Security Operations
Which tool aggregates and correlates logs from many sources for real-time analysis?+
- • WAF
- • DLP
- ✓ SIEM
- • NAC
A SIEM collects, normalizes and correlates events across systems to produce alerts. An IDS inspects traffic but does not aggregate logs organization-wide.
What does SOAR primarily add on top of a SIEM?+
- • Long-term log storage
- • Full packet capture
- • Vulnerability scanning
- ✓ Automated response playbooks and orchestration
SOAR orchestrates tools and automates response steps through playbooks, which reduces manual triage and response time.
Which tool monitors endpoints for suspicious process behavior and can isolate a host?+
- ✓ EDR
- • SIEM
- • IPS
- • CASB
Endpoint detection and response collects endpoint telemetry (processes, files, network), detects malicious behavior and can isolate hosts.
Which command-line tool captures packets on a Linux server?+
- • nslookup
- ✓ tcpdump
- • netstat
- • strings
tcpdump captures packets from the command line and can write pcap files. Wireshark provides a GUI for deep analysis.
Which tool quickly extracts readable text such as URLs and IPs from a suspicious binary?+
- • tcpdump
- • dig
- ✓ strings
- • chmod
strings shows printable text in a binary, revealing URLs, IPs, file paths and commands. It is safe static analysis because nothing is executed.
Where should an analyst safely run a suspicious attachment to observe its behavior?+
- • A production workstation
- • The domain controller
- • A shared file server
- ✓ An isolated sandbox
A sandbox such as Cuckoo or Joe Sandbox runs the sample in isolation and records file, registry, process and network behavior.
