D329 Networks and Security Applications - Set 3 - Part 3

Correct Answer: A sophisticated adversary maintaining long-term covert access to a target

An APT is a well-resourced adversary that gains access and remains undetected for extended periods, pursuing strategic objectives such as espionage.

Correct Answer: Information about adversaries and their techniques used to improve defenses

Threat intelligence provides actionable information about attacker tactics, techniques, and indicators, allowing defenders to anticipate and detect relevant threats.

Correct Answer: Observable evidence suggesting a system has been breached

IOCs are forensic artifacts such as malicious file hashes, suspicious domains, or unusual registry changes that indicate potential compromise.

Correct Answer: It preserves evidence attackers might delete locally and enables correlation

Forwarding logs to a protected central system preserves them even if an attacker clears local logs, and enables correlation of activity across many systems.

Correct Answer: How long logs are kept to support investigation and compliance

Retention policy balances investigative and regulatory needs, which favor longer retention, against storage cost and privacy considerations.

Correct Answer: Ensuring log timestamps correlate accurately across systems

Accurate synchronized time is essential for correlating events across systems during investigation. Inconsistent clocks make reconstructing an incident timeline unreliable.

Correct Answer: A control that identifies incidents after they occur, such as log monitoring

Detective controls identify that an event has occurred, complementing preventive controls that stop events and corrective controls that restore normal operation.

Correct Answer: A firewall blocking unauthorized connections

Preventive controls stop undesired events from occurring. Logs are detective, backups are corrective, and alerts are detective notifications.

Correct Answer: It reduces the success of attacks that target human judgment

Many successful attacks depend on a person clicking, disclosing, or granting something. Training reduces that success rate but complements rather than replaces technical controls.

Correct Answer: Regular testing, monitoring, and independent assessment

Controls degrade, get misconfigured, and are bypassed. Only ongoing testing, monitoring, and independent assessment provide genuine assurance that they function as intended.