D340 Cyber Defense and Countermeasures - Set 3 - Part 1

Correct Answer: Continuously observing systems to detect malicious or anomalous activity

Monitoring provides the visibility needed to detect attacks that bypass preventive controls, enabling response before significant damage occurs.

Correct Answer: A recorded entry documenting an event that occurred on a system

Logs record events such as logins, configuration changes, and errors, forming the evidentiary basis for detection, investigation, and accountability.

Correct Answer: Attackers commonly clear local logs to hide their activity

Centralizing logs preserves evidence beyond the attacker's reach on a compromised host and enables correlation across many systems.

Correct Answer: Combining events from multiple sources to reveal patterns invisible individually

Correlation links related events across systems, so a failed login sequence followed by a successful login and privilege change is recognized as one attack pattern.

Correct Answer: Collecting, correlating, and alerting on security event data

A SIEM aggregates log and event data from across the environment, applies correlation rules, and generates alerts for investigation.

Correct Answer: An alert generated for activity that is actually benign

A false positive flags legitimate activity as malicious. Excessive false positives cause alert fatigue, leading analysts to overlook genuine incidents.

Correct Answer: A real attack that the system failed to detect

A false negative is a genuine attack that produced no alert, representing a detection gap that allows the intrusion to proceed unnoticed.

Correct Answer: It reduces false positives so analysts can focus on genuine threats

Untuned rules generate overwhelming noise. Tuning to the environment's normal behavior preserves detection while making the alert queue actionable.

Correct Answer: Analysts becoming desensitized due to excessive low-value alerts

When most alerts are noise, analysts begin dismissing them reflexively, causing genuine incidents to be missed among the volume.

Correct Answer: A model of normal activity used to identify deviations

Establishing what normal looks like for users, systems, and traffic allows detection of meaningful deviations that may indicate compromise.

Correct Answer: Detecting anomalies by modeling normal behavior of users and systems

UEBA builds behavioral profiles and flags deviations such as unusual access times or data volumes, detecting insider threats and compromised accounts.

Correct Answer: Login from an unusual location immediately after a normal local login

Geographically impossible travel between logins strongly suggests credential compromise, since one user cannot be in both locations simultaneously.

Correct Answer: Proactively searching for threats that evaded automated detection

Threat hunting proactively investigates hypotheses about attacker presence, finding intrusions that produced no alert because no rule matched them.

Correct Answer: Hunting is hypothesis-driven and proactive rather than reactive to alerts

Triage responds to alerts the system generated. Hunting starts from a hypothesis about attacker behavior and searches data for evidence, requiring no prior alert.

Correct Answer: A knowledge base of adversary tactics and techniques observed in the wild

ATT&CK catalogs real-world adversary tactics and techniques, providing a common language for describing behavior and assessing detection coverage.

Correct Answer: Mapping existing detections to techniques to reveal gaps

Mapping detection capabilities against ATT&CK techniques exposes which adversary behaviors would currently go unnoticed, guiding detection engineering priorities.

Correct Answer: The discipline of designing, testing, and maintaining detection logic

Detection engineering treats detections as engineered artifacts that are designed, tested against real behavior, version-controlled, and maintained over time.

Correct Answer: Untested rules may never fire during an actual attack

A rule that looks correct may fail against real technique variations. Validating against emulated attacker behavior confirms it actually detects what it targets.

Correct Answer: Safely reproducing known attacker techniques to test defenses

Adversary emulation executes realistic attacker techniques in a controlled manner to validate whether detection and response capabilities actually work.

Correct Answer: Offensive and defensive teams collaborating to improve detection

Purple teaming has attackers and defenders work together, executing techniques while defenders verify and improve detection in real time.