Free Practice Quiz Question List

5 Security Monitoring and Detection Online Quiz Questions

Use this free practice quiz with 20 questions to review 5 Security Monitoring and Detection, test your knowledge, and prepare for your next test or exam.

20 questions

True or false

1 point

True or false: If a log source suddenly stops producing events, it is safe to assume that the monitored system is simply quiet.

A
True
B
False

Choose one

1 point

An analyst finds that events from two systems appear in the wrong order because their clocks differ. Which logging practice would best prevent this problem?

A
Discard time-zone information so timestamps use fewer fields.
B
Synchronize system clocks and retain time-zone information where relevant.
C
Sort events by the order in which they arrive at the collection service.
D
Use the endpoint timestamp for every event, regardless of its source.

Written response

1 point

What is the process of connecting records from multiple sources using shared details such as an account, device, or time?

Fill in the blank

1 point

In a monitoring pipeline, records are converted into consistent fields and supplemented with context such as asset owner or system criticality. This stage is called .

Choose one

1 point

An analyst must decide which of several alerts to review first. Which approach best supports risk-based prioritization?

A
Rank alerts only by how many events triggered each rule.
B
Suppress alerts from critical systems to reduce analyst workload.
C
Consider confidence, potential impact, asset criticality, scope, and urgency.
D
Give every alert the same priority until an incident is confirmed.

Choose all

1 point

A team is reviewing safeguards for its log pipeline. Which practices should it adopt? Select all that apply.

A
Forward records to an authorized, centrally managed collection service.
B
Allow all staff to change stored records so they can add investigation notes directly.
C
Protect data in transit and monitor whether sources stop sending.
D
Restrict access to stored records and preserve their integrity.

True or false

1 point

True or false: A security alert alone proves that an incident has occurred.

A
True
B
False

Written response

1 point

What should analysts establish to describe ordinary activity for users, systems, and services?

Fill in the blank

1 point

Before monitoring begins, a team identifies critical assets, logging requirements, response roles, escalation paths, and incident criteria. In the monitoring workflow, this step is .

Choose one

1 point

An identity log shows repeated failed sign-ins followed by a successful sign-in from an unfamiliar location. What is the most appropriate initial response?

A
Treat the successful sign-in as proof of an incident and immediately declare a breach.
B
Investigate the pattern, while gathering context before deciding whether it indicates an incident.
C
Ignore the failures because a successful sign-in followed them.
D
Close the alert unless the account owner confirms that the location is unfamiliar.

Choose all

1 point

An organization wants to investigate possible misuse of administrator accounts that access cloud services from managed devices. Which telemetry sources are directly relevant to that investigation? Select all that apply.

A
Collect identity sign-in and privilege-use records relevant to the administrator accounts.
B
Collect every available data source, even if it has no connection to important assets or likely threats.
C
Collect cloud audit records of relevant administrative actions and configuration changes.
D
Collect endpoint telemetry from devices used to access the management environment.

Open ended

1 point

Identity logs show a successful administrator sign-in after many failed attempts. Cloud audit logs then show creation of a new credential, and endpoint telemetry shows access to a management console from the same device. Describe how an analyst should investigate and decide whether to escalate.

Choose one

1 point

A team is preparing a new detection rule for production. Which plan is most likely to make the rule useful and manageable?

A
Define clear logic, ownership, severity, and response guidance, then test with representative data.
B
Deploy the rule without testing so its performance reflects live conditions.
C
Suppress every alert that repeats, even if the activity differs or presents higher risk.
D
Measure only total event count because it captures detection quality.

Choose one

1 point

An organization is planning its monitoring coverage. Which approach best balances investigative value with cost and noise?

A
Collect every available log so investigators never lack data.
B
Select sources based on important assets, likely threats, and investigation needs.
C
Collect only application logs because they contain user actions.
D
Limit collection to security-tool alerts to avoid noisy data.

Written response

1 point

Which log-management stage converts records into consistent fields and adds context such as asset owner or system criticality?

Written response

1 point

When relevant, what information should be retained alongside synchronized system timestamps to help interpret event times across locations?

True or false

1 point

True or false: Analysts should escalate every alert to the incident-response team without validating the evidence or checking incident criteria.

A
True
B
False

Choose one

1 point

A normally active endpoint stops sending logs. What is the best monitoring response?

A
Disable the source because no events means there is no activity.
B
Treat the gap as proof that an attacker has tampered with the logs.
C
Check source status and pipeline health, since a lull or a collection failure could explain the gap.
D
Increase alert severity for every system that has not sent an event.

Choose one

1 point

A team must prioritize two alerts: one involves many low-impact events, while the other involves a smaller number of events affecting a critical system. Which approach is most appropriate?

A
Rank alerts only by the number of events that triggered them.
B
Consider confidence, potential impact, asset criticality, scope, and urgency.
C
Prioritize the newest alert regardless of its evidence or affected system.
D
Treat alerts from the same rule as equally important.

Choose one

1 point

A detection rule generates frequent false positives. How should its owner reduce noise while preserving detection of more serious behavior?

A
Suppress the entire rule whenever it produces false positives.
B
Keep the rule unchanged because any suppression reduces security.
C
Raise the severity of every alert from that rule.
D
Tune the rule carefully and verify that suppression does not hide different or higher-risk activity.