4.4 - Security monitoring and alerting
Security+ SY0-701 objective 4.4 covers monitoring computing resources and turning activity into actionable alerts. A SOC maps observed attacker behaviours to a common catalogue of tactics and techniques using MITRE ATT&CK, which gives shared language for detection and hunting. Behavioural signals raise alerts: if one account authenticates from New York and Tokyo eight minutes apart, that is impossible travel, a strong risk indicator. Monitoring draws on logs, network flows, endpoints and applications, feeding tools that aggregate, correlate and alert. You should also understand log aggregation, scanning, benchmarks, alert tuning to cut false positives, and reporting and archiving. Expect scenario questions that describe suspicious activity or a monitoring method and ask which framework, signal or data source - MITRE ATT&CK, impossible travel, or a specific log source - applies.
Map attacker tactics/techniques = MITRE ATT&CK. One account, two distant places, minutes apart = impossible travel. Aggregate + correlate + alert on logs = monitoring. Tune alerts to cut false positives.
Practice questions
1. Which system aggregates and correlates logs from many sources for alerting and investigation?
- A DHCP server
- A SIEM (correct answer)
- A load balancer
- A KVM switch
A SIEM centralizes logs, correlates events, and raises alerts for investigation. SOAR adds automated response playbooks on top.
2. When collecting digital evidence, why do responders follow the order of volatility?
- To speed up the forensic disk backup
- To capture the most transient data first (correct answer)
- To free up storage space on the host
- To rotate the disk encryption keys
Order of volatility means collecting the most transient data first (CPU registers/cache, RAM, then disk, logs, archives) before it is lost, preserving evidence.
3. When a lawsuit is anticipated, an organization must issue a legal hold to:
- Delete old data quickly
- Preserve relevant data from deletion (correct answer)
- Encrypt all backups at once
- Publicly disclose the breach
A legal hold suspends normal deletion/retention so potentially relevant data is preserved for litigation/e-discovery. Overriding it can lead to spoliation sanctions.
4. Which record documents everyone who handled a piece of evidence and when, keeping it admissible?
- The service level agreement
- The chain of custody (correct answer)
- The acceptable use policy
- The business impact analysis
Chain of custody records who collected, handled and stored evidence, and when, so it stays tamper-evident and admissible in court. Gaps can render evidence unusable.
5. A team detects users' logins that behave oddly compared to their historical patterns. Which tool profiles this?
- A basic network packet sniffer
- User and entity behavior analytics (correct answer)
- A static IP address blocklist
- A DHCP address lease monitor
UEBA baselines normal user/entity behavior and flags deviations (odd hours, impossible travel, mass downloads), helping spot compromised accounts and insider threats.
6. An analyst reviews summarized who-talked-to-whom traffic records to spot data exfiltration. These records are:
- Full packet captures
- NetFlow/flow records (correct answer)
- Application source code
- BIOS firmware logs
Flow data (NetFlow/IPFIX) summarizes conversations (src/dst, ports, bytes) without full payload, efficient for spotting exfiltration, beaconing and unusual volumes at scale.