CCNA Cybersecurity Security Onion and SOC Tools Quiz

1. True or False: A SOC requires continuous monitoring and 24/7 alert response.

True

False

2. True or False: Security Onion can function as both an IDS and IPS simultaneously.

True

False

3. What is the typical first step in SOC incident response workflow?

Alert detection and triage

System shutdown

Data deletion

Executive notification

4. What is the primary benefit of network segmentation in a SOC architecture?

Reduces alert volume and improves detection accuracy

Eliminates the need for firewalls

Increases network bandwidth

Simplifies password management

5. What does the term 'false positive' mean in the context of IDS/IPS systems?

Legitimate traffic flagged as malicious

Malicious traffic not detected

System offline for maintenance

Firewall rule misconfiguration

6. What is the primary function of Security Onion in a SOC environment?

Network monitoring, IDS/IPS, and log aggregation

Firewall configuration and VPN management

User authentication and access control

Email encryption and data loss prevention

7. What is the primary role of Wazuh in a Security Onion deployment?

Endpoint detection and response

Network intrusion detection

Web application firewall

DNS filtering

8. Which protocol is commonly used for log forwarding to a SIEM system?

SNMP

Syslog

SMTP

SSH

9. True or False: Snort and Suricata are both IDS/IPS engines supported in Security Onion.

True

False

10. True or False: SOC analysts use SIEM tools exclusively for network packet analysis.

True

False

11. Which Security Onion component aggregates and indexes network flow data?

Suricata

Zeek

Elasticsearch

Logstash

12. What visualization tool does Security Onion use for real-time data analysis?

Grafana

Kibana

Splunk

Tableau

13. Which log parsing tool is commonly used with Security Onion for structured data extraction?

Logstash

Fluentd

Filebeat

All of the above

14. True or False: Threat intelligence feeds can be integrated into Security Onion for enhanced detection.

True

False

15. Which of the following is a primary data store in Security Onion?

MySQL

Elasticsearch

PostgreSQL

MongoDB

16. Which Security Onion component provides real-time network traffic analysis?

Zeek

Suricata

Wazuh

Elasticsearch

17. True or False: Incident response playbooks are unnecessary in a mature SOC.

True

False

18. What does SIEM stand for in the context of SOC tools?

Security Information and Event Management

Secure Internet Exchange Management

System Integration and Endpoint Monitoring

Security Infrastructure Event Module

19. Which metric measures the time from alert generation to analyst acknowledgment?

Mean time to detect (MTTD)

Mean time to respond (MTTR)

Mean time to acknowledge (MTTA)

Mean time to resolve (MTTR)

20. Which component of Security Onion is responsible for detecting intrusions?

Elasticsearch

Suricata

Kibana

Wazuh

CCNA Cybersecurity Security Onion and SOC Tools Quiz

1. True or False: A SOC requires continuous monitoring and 24/7 alert response.

2.

What first name or nickname would you like us to use?

2. True or False: Security Onion can function as both an IDS and IPS simultaneously.

3. What is the typical first step in SOC incident response workflow?

4. What is the primary benefit of network segmentation in a SOC architecture?

5. What does the term 'false positive' mean in the context of IDS/IPS systems?

6. What is the primary function of Security Onion in a SOC environment?

7. What is the primary role of Wazuh in a Security Onion deployment?

8. Which protocol is commonly used for log forwarding to a SIEM system?

9. True or False: Snort and Suricata are both IDS/IPS engines supported in Security Onion.

10. True or False: SOC analysts use SIEM tools exclusively for network packet analysis.

11. Which Security Onion component aggregates and indexes network flow data?

12. What visualization tool does Security Onion use for real-time data analysis?

13. Which log parsing tool is commonly used with Security Onion for structured data extraction?

14. True or False: Threat intelligence feeds can be integrated into Security Onion for enhanced detection.

15. Which of the following is a primary data store in Security Onion?

16. Which Security Onion component provides real-time network traffic analysis?

17. True or False: Incident response playbooks are unnecessary in a mature SOC.

18. What does SIEM stand for in the context of SOC tools?

19. Which metric measures the time from alert generation to analyst acknowledgment?

20. Which component of Security Onion is responsible for detecting intrusions?