CCNA Cybersecurity Security Onion and SOC Tools Quiz

1. True or False: A SOC requires continuous monitoring and 24/7 alert response.

True

False

2. True or False: Security Onion can function as both an IDS and IPS simultaneously.

True

False

3. Which metric measures the time from alert generation to analyst acknowledgment?

Mean time to detect (MTTD)

Mean time to respond (MTTR)

Mean time to acknowledge (MTTA)

Mean time to resolve (MTTR)

4. What is the typical first step in SOC incident response workflow?

Alert detection and triage

System shutdown

Data deletion

Executive notification

5. True or False: Incident response playbooks are unnecessary in a mature SOC.

True

False

6. Which Security Onion component provides real-time network traffic analysis?

Zeek

Suricata

Wazuh

Elasticsearch

7. What is the primary benefit of network segmentation in a SOC architecture?

Reduces alert volume and improves detection accuracy

Eliminates the need for firewalls

Increases network bandwidth

Simplifies password management

8. True or False: Threat intelligence feeds can be integrated into Security Onion for enhanced detection.

True

False

9. Which log parsing tool is commonly used with Security Onion for structured data extraction?

Logstash

Fluentd

Filebeat

All of the above

10. What does the term 'false positive' mean in the context of IDS/IPS systems?

Legitimate traffic flagged as malicious

Malicious traffic not detected

System offline for maintenance

Firewall rule misconfiguration

11. What is the primary function of Security Onion in a SOC environment?

Network monitoring, IDS/IPS, and log aggregation

Firewall configuration and VPN management

User authentication and access control

Email encryption and data loss prevention

12. Which Security Onion component aggregates and indexes network flow data?

Suricata

Zeek

Elasticsearch

Logstash

13. What is the primary role of Wazuh in a Security Onion deployment?

Endpoint detection and response

Network intrusion detection

Web application firewall

DNS filtering

14. True or False: SOC analysts use SIEM tools exclusively for network packet analysis.

True

False

15. Which protocol is commonly used for log forwarding to a SIEM system?

SNMP

Syslog

SMTP

SSH

16. What visualization tool does Security Onion use for real-time data analysis?

Grafana

Kibana

Splunk

Tableau

17. True or False: Snort and Suricata are both IDS/IPS engines supported in Security Onion.

True

False

18. Which of the following is a primary data store in Security Onion?

MySQL

Elasticsearch

PostgreSQL

MongoDB

19. What does SIEM stand for in the context of SOC tools?

Security Information and Event Management

Secure Internet Exchange Management

System Integration and Endpoint Monitoring

Security Infrastructure Event Module

20. Which component of Security Onion is responsible for detecting intrusions?

Elasticsearch

Suricata

Kibana

Wazuh

CCNA Cybersecurity Security Onion and SOC Tools Quiz

1. True or False: A SOC requires continuous monitoring and 24/7 alert response.

2.

What first name or nickname would you like us to use?

2. True or False: Security Onion can function as both an IDS and IPS simultaneously.

3. Which metric measures the time from alert generation to analyst acknowledgment?

4. What is the typical first step in SOC incident response workflow?

5. True or False: Incident response playbooks are unnecessary in a mature SOC.

6. Which Security Onion component provides real-time network traffic analysis?

7. What is the primary benefit of network segmentation in a SOC architecture?

8. True or False: Threat intelligence feeds can be integrated into Security Onion for enhanced detection.

9. Which log parsing tool is commonly used with Security Onion for structured data extraction?

10. What does the term 'false positive' mean in the context of IDS/IPS systems?

11. What is the primary function of Security Onion in a SOC environment?

12. Which Security Onion component aggregates and indexes network flow data?

13. What is the primary role of Wazuh in a Security Onion deployment?

14. True or False: SOC analysts use SIEM tools exclusively for network packet analysis.

15. Which protocol is commonly used for log forwarding to a SIEM system?

16. What visualization tool does Security Onion use for real-time data analysis?

17. True or False: Snort and Suricata are both IDS/IPS engines supported in Security Onion.

18. Which of the following is a primary data store in Security Onion?

19. What does SIEM stand for in the context of SOC tools?

20. Which component of Security Onion is responsible for detecting intrusions?