Summary questions on security incident management

From this question you will receive only correct/incorrect feedback. Each student will have at least one correct option randomly assigned, usually more. For a partially correct answer, Plussa gives incorrect feedback, but the task is accepted when the score is 12 or higher and the points are shown on a yellow background. Points start to accumulate only once more than half of the selections in the task are correct. From the score, it is not possible to directly determine whether an individual selection is correct or not.

Select the correct statements. You may select one or more options.

Question 1

ISAC improves threat detection.

A demilitarised zone does not allow traffic into a private network.

IDPS sensors detect events that may generate alerts.

Event data is automated in order to reduce human error.

Security operations centres perform monitoring and incident response automatically.

Changes in operating conditions mean that monitoring, analysis, planning, and execution must be carried out continuously.

Cloud services increase the amount of available traces.

An alert is responded to with actions or forwarded to analysts for evaluation.

The main advantage of SOAR platforms is the reduced need for human analysis.

CERT organisations produce reliable cyber‑threat intelligence for security operations centres.

Log files can serve as a data source for system events.

Posting submission...