Summarizing the Techniques Used in Security Assessments
In this sample chapter from CompTIA Security+ SY0-601 Cert Guide, 5th Edition, you will learn how the threat-hunting process leverages threat intelligence.
This chapter is from the book
This chapter is from the book
This chapter is from the book
This chapter covers the following topics related to Objective 1.7 (Summarize the techniques used in security assessments) of the CompTIA Security+ SY0-601 certification exam:
Threat hunting
Intelligence fusion
Threat feeds
Advisories and bulletins
Maneuver
Vulnerability scans
False positives
False negatives
Log reviews
Credentialed vs. non-credentialed
Intrusive vs. non-intrusive
Application
Web application
Network
Common Vulnerabilities and Exposures (CVE) and Common Vulnerability Scoring System (CVSS)
Configuration review
Syslog/Security information and event management (SIEM)
Review reports
Packet capture
Data inputs
User behavior analysis
Sentiment analysis
Security monitoring
Log aggregation
Log collectors
Security orchestration, automation, and response (SOAR)
This chapter starts by introducing threat hunting and how the threat-hunting process leverages threat intelligence. Then you learn about vulnerability management tasks, such as keeping up with security advisories and performing vulnerability scans. You also learn about the importance of collecting logs (such as system logs [syslogs]) and analyzing those logs in a Security Information and Event Management (SIEM) system. In addition, you learn how security tools and solutions have evolved to provide Security Orchestration, Automation, and Response (SOAR) capabilities to better defend your network, your users, and your organizations overall.
“Do I Know This Already?” Quiz
The “Do I Know This Already?” quiz enables you to assess whether you should read this entire chapter thoroughly or jump to the “Chapter Review Activities” section. If you are in doubt about your answers to these questions or your own assessment of your knowledge of the topics, read the entire chapter. Table 7-1 lists the major headings in this chapter and their corresponding “Do I Know This Already?” quiz questions. You can find the answers in Appendix A, “Answers to the ‘Do I Know This Already?’ Quizzes and Review Questions.”
Table 7-1 “Do I Know This Already?” Section-to-Question Mapping
Foundation Topics Section |
Questions |
|---|---|
Threat Hunting |
1–3 |
Vulnerability Scans |
4–6 |
Syslog and Security Information and Event Management (SIEM) |
7–8 |
Security Orchestration, Automation, and Response (SOAR) |
9–10 |
What is the act of proactively and iteratively looking for threats in your organization that may have bypassed your security controls and monitoring capabilities?
Threat intelligence
Threat hunting
Threat binding
None of these answers are correct.
Which of the following provides a matrix of adversary tactics, techniques, and procedures that modern attackers use?
ATT&CK
CVSS
CVE
All of these answers are correct.
Which identifier is assigned to disclosed vulnerabilities?
CVE
CVSS
ATT&CK
TTP
Which broad term describes a situation in which a security device triggers an alarm, but no malicious activity or actual attack is taking place?
False negative
True negative
False positive
True positive
Which of the following is a successful identification of a security attack or a malicious event?
True positive
True negative
False positive
False negative
Which of the following occurs when a vulnerability scanner logs in to the targeted system to perform deep analysis of the operating system, running applications, and security misconfigurations?
Credentialed scan
Application scan
Noncredentialed scan
None of these answers are correct.
Which of the following are functions of a SIEM?
Log collection
Log normalization
Log correlation
All of these answers are correct.
Which solution allows security analysts to collect network traffic metadata?
NetFlow
SIEM
SOAR
None of these answers are correct.
Which solution provides capabilities that extend beyond traditional SIEMs?
SOAR
CVSS
CVE
IPFIX
Which of the following can be capabilities and benefits of a SOAR solution?
Automated vulnerability assessment
SOC playbooks and runbook automation
Orchestration of multiple SOC tools
All of these answers are correct.