RANGER CompTIA Security+ (SY0-701) · chapter 17 of 27
Month 7: The SIEM never sleeps (but you should)
In this chapter Objectives 4.4, 4.7
Objective 4.4
Monitoring and alerting
What we monitor
Three layers of computing resources: Systems (servers, workstations: CPU, logins, processes), Applications (errors, failed logins, unusual transactions in the shop app) and Infrastructure (network devices, firewalls, cloud services, power). Missing any layer leaves a blind spot.
Monitoring activities
The workflow behind every alert:
- Log aggregation: collect logs from everywhere into one place in a common format.
- Alerting: rules or analytics raise an alert when something matches. Scanning: regular vulnerability and config scans.
- Reporting: summaries for operations and management. Archiving: keep older logs in cheaper storage for investigations and compliance.
- Alert response and remediation/validation: act on alerts, for example quarantine an infected host, then confirm it is fixed.
- Alert tuning: adjust rules to cut false positives without creating false negatives.
Exam tip Trap: tuning means making alerts more accurate, not just turning noisy ones off.
Monitoring tools, part 1
SIEM (security information and event management): aggregates and correlates logs, alerts and dashboards in one place. SCAP (Security Content Automation Protocol): NIST standards that let tools check configurations and vulnerabilities automatically in a common language. Benchmarks (such as CIS Benchmarks): published secure-configuration guides that SCAP tools can test against. Agents/agentless: an agent is software installed on the host (deep visibility, must be maintained); agentless collects remotely (nothing to install, less detail).
Monitoring tools, part 2
More tools that feed monitoring:
- Antivirus: detects and removes known malware on endpoints.
- DLP (data loss prevention): spots and blocks sensitive data leaving by email, web, USB or cloud.
- SNMP traps: a device sends an unrequested alert to the management station (UDP 162) when something happens. Use SNMPv3 for security.
- NetFlow: records flow metadata (who talked to whom, ports, how much), not packet contents.
- Vulnerability scanners: find missing patches and weak settings across systems.
Exam tip Exam tip: "how much data went where" without content = NetFlow. Full contents = packet capture.
Objective 4.7
Automation and orchestration
Use cases of automation and scripting
Automate repeatable, rule-based work:
- User provisioning and resource provisioning: create accounts and servers from templates, the same way every time.
- Guard rails: automatic checks that block unsafe actions (no public storage buckets). Security groups: apply firewall-like rules automatically.
- Ticket creation and escalation: open a ticket from an alert and escalate it if nobody acts in time.
- Enabling/disabling services and access: disable a compromised account in seconds.
- Continuous integration and testing: run security tests on every code change. Integrations and APIs connect tools so they share data and act together.
Benefits
Why automate: efficiency/time saving; enforcing baselines and standard infrastructure configurations (no drift, no typos); scaling in a secure manner (100 servers built as safely as one); employee retention (fewer boring tasks, less burnout); faster reaction time (machine speed containment); and a workforce multiplier (a small team does the work of a large one). Orchestration (often a SOAR platform) chains automated steps into a full playbook.
Other considerations
Automation has costs too: complexity (more moving parts to understand), cost (tools, development time), a single point of failure (if the automation platform breaks, everything it does stops), technical debt (quick scripts nobody documents become future problems) and ongoing supportability (someone must maintain scripts as systems change).
Exam tip Trap: automation does not remove the need for people. It multiplies them. Bad automation also does bad things faster.
Check yourself 1Priya wants to know which internal host sent 40 GB to an unknown external address last night, but does not need the content of the traffic. Which data source fits BEST?
- NetFlow records
- SNMP traps
- Antivirus logs
- SCAP benchmark results
Show the answer
Answer: A. NetFlow records
NetFlow records flow metadata (source, destination, ports, bytes), which answers who sent how much to where without packet contents.
Check yourself 2The team scripts new-hire account creation so every account gets the same groups, MFA and expiry rules. Which benefit does this MOST directly provide?
- Workforce multiplier for incident response
- Fewer single points of failure in the identity system
- Enforcing baselines and standard configurations
- Lower technical debt
Show the answer
Answer: C. Enforcing baselines and standard configurations
Automated provisioning applies the same approved settings every time, enforcing a consistent baseline with no human typos.
Practice questions
Answer in your head, then open the answer. Ranger's Cyber Patrol has 60 questions like these for Security+, with mock exams.
Question 1Four SIEM alerts arrive within minutes (exhibit). Which should the analyst investigate FIRST?
- Alert 3, the printer's link trap
- Alert 1, the quarantined file on LT-IT-07
- Alert 2, the Domain Admins change on DC01
- Alert 4, the blocked port scan at the edge
Show the answer
Answer: C. Alert 2, the Domain Admins change on DC01
An unapproved addition to Domain Admins on a domain controller could mean an attacker already holds the highest privileges, and nothing has stopped it. Both High alerts were already handled: the test file was quarantined and the scan was blocked.
Question 2A SIEM rule alerts when one account has 5 or more failed logons in 10 minutes. It stayed silent during the activity in the exhibit. What is the BEST tuning change?
- Widen the per-account window from 10 minutes to one full hour
- Disable the rule, because it produced a false negative
- Lower the per-account threshold from 5 failures to 2
- Add a rule for one source failing against many accounts
Show the answer
Answer: D. Add a rule for one source failing against many accounts
Password spraying tries one password against many accounts, so a per-account count never trips. Counting failures per source across many accounts catches it; a lower or wider per-account threshold still sees one failure each.
Question 3An analyst cannot line up events in the SIEM during an investigation. All three records in the exhibit describe the same connection. What should be fixed so that future correlation works?
- Sync Web-03 to NTP and normalize all time stamps to UTC
- Collect the logs with agents instead of syslog
- Shorten the SIEM's correlation window to one second
- Switch every device to local time and drop the time zone fields
Show the answer
Answer: A. Sync Web-03 to NTP and normalize all time stamps to UTC
Correlation needs accurate, comparable time: Web-03 needs NTP to stop drifting, and the SIEM should store every event in one zone, usually UTC. DC01 is already correct once its offset is applied.
Question 4Kibble & Co. must keep security logs for one year and be able to search them during investigations. Its SIEM keeps 90 days in hot storage, and keeping nine more months there would triple the license cost. Which approach BEST meets the requirement?
- Sample the logs so the SIEM stores only one event in ten
- Archive older logs to cheap, write-protected, restorable storage
- Have each team keep its own logs on its servers for a year
- Delete the logs after 90 days and keep only monthly summary reports
Show the answer
Answer: B. Archive older logs to cheap, write-protected, restorable storage
Archiving moves aged logs to cheaper storage while keeping them complete and protected from change, so they can be restored for an investigation. Sampling and summaries throw away the detail investigations need.
Question 5A SOAR playbook isolates any host from the network when EDR raises a High alert, then opens a ticket and pages on-call. Its scope is all endpoints and servers. After a false positive, it isolated domain controller DC01 and sign-ins failed company-wide for 40 minutes. Which change BEST keeps the speed benefit while avoiding a repeat?
- Require analyst approval before isolating critical servers
- Remove the isolation step from the playbook entirely for all hosts
- Trigger the playbook only on Critical alerts
- Run the playbook only during business hours
Show the answer
Answer: A. Require analyst approval before isolating critical servers
Automatic isolation is valuable for laptops, but critical servers such as domain controllers need a human decision, because a false positive there causes an outage. Removing isolation or raising the trigger gives up speed for every host.
CompTIA, A+, Network+, Security+ and Linux+ are trademarks of CompTIA, Inc. Ranger Gamez is not affiliated with or endorsed by CompTIA. The practice questions are written to the published exam objectives; they are not real exam questions.