1
Q
Deterministic Assessment Method
A
Known values to yield outcome for each proposed scenario
2
Q
Probabilistic Assessment Method
A
Consider a wide range of probable scenarios. Less accurate
3
Q
Syslog TAG field
A
Process that generated the message
4
Q
Syslog CONTENT field
A
Displays contents of the message
5
Q
ELSA search operators (2)
A
Boolean + Directives
6
Q
Fast flux
A
IP address mapping to DNS changes rapidly
7
Q
Double IP Flux
A
Name server and IP address changes rapidly
8
Q
DGA
A
Random domain names created rapidly. Often for C2
CCNA Cyber Ops SECOPS
flashcards
Decks in class (19)
# Cards
-
SECOPS 1: Defining the SOC24
-
SECOPS 2: NSM Tools and Data11
-
Security Onion1
-
SECOPS 3: Incident Analysis in a Threat Centric SOC20
-
SECOPS 4: Hunting Cyber Threats41
-
SECOPS 5: Event correlation and normalization23
-
SECOPS 6: Common Attack Vectors32
-
SECOPS 7: Identifying Malicious Activity8
-
Regex14
-
SECOPS 98
-
SECOPS 10: SOC Playbook (Not needed for the exam)13
-
SECOPS 11: SOC Metrics7
-
SECOPS 12: SOC WMS and Automation18
-
SECOPS 13: Incident Response Plan20
-
Appendix A: CSIRT13
-
Appendix B: VERIS8
-
RFI36
-
NIST 800-61r29
-
Blueprint60
