M20-01Security Monitoring · quiz
SOC Triage
You're on the security desk with a stack of alerts. Read the flows, name the attack patterns, and make the right triage call - the core skills of network defence.
1
Which fields make up the 5-tuple that identifies a network flow?
2
One internal host is opening connections to hundreds of different ports on a single server in seconds. What is this?
3
An infected host contacts the same external IP every 60 seconds with tiny requests. Which pattern is this?
4
What is the correct order of the incident response lifecycle?
5
An IDS alert fires but investigation shows the traffic was a legitimate backup. How do you classify it?