Domain 4 – Section B Review: Monitoring and Defense

This section integrates:

• Security Monitoring and Log Analysis
• Firewalls, IDS, and IPS
• Endpoint Detection and Response (EDR) and Data Loss Prevention (DLP)

Security+ expects you to understand how monitoring tools detect threats, how network defenses operate, and how endpoint and data protection complement each other.

1. Security Monitoring and Log Analysis

Monitoring provides visibility into what is happening across the environment:

If you are not monitoring, you are not detecting.
If you are not correlating, you are drowning in alerts.

• SIEM (Security Information and Event Management) — aggregates, correlates, and analyzes logs from multiple sources.
• Log sources — firewalls, servers, endpoints, applications, authentication systems.
• Alerting — rules and thresholds that trigger notifications for suspicious activity.
• Retention — logs must be stored long enough to support investigations and compliance.

Raw logs are data. Correlated logs are intelligence. SIEM turns data into actionable alerts.

2. Firewalls, IDS, and IPS

Network defense tools operate at different points and in different modes:

• Firewall — filters traffic based on rules (allow/deny by IP, port, protocol).
• IDS (Intrusion Detection System) — monitors and alerts on suspicious traffic but does not block.
• IPS (Intrusion Prevention System) — monitors and actively blocks malicious traffic inline.
• WAF (Web Application Firewall) — filters HTTP/HTTPS traffic to protect web applications.

IDS detects and alerts. IPS detects and blocks.
A firewall filters by rule. An IPS filters by behavior and signature.

False positives (legitimate traffic flagged as malicious) and false negatives (malicious traffic not detected) are the key tuning challenges.

3. Endpoint Detection and Data Loss Prevention

Protection at the endpoint and data level completes the defense strategy:

• EDR — monitors endpoint behavior, detects threats, and enables response actions (isolation, remediation).
• Antivirus/antimalware — signature-based detection of known threats.
• DLP — prevents unauthorized data transfers based on content inspection and policy.
• Host-based firewall — filters traffic at the individual endpoint level.

EDR goes beyond traditional antivirus by analyzing behavior patterns rather than relying solely on signatures. DLP focuses on protecting data regardless of the threat type.

Section B Decision Pattern

When unsure in Domain 4 Section B:

1. Determine if the scenario needs detection only (IDS) or detection and prevention (IPS).
2. Use SIEM when log correlation and alerting are required.
3. Apply DLP when the concern is data leaving the organization.
4. Use EDR when endpoint-level threat detection and response are needed.
5. Remember: WAF protects web applications; network firewalls protect network segments.

Section B – Practice Questions

Question 1

A security analyst reviews SIEM alerts and notices multiple failed login attempts from a single IP address across 15 different user accounts in a two-minute window. What type of attack does this suggest?

A. Brute force against a single account
B. Password spraying
C. Credential stuffing
D. Phishing

Question 2

An IDS generates an alert for traffic that is later confirmed to be a legitimate software update. What is this type of alert called?

A. True positive
B. False positive
C. True negative
D. False negative

Question 3

A company needs to prevent employees from uploading confidential documents to personal cloud storage services. Which technology is MOST appropriate?

A. IPS
B. SIEM
C. DLP
D. EDR

Question 4

An organization deploys an inline device that inspects all incoming traffic and automatically drops packets matching known attack signatures. What type of device is this?

A. IDS
B. Proxy server
C. SIEM
D. IPS

Question 5

A malware infection evades the company's signature-based antivirus. The security team deploys a tool that detects the malware by analyzing abnormal process behavior on the endpoint. What type of tool is this?

A. Network firewall
B. DLP agent
C. EDR solution
D. Vulnerability scanner

Question 6

A web application is targeted by SQL injection attacks. The network firewall does not detect the attacks because they arrive over HTTPS on port 443. What additional control should be implemented?

A. Deploy a WAF
B. Close port 443
C. Increase IDS sensitivity
D. Add more firewall rules

Question 7

A SIEM correlation rule triggers when it detects a user logging in from two geographically distant locations within 10 minutes. What type of detection is this?

A. Signature-based detection
B. Impossible travel detection
C. Heuristic scanning
D. Port scanning detection

Question 8

An organization's IPS is blocking legitimate business partner traffic due to overly aggressive rules. What should the security team do?

A. Disable the IPS entirely
B. Switch the IPS to IDS mode
C. Whitelist all business partner IP addresses from all inspection
D. Tune the IPS rules to reduce false positives while maintaining protection

Question 9

A security analyst needs to investigate a security incident that occurred three months ago. The analyst discovers that firewall logs older than 30 days have been deleted. What control failure occurred?

A. Insufficient log retention
B. Misconfigured alerting
C. Missing encryption
D. Inadequate access controls

Question 10

An EDR solution detects suspicious PowerShell activity on a workstation and automatically isolates the machine from the network while alerting the security team. What capability does this demonstrate?

A. Vulnerability scanning
B. Log aggregation
C. Automated incident response
D. Patch management