AP®︎ Cybersecurity: Topic 3.5 Flashcards

A time-ordered record of events that may include timestamps, addresses, ports, protocols, traffic amounts, actions, and alerts

A record of packets observed at a monitoring point, used to examine addresses, ports, protocols, and traffic patterns

An automated tool that analyzes network data for malicious activity and generates an alert when its detection criteria are met

A tool that detects malicious network activity and can halt or mitigate it by blocking addresses, closing ports, rejecting protocols, or interrupting traffic

A system that collects and correlates security data from multiple sources to detect suspicious patterns and raise alerts for investigation

Using AI algorithms to analyze large data sets, classify patterns as malicious or normal, and report probabilistic threat likelihoods

The threat-likelihood percentage at which a system generates an alert; lower thresholds create more alerts and false positives, while higher thresholds risk missed attacks

Detection that quickly compares observed data with stored signatures of known IoCs; it suits high traffic but requires updates and cannot detect attacks without signatures

Detection that compares activity with a clean baseline and alerts on deviations beyond a tolerance range; it can find novel attacks but costs more and produces more false positives

Detection combining signature-based and anomaly-based methods for known and novel threats, with greater cost and alert volume

Legitimate or nonmalicious activity incorrectly classified as malicious, wasting investigative resources and potentially contributing to alert fatigue

Malicious activity that bypasses detection without an appropriate alert or action, allowing the attack to continue

A condition in which responders become accustomed to false alerts and take new alerts less seriously

Evidence of possible malicious activity found in network traffic, logs, or packet captures, such as malicious IP connections, scans, traffic changes, or port-application mismatches

Scan for suspiciously similar or duplicate local SSIDs and investigate unfamiliar access-point identifiers or unexpected signal locations

Locating a wireless transmitter by comparing signal-strength measurements from multiple physical positions

Look for wireless connection failures concentrated in one physical area and scan that area for strong electromagnetic noise in the wireless range

Monitor for unusual ARP messages, especially duplicate MAC-address claims, and check the default gateway's ARP table for incorrect mappings

Look for a surge of Ethernet frames with many different source MAC addresses and inspect the switch's MAC address table

After an unexplained drop in legitimate website traffic, inspect DNS records for unexpected addresses or altered name-to-address mappings

Watch for a sudden increase in ICMP requests directed to a network's broadcast address