AP®︎ Cybersecurity: Topic 4.4 Flashcards

Identifying evidence that an adversary is attempting to compromise, has compromised, or is misusing an individual device

A chronological record of device events such as logins, process activity, file actions, software changes, and configuration changes

Placing related log events in chronological order and correlating fields such as accounts, sources, processes, paths, and devices

Evidence that an adversary has compromised a device or network

Evidence found in device logs or configuration settings, such as unusual files, unexpected processes or services, unauthorized configuration changes, or unauthorized software installations or updates

Evidence found by examining device files, such as a known-malware hash, recognized malicious filename, or suspicious file path

Suspicious conduct found in activity logs, such as repeated login failures, unusual logins, unauthorized access, or privilege-elevation attempts

Detection that matches files or events to known threat patterns; it is fast, resource-efficient, and precise but easier to bypass

Detection that flags significant deviations from normal activity; it can find unfamiliar attacks but uses more resources and produces more false positives

A combination of signature-based and anomaly-based detection that broadens protection but generally requires more resources and expense

A detection result that incorrectly identifies legitimate activity as an attack

A unified endpoint threat-detection service that typically provides centralized monitoring and alerts across an organization’s devices

A record of attempted logins whose frequency, timing, accounts, sources, outcomes, and context can reveal attack patterns