HomeSubjectsUniversityBlogAbout

Security Monitoring

Topic in Cyber Security

210 total MCQsShowing 30 with explanations10 Easy10 Medium10 Hard
Start Timed Quiz on Security MonitoringBack to Cyber Security

About This Topic

Security monitoring is the continuous collection and analysis of logs, network traffic and endpoint activity to detect threats and policy violations. SIEM platforms are central: log aggregation, correlation rules, dashboards, and tuning to cut false positives and alert fatigue. You should compare signature-based with anomaly-based detection, and place EDR, XDR, network IDS, DLP and SOAR automation within a SOC workflow. Team exercises matter too, with red, blue and purple teams, threat hunting, and metrics such as mean time to detect. Frameworks used to organize monitoring, including the NIST Cybersecurity Framework functions and the MITRE ATT&CK matrix, also come up.

Below are 30 practice questions from a pool of 210 Security Monitoring MCQs, one of 16 topics in Cyber Security. Each shows the correct answer with an explanation; when you are ready, take a timed quiz to test recall under exam conditions.

Practice Questions

Each question below shows the correct answer with a full explanation. Use these to build conceptual understanding before attempting a timed quiz.

Security MonitoringEasy

Q1. What is an alert in security monitoring?

  1. A.A routine system update for improving stability used in enterprise computing environments
  2. B.A user account type with specifically assigned access permissions
  3. C.A notification when a security tool detects suspicious or potentially malicious activity✓ Correct
  4. D.An alarm clock that wakes people up at a set time used in enterprise computing environments

Explanation

A security alert is triggered when suspicious activity or potential threats are detected.

Report an error in this question

Security MonitoringEasy

Q2. What is security monitoring?

  1. A.Monitoring attendance records for employee time tracking
  2. B.Watching security guards on physical surveillance cameras
  3. C.Continuous observation and analysis of systems and networks for security threats✓ Correct
  4. D.A video surveillance system for monitoring building access

Explanation

Security monitoring continuously observes systems to detect and respond to security threats.

Report an error in this question

Security MonitoringEasy

Q3. What is a security log?

  1. A.A record of security-relevant events and activities within a system or network✓ Correct
  2. B.A wooden log used for building physical fire structures
  3. C.A login page for entering user authentication credentials
  4. D.A security guard's written diary of daily activity notes

Explanation

A security log is a chronological record of security-relevant events.

Report an error in this question

Security MonitoringEasy

Q4. What is a dashboard in security monitoring?

  1. A.A file manager for organizing system directories used in enterprise computing environments
  2. B.A visual interface displaying real-time security metrics, alerts, and status information✓ Correct
  3. C.A web browser application for accessing internet-hosted content
  4. D.A car dashboard displaying vehicle speed and fuel information

Explanation

A security dashboard provides a real-time visual overview of the security posture.

Report an error in this question

Security MonitoringMedium

Q5. What is UEBA?

  1. A.Security analytics using machine learning to establish baselines and detect anomalous user behavior✓ Correct
  2. B.A social media management tool used for content scheduling tasks and engagement tracking
  3. C.A user interface design tool used for creating web application page layouts and mockups
  4. D.An email analytics tool used for tracking message delivery metrics and campaign performance

Explanation

UEBA uses machine learning to detect anomalous activities indicating insider threats or compromised accounts.

Report an error in this question

Security MonitoringEasy

Q6. What is the purpose of monitoring network traffic?

  1. A.To count the total number of packets transmitted on network
  2. B.To slow down overall network performance and throughput
  3. C.To increase available bandwidth for improved download speeds
  4. D.To detect unusual patterns, unauthorized access, and potential security threats✓ Correct

Explanation

Network traffic monitoring identifies unusual patterns and potential security threats.

Report an error in this question

Security MonitoringMedium

Q7. What is a SIEM system?

  1. A.A physical hardware component used in computing infrastructure
  2. B.Security Information and Event Management: aggregates, correlates, and analyzes security data✓ Correct
  3. C.A next-generation firewall security appliance deployed across enterprise environments
  4. D.A physical cable used for network connections used in enterprise network infrastructure

Explanation

SIEM aggregates log data, correlates events, and provides real-time security monitoring.

Report an error in this question

Security MonitoringEasy

Q8. What is a false positive in security monitoring?

  1. A.A true security threat confirmed by analysis investigation
  2. B.A false identity used for unauthorized system access
  3. C.A system error causing application crashes or instability
  4. D.An alert that incorrectly identifies normal activity as a security threat✓ Correct

Explanation

A false positive incorrectly flags legitimate activity as a threat.

Report an error in this question

Security MonitoringMedium

Q9. What is the difference between signature-based and anomaly-based detection?

  1. A.Anomaly-based detection only works effectively in offline analysis and forensic modes
  2. B.Signature-based detection is always considered better than anomaly-based detection methods
  3. C.They are functionally identical detection frameworks with no meaningful differences at all
  4. D.Signature-based matches known patterns; anomaly-based detects deviations from normal behavior✓ Correct

Explanation

Signature-based matches known threats; anomaly-based detects deviations from baselines.

Report an error in this question

Security MonitoringEasy

Q10. What type of events should be logged for security?

  1. A.Login attempts, access to sensitive data, system changes, and privilege escalations✓ Correct
  2. B.Only successful events should be logged for monitoring and compliance reporting
  3. C.Only errors and crashes should be logged for security analysis and remediation
  4. D.Only network events should be logged for analysis and security monitoring

Explanation

Security-relevant events include authentication attempts, access to sensitive resources, and configuration changes.

Report an error in this question

Security MonitoringEasy

Q11. What is the purpose of antivirus monitoring?

  1. A.To continuously watch for and detect malware infections in real-time✓ Correct
  2. B.To delete all files from the system storage permanently
  3. C.To sell software licenses for antivirus subscriptions
  4. D.To slow down the computer for detailed system analysis

Explanation

Antivirus monitoring continuously scans systems for malware, providing real-time protection.

Report an error in this question

Security MonitoringMedium

Q12. What is log correlation?

  1. A.Deleting old logs to free up storage space on servers
  2. B.Sorting logs alphabetically for easier navigation across computing environments
  3. C.Comparing log file sizes for storage capacity planning
  4. D.Analyzing and connecting related events across multiple sources to identify threat patterns✓ Correct

Explanation

Log correlation identifies patterns across multiple sources that together indicate a threat.

Report an error in this question

Security MonitoringMedium

Q13. What is a Security Operations Center (SOC)?

  1. A.A software company that develops security products deployed across enterprise environments
  2. B.A physical hardware component used in computing infrastructure
  3. C.A centralized facility where a team continuously monitors, detects, and responds to security incidents✓ Correct
  4. D.A cloud computing platform for hosting enterprise workloads

Explanation

A SOC continuously monitors the organization's security posture and responds to threats 24/7.

Report an error in this question

Security MonitoringEasy

Q14. Why is continuous monitoring important?

  1. A.Continuous monitoring exists solely to use more electricity
  2. B.Continuous monitoring is not important for security for modern enterprise security environments
  3. C.Threats can occur at any time and continuous monitoring ensures quick detection✓ Correct
  4. D.Continuous monitoring exists only to generate more data

Explanation

Continuous monitoring enables faster response, minimizing potential damage from incidents.

Report an error in this question

Security MonitoringEasy

Q15. What is log management?

  1. A.Collecting, storing, analyzing, and retaining log data from various systems✓ Correct
  2. B.Managing a personal blog for publishing online content
  3. C.Managing a lumber yard for processing wood materials
  4. D.A task management tool for organizing project work items

Explanation

Log management involves collecting logs from various sources and ensuring proper retention.

Report an error in this question

Security MonitoringMedium

Q16. What is the purpose of vulnerability scanning?

  1. A.To automatically identify known security weaknesses in systems and configurations✓ Correct
  2. B.To compress files for reducing disk storage consumption
  3. C.To create new vulnerabilities in systems for testing and management
  4. D.To scan paper documents and convert them to digital format

Explanation

Vulnerability scanning identifies known weaknesses and missing patches for remediation.

Report an error in this question

Security MonitoringMedium

Q17. What is the importance of log retention policies?

  1. A.Logs should be deleted immediately after they are created
  2. B.Logs should never be kept or retained for any period regardless of the deployment context or scenario
  3. C.Ensuring historical data availability for investigation, compliance, and trend analysis✓ Correct
  4. D.Retention is only about managing physical storage capacity

Explanation

Log retention balances storage costs with needs for investigation, compliance, and analysis.

Report an error in this question

Security MonitoringMedium

Q18. What is the role of a SOC analyst?

  1. A.Writing application source code for building new software features and functionality
  2. B.Monitoring alerts, investigating potential incidents, performing triage, and escalating threats✓ Correct
  3. C.Managing database servers and optimizing query performance for application workloads
  4. D.Architecting and building responsive enterprise web applications and user interfaces

Explanation

SOC analysts monitor alerts, investigate suspicious activities, and escalate confirmed threats.

Report an error in this question

Security MonitoringHard

Q19. What is deception technology?

  1. A.Social media manipulation campaigns designed for spreading misinformation and propaganda
  2. B.A magic show performance with illusion tricks for entertainment and audience engagement
  3. C.A VPN technology used for creating encrypted tunnel connections across networks securely
  4. D.Using decoys, breadcrumbs, and traps to detect attackers who bypassed perimeter defenses✓ Correct

Explanation

Deception technology deploys decoys to detect lateral movement with high-fidelity, low false-positive alerts.

Report an error in this question

Security MonitoringHard

Q20. What is a SOC maturity model?

  1. A.A project management tool for tracking development milestones
  2. B.A software development model for iterative feature delivery
  3. C.A framework for assessing and improving SOC capabilities across people, processes, and technology✓ Correct
  4. D.A hiring framework for recruiting security team personnel used in enterprise computing environments

Explanation

A SOC maturity model evaluates and guides improvement of SOC capabilities across multiple dimensions.

Report an error in this question

Security MonitoringHard

Q21. What is MITRE ATT&CK's role in security monitoring?

  1. A.A next-generation firewall security appliance deployed across enterprise environments
  2. B.A vulnerability scanner for identifying system weaknesses used in enterprise computing environments
  3. C.A software application used for enterprise computing operations
  4. D.Providing a matrix of adversary tactics and techniques to guide detection rule creation and coverage assessment✓ Correct

Explanation

MITRE ATT&CK guides detection rule creation, coverage assessment, and consistent threat communication.

Report an error in this question

Security MonitoringHard

Q22. What is SOAR in security monitoring?

  1. A.A software application used for enterprise computing operations
  2. B.A flight control system used in aviation navigation within modern computing environments
  3. C.A platform integrating security tools, automating response workflows, and orchestrating incident handling✓ Correct
  4. D.A cloud computing platform for hosting enterprise workloads

Explanation

SOAR integrates tools and automates workflows, improving SOC efficiency and consistency.

Report an error in this question

Security MonitoringMedium

Q23. What is threat detection in security monitoring?

  1. A.A recreational entertainment application for consumer devices
  2. B.Identifying potential security threats through analysis of security data, patterns, and behaviors✓ Correct
  3. C.A weather detection system for forecasting atmospheric events used in enterprise computing environments
  4. D.Creating new threats to test system resilience capabilities

Explanation

Threat detection analyzes events and behaviors to identify potential security threats.

Report an error in this question

Security MonitoringMedium

Q24. What is a honeypot in security monitoring?

  1. A.A VPN service for encrypting internet traffic connections used in enterprise computing environments
  2. B.A decoy system designed to attract attackers and provide intelligence about attack methods✓ Correct
  3. C.A next-generation firewall for filtering network traffic flows
  4. D.A jar of honey used for food and cooking purposes used in enterprise computing environments

Explanation

A honeypot is a decoy system that attracts attackers to capture their tools and techniques.

Report an error in this question

Security MonitoringHard

Q25. What is Extended Detection and Response (XDR)?

  1. A.A display resolution specification for mobile devices installed within computing infrastructure
  2. B.A unified platform integrating data from endpoints, networks, cloud, and email for holistic threat detection✓ Correct
  3. C.A network routing device for managing enterprise traffic flows
  4. D.A physical hardware component used in computing infrastructure

Explanation

XDR unifies security data from multiple layers for correlated detection and automated response.

Report an error in this question

Security MonitoringHard

Q26. What is a purple team exercise?

  1. A.A standard software application commonly used for enterprise computing operations and tasks
  2. B.A collaborative exercise where offensive and defensive teams work together to improve detection✓ Correct
  3. C.A training exercise specifically designed for improving team coordination and basic skills
  4. D.A color-themed social event designed for team-building and recreational group activities

Explanation

Purple teaming combines red and blue team operations to improve detection rules and security posture.

Report an error in this question

Security MonitoringHard

Q27. What is the role of machine learning in security monitoring?

  1. A.Replacing all human security analysts with automation across computing environments
  2. B.Machine learning is used only for spam filtering without any additional considerations needed
  3. C.Enhancing detection of novel threats, reducing false positives, and automating large-scale data analysis✓ Correct
  4. D.Making systems slower through additional processing overhead

Explanation

ML enhances detection by establishing baselines, identifying anomalies, and analyzing massive data volumes.

Report an error in this question

Security MonitoringHard

Q28. What is a detection engineering program?

  1. A.Building physical detectors for environmental monitoring
  2. B.An electrical engineering course covering power distribution used in enterprise computing environments
  3. C.A systematic approach to developing, testing, and measuring effectiveness of security detection rules✓ Correct
  4. D.A physical hardware component used in computing infrastructure

Explanation

Detection engineering systematically develops and maintains security detection logic with metrics and continuous improvement.

Report an error in this question

Security MonitoringHard

Q29. What is network detection and response (NDR)?

  1. A.A network routing device for managing enterprise traffic flows
  2. B.A DNS service for resolving domain names to IP addresses used in enterprise computing environments
  3. C.A solution monitoring network traffic using behavioral analytics and ML to detect and respond to threats✓ Correct
  4. D.A network speed test for measuring bandwidth throughput used in enterprise computing environments

Explanation

NDR analyzes network traffic using behavioral analytics to detect sophisticated threats.

Report an error in this question

Security MonitoringHard

Q30. What are MTTD and MTTR?

  1. A.Time to reboot systems within enterprise security environments
  2. B.Average time to build software within enterprise security environments
  3. C.Time to install updates regardless of the specific situation or context
  4. D.Key SOC metrics measuring average time to detect (MTTD) and to contain and resolve (MTTR) incidents✓ Correct

Explanation

MTTD measures time from threat appearance to detection; MTTR measures time from detection to resolution.

Report an error in this question

More Cyber Security Topics

Introduction to Cyber Security

Practice MCQs with explanations

Security Fundamentals

Practice MCQs with explanations

Cryptography

Practice MCQs with explanations

Network Security

Practice MCQs with explanations

OS Security

Practice MCQs with explanations

Web Security

Practice MCQs with explanations

Ready to test yourself on Security Monitoring?

Take a timed quiz drawn from 210+ questions on this topic. No signup required — your progress saves in your browser.

Start Security Monitoring Quiz