KC-1 — Chapter 1 Knowledge Check
Questions and answer context for Chapter 1
Use this page after completing the chapter Knowledge Check. Each question is repeated so the answer and rationale retain their full instructional context.
Questions
Select the best answer for each question.
1. What is the primary purpose of a Security Operations Center?
A. Install antivirus software
B. Continuously monitor, detect, investigate, and respond to cybersecurity events
C. Manage user accounts
D. Configure routers
2. Which statement best defines an event?
A. A confirmed cyberattack
B. A malware infection
C. A firewall rule
D. Any recorded system activity
3. Every incident begins as:
A. An alert
B. A firewall rule
C. A software update
D. A help desk ticket
4. Which technology primarily provides network visibility in our laboratory?
A. Sysmon
B. Windows Defender
C. Suricata
D. PowerShell
5. Which technology primarily records Windows process creation?
A. DNS Server
B. Sysmon
C. VMware
D. Active Directory
6. Which statement best describes telemetry?
A. Security observations generated by systems
B. A security incident
C. Firewall rules
D. Antivirus definitions
7. Which technology correlates alerts from multiple security products?
A. Suricata
B. Sysmon
C. Windows Defender
D. Wazuh
8. Which SOC tier performs initial alert triage?
A. Tier 1
B. Tier 2
C. Tier 3
D. Executive Management
9. Before investigating an alert, what should always be verified?
A. Monitoring infrastructure and telemetry
B. Windows Updates
C. Password Policy
D. Browser history
10. Which statement best summarizes this chapter?
A. Install software first.
B. Trust every alert.
C. Every alert is an incident.
D. Understand the mission before learning the tools.
11. Malicious activity occurs on an endpoint whose Wazuh Agent disconnected the previous night. No alert is generated. This outcome is best described as:
A. A true positive
B. A false positive
C. A false negative
D. An incident
Answer Key
| Q | Answer | Why |
|---|---|---|
| 1 | B | Continuous monitoring, detection, investigation, and response is the SOC’s core mission. |
| 2 | D | An event is any recorded system activity; most events are benign. |
| 3 | A | Incidents are confirmed through investigation of alerts. |
| 4 | C | Suricata inspects mirrored network traffic in this lab. |
| 5 | B | Sysmon records process creation (Event ID 1) and related endpoint telemetry. |
| 6 | A | Telemetry is the stream of security observations systems generate. |
| 7 | D | Wazuh, as the SIEM, correlates alerts across all sources. |
| 8 | A | Tier 1 performs initial triage before escalation. |
| 9 | A | If telemetry is broken, absence of alerts proves nothing. |
| 10 | D | The chapter’s theme: understand the mission before the tools. |
| 11 | C | Malicious activity with no alert is a false negative—and broken telemetry manufactures false negatives silently. |