KC-9 — Chapter 9 Knowledge Check
Questions and answer context for Chapter 9
Use this page after completing the chapter Knowledge Check. Each question is repeated so the answer and rationale retain their full instructional context.
Questions
Select the best answer for each question.
1. The Indexer disk reaches its watermark. What does an analyst most likely observe?
A. A prominent error banner in the Dashboard
B. Fewer alerts than usual, with no error message
C. All agents disconnecting simultaneously
D. Suricata stopping automatically
2. Security Configuration Assessment primarily answers which question?
A. Is something happening on this system right now?
B. Which packets crossed the network?
C. Is this system configured according to policy?
D. Which process created this file?
3. A vulnerability finding indicates:
A. A confirmed compromise
B. Exposure to a known software defect
C. That an alert rule matched
D. That an agent has disconnected
4. What is the primary operational benefit of agent groups?
A. They increase the speed of packet capture
B. They allow configuration to be defined once and inherited by every member
C. They replace the need for decoders
D. They encrypt agent communication
5. When onboarding a new log source, in what order should failures be diagnosed?
A. Rules, then decoding, then collection
B. Collection, then decoding, then rule evaluation
C. Tuning, then collection, then rules
D. Any order, since the stages are independent
6. Suricata reports a rising number of dropped packets. What does this mean?
A. The rules are working correctly
B. Traffic was discarded before inspection and was never evaluated
C. The agent has disconnected
D. Retention has expired
7. Why are detection rules kept in version control?
A. To reduce disk usage on the Manager
B. To provide authorship, history, and review for every change
C. Because Wazuh requires it
D. To increase alert severity
8. Which task belongs to the "every shift" cadence?
A. Quarterly detection coverage review
B. Retention audit
C. Pre-flight checks, capture counters, and agent status
D. Annual policy revision
9. An analyst observes zero Suricata alerts for a full day. What is the correct conclusion?
A. The network is confirmed clean
B. Suricata should be uninstalled
C. Nothing can be concluded until capture counters and interface state are verified
D. All rules should be set to a higher severity
10. What distinguishes operating a platform from building one?
A. Operating requires no configuration
B. Operating maintains correctness over time as conditions change
C. Building is performed by analysts and operating by vendors
D. There is no meaningful difference
Answer Key
| Q | Answer | Why |
|---|---|---|
| 1 | B | Indexer watermark conditions may reduce or stop indexing without producing an obvious Dashboard banner. |
| 2 | C | Security Configuration Assessment evaluates whether endpoint configuration aligns with policy. |
| 3 | B | A vulnerability finding identifies exposure to a known defect; it does not prove compromise. |
| 4 | B | Agent groups let administrators define shared configuration once and distribute it consistently. |
| 5 | B | Diagnose the pipeline in order: collection, decoding, then rule evaluation. |
| 6 | B | Dropped packets were not inspected, so they could not trigger a Suricata detection. |
| 7 | B | Version control preserves authorship, history, review, and rollback for detection changes. |
| 8 | C | Pre-flight checks, capture counters, and agent status are every-shift operational checks. |
| 9 | C | An empty alert view is inconclusive until interface state and capture counters are verified. |
| 10 | B | Operations preserve platform correctness as traffic, software, storage, and business conditions change. |