AP Cybersecurity Drill 14: Network Monitoring Alerts

Question 1. Reading the table, what is the key difference between the 02:31 NIPS alert and the 02:14 NIDS alert?

• A) The NIPS blocked the connection automatically, while the NIDS only detected and alerted without blocking ✓
• B) The NIDS blocked the matching connection itself, while the NIPS merely recorded the activity and watched
• C) Both the NIPS and the NIDS automatically blocked every connection that they happened to detect this morning
• D) Neither the NIPS nor the NIDS is in fact able to generate any alert at all about the traffic that it sees

Explanation: Choice A is correct. The notes show the NIPS dropped the matching connection automatically, while the NIDS only detected and raised an alert without stopping the traffic; that prevention-versus-detection difference is the defining distinction between the two tools. Choice B is incorrect. It reverses the roles: the NIDS detects and the NIPS can block, not the other way around. Choice C is incorrect. Only the NIPS blocked; the NIDS alert note explicitly says traffic was not blocked. Choice D is incorrect. Both tools generated alerts in the table.

Question 2. The 02:14 and 02:31 alerts fired because traffic matched stored patterns of known bad activity, while the 03:05 and 09:20 alerts fired because the behavior was unusual. What are these two detection approaches called?

• A) Both of the detection approaches shown are forms of signature-based detection
• B) Both of the detection approaches shown are forms of anomaly-based detection
• C) The first two alerts are anomaly-based; the last two alerts are signature-based
• D) The first two alerts are signature-based; the last two alerts are anomaly-based ✓

Explanation: Choice D is correct. Matching stored patterns of known bad activity is signature-based detection (the 02:14 and 02:31 alerts), while flagging behavior that departs from normal is anomaly-based detection (the 03:05 and 09:20 alerts). Choice A is incorrect. The last two alerts had no signature, so they are not signature-based. Choice B is incorrect. The first two matched known signatures, so they are not anomaly-based. Choice C is incorrect. It reverses the two approaches.

Question 3. The 03:05 alert shows one workstation contacting 60 internal hosts in 2 minutes. Which interpretation best fits this pattern?

• A) A normal software-update process, which by its design always reaches out to dozens of internal hosts at once
• B) A scheduled nightly backup job copying that one workstation's files across to a single backup-server target
• C) Possible internal scanning or worm-like spread, since one host reaching very many others is a common indicator ✓
• D) A single user who is sitting at that one workstation and is simply typing in their own account password incorrectly

Explanation: Choice C is correct. One workstation reaching many internal hosts in a very short time is a common indicator of scanning or worm-like lateral movement, where a compromised device probes the network for other systems; that is why the anomaly score is high. Choice A is incorrect. A routine update contacts update servers, not 60 internal peers in two minutes, so calling that normal misreads the pattern. Choice B is incorrect. A backup job sends data to one backup destination, not connections fanning out to 60 different internal hosts. Choice D is incorrect. A mistyped password is a single failed login, not a burst of connections across the internal network.

Question 4. The 09:20 alert was flagged by the AI-assisted feature because a finance user's account was used to log in from two cities minutes apart. How should the analyst describe the role of the AI here?

• A) The AI-assisted SIEM scored the pattern as unusual and surfaced it for review, but it still needs human work ✓
• B) The AI has now conclusively proven that the finance account was stolen, so no further checking is needed at all
• C) The AI guarantees that this particular login attempt must be legitimate because the username entered was valid
• D) The AI feature entirely replaces any need for the security team to keep maintaining signatures or system logs

Explanation: Choice A is correct. The AI-assisted feature scores how unusual a pattern is and surfaces likely problems such as impossible travel for an analyst to examine; it speeds detection but does not by itself prove compromise, so human investigation is still required. Choice B is incorrect. An anomaly score is a strong lead, not proof, and overstating it as proven theft skips needed verification. Choice C is incorrect. A valid username does not guarantee a legitimate login; the tool flagged this sign-in as unusual. Choice D is incorrect. Anomaly scoring complements signatures and logs rather than replacing them.

Question 5. Given the morning's alerts, which response best balances acting on the strongest lead with avoiding alert fatigue?

• A) Treat every one of the four morning alerts as equally urgent and page the entire response team for each one
• B) Investigate the 03:05 and 09:20 anomalies first, review the 02:14 scan as lower priority, note 02:31 was blocked ✓
• C) Ignore all four of this morning's alerts on the simple grounds that two of them did not match any signature
• D) Turn off the SIEM's anomaly-scoring feature altogether so that far fewer alerts appear in the morning queue each day

Explanation: Choice B is correct. The 03:05 and 09:20 alerts suggest possible active compromise and should be investigated first; the 02:14 scan is still worth reviewing but is a lower-priority lead than evidence of internal scanning or impossible travel, and the 02:31 exploit attempt was already blocked by the NIPS. Ranking by severity is how analysts act on real threats without burning out on noise. Choice A is incorrect. Treating every alert as equally urgent is exactly what causes alert fatigue and buries the serious leads. Choice C is incorrect. The lack of a signature does not make an alert meaningless; the anomaly alerts here are the most serious. Choice D is incorrect. Disabling anomaly scoring would hide the morning's two strongest leads rather than manage the workload.