How should I use these Security Monitoring practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Security Monitoring questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Security Monitoring domain.

200-201 · topic practice

Security Monitoring practice questions

Monitoring questions test your ability to match the right signal type to the right tool. Metrics for dashboards, logs for forensics, traces for distributed systems — keep this mapping in mind for every scenario.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Security Monitoring

Practice 10 questions Browse domain →

What the exam tests

What to know about Security Monitoring

Monitoring and logging questions test metrics, logs, and traces as the three pillars of observability, and how to choose the right tool for each signal type.

Metrics (time-series data), logs (events), and traces (distributed request flow) — and which tools handle each.

Alert types: threshold-based, anomaly-based, and composite — and when each is appropriate.

Log levels: DEBUG, INFO, WARN, ERROR, CRITICAL — and what should be logged at each level.

Retention policies, aggregation, and the cost trade-off of storing high-cardinality data.

Watch out for

Common Security Monitoring exam traps

▸Choosing a logging solution for real-time metric alerting — logs work for metrics but introduce latency.
▸Setting all log levels to DEBUG in production — high-volume debug logging degrades performance.
▸Treating an alert silence as a resolution — silencing without root-cause investigation leaves the issue active.
▸Forgetting that distributed tracing requires instrumentation in every service in the call chain.

Practice set

Security Monitoring questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Read the full Security Monitoring explanation →

An analyst notices repeated failed SSH attempts from an external IP to a server. The analyst wants to quickly see all SSH-related events from that IP in the last hour. Which approach is most efficient?

Trap 1: Review all firewall logs for the past hour.

Too broad; includes non-SSH traffic.

Trap 2: Run a packet capture on the server's network interface.

Reactive and time-consuming; not suitable for quick historical review.

Trap 3: Check the server's auth.log file manually.

Does not filter by source IP; requires manual parsing.

Study all Security Monitoring common traps →

A
Search the SIEM for events with destination port 22 and source IP.
Directly retrieves SSH events for that IP.
B
Review all firewall logs for the past hour.
Why wrong: Too broad; includes non-SSH traffic.
C
Run a packet capture on the server's network interface.
Why wrong: Reactive and time-consuming; not suitable for quick historical review.
D
Check the server's auth.log file manually.
Why wrong: Does not filter by source IP; requires manual parsing.

Security Monitoring practice questions

What to know about Security Monitoring

Common Security Monitoring exam traps

Security Monitoring questions

An analyst notices repeated failed SSH attempts from an external IP to a server. The analyst wants to quickly see all SSH-related events from that IP in the last hour. Which approach is most efficient?

A security team implements a network-based IPS. During testing, they find that legitimate traffic is frequently blocked. Which tuning approach should they prioritize?

An analyst is investigating a host that is beaconing to a known malicious domain every 60 seconds. The host also shows outbound connections to multiple IPs on port 443. To confirm the beaconing, which data source is most useful?

A SOC analyst receives an alert for 'Malware Detected' from an endpoint sensor. The analyst checks the endpoint and sees a file named 'invoice.exe' in the Downloads folder. What should the analyst do first?

A company uses a SIEM with correlation rules. They notice that a rule designed to detect brute-force attacks is not triggering even though failed logins are occurring. Which is the most likely cause?

During an incident, an analyst needs to determine if a specific user account 'jsmith' was used from a remote IP during a breach window. Which log sources should the analyst check first?

An organization uses a SIEM that ingests logs from multiple sources. The analysts are overwhelmed with alerts, many of which are false positives. Which strategy best reduces alert fatigue without increasing risk?

An analyst is reviewing a suspicious email reported by a user. The email contains an attachment 'invoice.pdf' and urges the user to open it. Which indicator is most likely to confirm it is a phishing attempt?

A network engineer configures a SPAN port to send traffic from a critical server to an IDS. After configuration, the IDS sees no traffic. What is the most likely issue?

An analyst observes a sudden spike in DNS queries from an internal host to a random subdomain of a legitimate domain (e.g., randomstring.google.com). This behavior is consistent with which technique?

A company wants to monitor for unauthorized wireless access points. Which technique should they implement?

Which TWO are common indicators of a compromised host? (Choose two.)

Which THREE are essential components of a security monitoring strategy? (Choose three.)

Which TWO are best practices for managing SIEM alerts to reduce false positives? (Choose two.)

Which THREE are typical sources of log data used in security monitoring? (Choose three.)

Refer to the exhibit. An analyst configures an ACL to block traffic to a malicious host on port 443. After applying it inbound on the external interface, the analyst sees the ACL counters. What does the output indicate?

Exhibit

Refer to the exhibit. An analyst sees this syslog message from a Cisco ASA. What does this log entry indicate?

Exhibit

Refer to the exhibit. An EDR alert shows this JSON event. What is the most significant indicator of a potential malware infection?

Exhibit

Track your progress over time

Start a Security Monitoring only practice session

Related 200-201 topic practice pages

Security Policies and Procedures practice questions

Security Concepts practice questions

Security Monitoring practice questions

Host-Based Analysis practice questions

Network Intrusion Analysis practice questions

200-201 fundamentals practice questions

200-201 scenario practice questions

200-201 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid