ISC2 · CISSP
Logging, monitoring, and detection
CISSP · Lesson 27 of 34 · 3:27:01
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the ISC2 CISSP exam, on the 2027 outline. In this lesson: log management, SIEM, SOAR, continuous monitoring and tuning, UEBA, IDS and IPS, egress monitoring and DLP, threat intelligence and hunting, firewalls, allowlists, DDoS scrubbing, MSSPs, sandboxing, honeypots, anti-malware, EDR, XDR, and AI-based tools. Includes three original practice questions.
Preview the topics
- Larkspur’s analysts receive thousands of alerts a day, and miss real attacks among the false positives. What should they do first?
- Larkspur wants suspicious email attachments opened in an isolated environment, to watch what they do before users receive them. What fits?
- Which approach can detect a brand new attack, with no known signature, at the cost of more false positives?