Chapter 1
Security Architecture
Course: Comptia Securityx Cas 005
Subject: Comptia Securityx Cas 005 Practice Exam
Chapter: Security Operations
1. Proactive and Detection Processes
Proactive and detection processes aim to identify potential threats and reduce risks before they escalate into actual incidents. These processes focus on active threat hunting, developing defenses, and using deceptive technologies to confuse and mislead attackers.
1.1 Hunts
- Definition: Proactively searching for threats that evade automated detection systems.
- Example: A security team reviews endpoint activity logs for signs of lateral movement in a network.
- Tools: Threat-hunting platforms like CrowdStrike, Splunk, or ELK Stack.
1.2 Developing Countermeasures
- Definition: Creating defensive strategies and tools to mitigate emerging threats.
- Example: Developing custom firewall rules to block traffic from a newly identified malicious IP address.
- Countermeasures Include:
Intrusion detection system (IDS) rules. Network segmentation policies.
- Intrusion detection system (IDS) rules.
- Network segmentation policies.