Cyber Defense · lesson 4 of 12 · 12 min

Security monitoring basics

summary: Monitoring helps teams understand normal behavior and notice changes that need review. Useful signals include authentication activity, configuration changes, and unusual traffic patterns.

question: Why establish a normal baseline?

options:

• To recognize unusual behavior
• To hide alerts
• To remove logs
• To avoid documentation

correct: To recognize unusual behavior

explanation: A baseline gives investigators context for deciding what needs attention.

---

Previous lesson: Phishing and social engineering
Back to Cyber Defense
Next lesson: Asymmetric encryption and PKI