2Security Monitoring

• 2.1Attack surface and monitoring data technologies

  Establishes the relationship between the attack surface and vulnerabilities, and covers what each monitoring technology reveals—tcpdump (full packets), NetFlow (flow statistics), NGFW, the stateful firewall, AVC (Application Visibility and Control), web filtering, and email filtering—framed as a SOC analyst's judgment of which data to collect.

• 2.2Impact on data visibility

  Covers how ACLs, NAT/PAT, tunneling, TOR, encryption, P2P, encapsulation, and load balancing make monitoring and log reading harder. Assuming real cases where IP rewriting or encryption hides the 5-tuple or content, it builds the judgment of where an analyst re-correlates when visibility drops.

• 2.3Uses of monitoring data types

  Covers choosing among the monitoring data types—full packet capture, session data, transaction data, statistical data, metadata, and alert data—by "which data answers which question" and "the trade-off between retention cost and investigation depth."

• 2.4Network attacks and web application attacks

  Covers network attacks—protocol-based attacks, DoS, DDoS, man-in-the-middle (MITM)—and web application attacks—SQL injection, command injection, cross-site scripting (XSS)—as the judgment of identifying which attack from traces in logs/pcaps/requests.

• 2.5Social engineering, endpoint attacks, and evasion

  Covers social engineering that deceives people (manual and via generative AI abuse), endpoint compromises—buffer overflow, C2, malware, ransomware—and evasion via tunneling, encryption, and proxies, framed as judgment for spotting them from their signs.

• 2.6Certificates and security

  Covers public-key authenticity via PKI, choosing between symmetric (fast, shared key) and asymmetric (key distribution) cryptography, and certificate elements negotiated in TLS—the cipher suite, X.509 certificate, key exchange, protocol version, and PKCS—from the monitoring perspective of judging "is this encrypted traffic safe and untampered?"