Memory cue
Last-day cue
A.8.16 = detect abnormal behaviour, evaluate potential incidents, and respond through the event/incident process.
What the exam is likely testing
| Topic | Exam cue |
|---|---|
| Logging vs monitoring | Logs are evidence; monitoring turns signals into detection and alerting |
| Tool vs process | SIEM/IDS/IPS is not enough without sources, rules, thresholds, triage, and escalation |
| Risk-based monitoring | Detection use cases should match risks and critical assets |
| Alert fatigue | Too many poor alerts can reduce effectiveness |
| Out-of-hours handling | Important alerts need an escalation path outside normal hours |
Common wrong answers
- Treating log collection as full monitoring.
- Assuming vendor default detection rules are sufficient.
- Treating every alert as an incident without triage.
- Ignoring monitoring blind spots.
- Optimizing for alert quantity instead of alert quality.
Related notes
- Iso27001
- Exam
- Monitoring
Note Metadata
Aliases: EXAM-034
Source: 09-Exam-Preparation/EXAM-034-Monitoring-Activities.md