Which practice involves ongoing surveillance to detect abnormal behavior and potential security incidents?

Which practice involves ongoing surveillance to detect abnormal behavior and potential security incidents?

• A. Threat Hunting
• B. Continuous Monitoring
• C. Password Policy
• D. Incident Response Planning

Answer: (B)

Continuous monitoring is the ongoing collection, correlation, and analysis of security telemetry—such as logs, events, and metrics—from systems, networks, and identities to detect abnormal behavior and potential security incidents as they occur. It provides near real-time visibility and alerts when deviations from baselines are observed, enabling faster detection, containment, and investigation. Threat hunting is a proactive, hypothesis-driven search for threats that might evade automated alerts, and it is typically more manual and periodic than continuous monitoring. A password policy sets rules for credential strength and management but does not perform surveillance. Incident response planning outlines the steps to take after an incident is detected, rather than the ongoing detection process.

Continuous monitoring is the ongoing collection, correlation, and analysis of security telemetry—such as logs, events, and metrics—from systems, networks, and identities to detect abnormal behavior and potential security incidents as they occur. It provides near real-time visibility and alerts when deviations from baselines are observed, enabling faster detection, containment, and investigation. Threat hunting is a proactive, hypothesis-driven search for threats that might evade automated alerts, and it is typically more manual and periodic than continuous monitoring. A password policy sets rules for credential strength and management but does not perform surveillance. Incident response planning outlines the steps to take after an incident is detected, rather than the ongoing detection process.