Apache Metron Interview Questions and Answers 2022

Apache Metron is a storage ,scalable advanced security analytics framework which provides analytic platform specialized in cyber security. This talk was about demonstrating the usages and capabilities of Apache Metron in the real world. Apache Metron integrates a variety of open source big data technologies in order to offer a centralized tool for security monitoring and analysis. We have collected 50+ Apache Metron Interview questions and answers that might help you.

 

Apache Metron

 

Metron can be divided into 4 areas:

  1. A mechanism to capture, store, and normalize any type of security telemetry at extremely high rates. Because security telemetry is constantly being generated, it requires a method for ingesting the data at high speeds and pushing it to various processing units for advanced computation and analytics.

  2. Real time processing and application of enrichments such as threat intelligence, geolocation, and DNS information to telemetry being collected. The immediate application of this information to incoming telemetry provides the context and situational awareness, as well as the who and where information critical for investigation

  3. Efficient information storage based on how the information will be used:

    • Logs and telemetry are stored such that they can be efficiently mined and analyzed for concise security visibility
    • The ability to extract and reconstruct full packets helps an analyst answer questions such as who the true attacker was, what data was leaked, and where that data was sent
    • Long-term storage not only increases visibility over time, but also enables advanced analytics such as machine learning techniques to be used to create models on the information. Incoming data can then be scored against these stored models for advanced anomaly detection.
  4. An interface that gives a security investigator a centralized view of data and alerts passed through the system. Metron’s interface presents alert summaries with threat intelligence and enrichment data specific to that alert on one single page. Furthermore, advanced search capabilities and full packet extraction tools are presented to the analyst for investigation without the need to pivot into additional tools.

 

Apache Metron Interview Questions and Answers 2022

Q.1 Who is responsible for finding patterns in the security data ingested into Metron?

1.Forensic Investigator

2.SOC Investigator

3.Security Data Scientist

4.SOC Analyst

Ans : Security Data Scientist

Q.2 Apache Metron is built on top of _________.

1.Cisco Open Source Technologies

2.Apache Open Source Technologies

3.Multiple Cisco and Apache Technologies

4.Cisco Licensed Technologies

Ans : Cisco Open Source Technologies

Q.3 Apache Metron in Deployment is __________

1.replicated

2.distributed

3.can be either centralised or distributed

4.centralised

Ans : can be either centralised or distributed

Q.4 Which of the following is an Example of Threat Intel feeds in Metron?

1.DPI

2.Bro

3.Nifi

4.Soltra

Ans : Soltra

Q.5 Consider you are a store owner operating your own website for the people of your Town. What can be ideal for maintaining security of the shopping platform on your site?

1.Traditional SIEM

2.Security is not needed

3.Metron

4.Either Metron or Traditional SIEM

Ans : Traditional SIEM

Q.6 Telemetry Data Ingestion is possible into Metron through ___________.

1.Apache Impala

2.Apache Kudu

3.Apache Storm

4.Apache Nifi

Ans : Apache Nifi

Q.7 Timestamp in Metron is parsed in ________.

1.Both POSIX and UTC

2.UTC format

3.POSIX format

4.None of the given options

Ans : POSIX format

Q.8 Machine Learning models can be adopted in Metron for ________.

1.Advanced Analytics

2.Threat Prediction

3.Anomaly Detection

4.all the given options

Ans : all the given options

Q.9 Metron Provides support for multiple types of data through its __________.

1.Intelligence Platform

2.Data Vault

3.Pluggable framework

4.all the given options

Ans : Pluggable framework

Q.10 Which of the following is NOT a component of parsing topology?

1.Storm kafka spout

2.kafka parser bolt

3.Storm parser spout

4.none of the options

5.all the given options

Ans : Storm parser spout

Q.11 Parallel Enrichment is available on Metron by default

1.True

2.False

Ans : False

Q.12 What is the order of stages in Stream Processing Pipeline. 1. Theat Intel b.) Telemetry Parsing c.) Index and Write d.) Alert Triage e.) Enrichment

1.a, b, c, d, e

2.b, e, a, d, c

3.b, e d, a, c

4.b, a d, e, c

5.none of the given options

Ans : b, e, a, d, c

Q.13 In Telemetry Parsing Stage ________.

1.data normalization takes place

2.data validation takes place

3.data enrichment takes place

4.data transformation takes place

Ans : data normalization takes place

Q.14 Stellar Expressions can be used in telemetry parsing as part of ______.

1.data normalization

2.cannot be used in telemetry parsing

3.data validation

4.data transformation

5.all the given options

Ans : cannot be used in telemetry parsing

Q.15 Threat Intel Feeds can be __________.

1.streamed in real-time

2.normalised and de-duped

3.Bulk-loaded

4.all the given options

Ans : all the given options

Q.16 Client for MaaS is written in ___________.

1.Scala

2.Node.js

3.Python

4.Java

Ans : Java

Q.17 Profiler can be configured for entities like

1.application

2.user

3.subnet

4.server

5.all the given options

Ans : all the given options

Q.18 Solr and ElasticSearch Indices are supported __________.

1.as they are cold storage indices

2.as they are kibana supported

3.as they are random access indices

4.all the given options

Ans : as they are kibana supported

Q.19 Which of the following statements regarding MetaalertDao is/are TRUE

1.pagination of metaalerts is not possible

2.alerts are linked to metaalerts by id

3.It denormalizes the relation between alerts and metaalerts

4.none of the given options

Ans : It denormalizes the relation between alerts and metaalerts

Q.20 HDFS Index updates are supported in Metron.

1.No, Only Random Access Index updates are supported

2.Yes, Using a NoSQL write ahead log

3.Yes, Natively Supported

4.none of the given options

Ans : No, Only Random Access Index updates are supported

Q.21 Enrichment configuration can be stored on _________.

1.storm

2.Hbase

3.zookeeper

4.HDFS

Ans : zookeeper

Q.22 Validation of data entering Metron can be validated ___________.

1.fully at the time of ingestion

2.partially at the time of ingestion

3.partially at time of enrichment

4.all the given options

Ans : partially at time of enrichment

Q.23 Threat Intel Store is based on.

1.Key – Value Pair

2.Graph DB

3.Columnar Table

4.Document DB

Ans : Key – Value Pair

Q.24 Select the Correct order of nested data in a JSON file which is processed in the pipeline.

1.threatIntel -> triageConfig -> enrichment

2.enrichment -> triageConfig -> threatIntel

3.enrichment -> threatIntel ->triageConfig

4.None of the options

Ans : enrichment -> threatIntel ->triageConfig

Q.25 UDFs are supported by Stellar.

1.True

2.False

Ans : True

Q.26 Which of the following statements regarding MetaalertDao is/are TRUE.

1.It is limited by parent-child relationships between alerts and metaalerts

2.It denormalizes the relation between alerts and metaalerts

3.alerts are linked to metaalerts by id

4.none of the given options

Ans : It is limited by parent-child relationships between alerts and metaalerts

Q.27 Apache Metron do NOT have a dependency on _______.

1.docker

2.python

3.ansible

4.vagrant

Ans : ansible

Q.28 Identify the Stellar Function which is NOT VALID.

1.IS_DOMIAN

2.IS_IP

3.IS_SUBNET

4.IS_EMAIL

Ans : IS_SUBNET

Q.29 When Machine Learning models are employed for threat intelligence what is considered to be an infrastructure challenge?

1.Type of adopted model

2.Model Implementation Language dependency

3.Implemented Model accuracy

4.all the given options

Ans : Type of adopted model

Q.30 Consider you are trying to parse telemetry of a application which uses a custom API. Its telemetry is highly complex and the data is generated at a rapid rate. What is an ideal parsing
strategy for the scenario?

1.Write a Custom JVM parser while using Grok as stop gap

2.Write and use a Custom JVM parser

3.Modify a Grok Parser while using JVM parser as stop gap

4.Use in-built Grok Parser

Ans : Use in-built Grok Parser

Q.31 MaaS scaling can be done through ______.

1.YARN

2.Service Discovery

3.REST

4.Storm

Ans : REST

Q.32 Data to create a profiler is collected.

1.Over sliding windows

2.Over multiple windows

3.from different data sources

4.In time series way

Ans : Over multiple windows

Q.33 Zeppelin Interpreter do NOT support.

1.Python

2.JDBC

3.Node.js

4.Cassandra

Ans : Node.js

Q.34 Stellar is Integrated into Metron Components such as _________.

1.Enrichment and Indexing

2.Indexing and Threat Triage

3.Enrichment and Threat Triage

4.Global Validation and Threat Triage

5.Global Validation and Enrichment

Ans : Global Validation and Threat Triage

Q.35 Default Indexer of Metron is ____________.

1.HDFS

2.Hbase

3.Elastic Search

4.Solr

Ans : HDFS

Q.36 How does Network Intrusion Detection System works?

1.Uses fixed rules to identify abnormal events

2.Tracks communication between actors of target network

3.Extracts application level request details

4.all the given options

Ans : Uses fixed rules to identify abnormal events

Q.37 DPI(Deep Packet Inspection) Data is best to be extracted only for ____________.

1.DNS Protocol

2.REST Protocol

3.PCAP

4.Netflow protocol

Ans : Netflow protocol

Q.38 Pick out the Stellar Keyword among the following.

1.NaN

2.except

3.case

4.all the given options

Ans : NaN

Q.39 Metron apart from in-built Geo Enrichment supports.

1.Asset and User Enrichment

2.none of the given options

3.Asset and Network Enrichment

4.User and Network Enrichment

Ans : Asset and Network Enrichment

Q.40 Who among the following is considered to be an advanced SME w.r.t Apache Metron Platform _____________.

1.SOC Investigator

2.Security Platform Ops Engineer

3.SOC Analyst

4.Forensic Investigator

Ans : Security Platform Ops Engineer

About Author


After years of Technical Work, I feel like an expert when it comes to Develop wordpress website. Check out How to Create a Wordpress Website in 5 Mins, and Earn Money Online Follow me on Facebook for all the latest updates.