SSCP Risk Identification, Monitoring and Analysis — 30 Questions

Question 1

A security analyst notices repeated failed login attempts from a single IP address on the VPN gateway. The analyst adjusts the threshold for account lockout and enables geo-ip blocking. This activity is part of which risk management process?

Accepted Answer

Risk monitoring. Option D is correct because the analyst is actively monitoring the VPN gateway for security events (failed logins) and then adjusting controls (lockout threshold, geo-IP blocking) in response to observed threats. This continuous observation and adjustment is the essence of risk monitoring, which is the ongoing process of tracking identified risks and evaluating the effectiveness of controls. The actions taken are not about identifying new risks, assessing their likelihood/impact, or formally reporting them, but rather about reacting to real-time data to maintain an acceptable risk posture.

Answer

Risk identification

Answer

Risk assessment

Answer

Risk reporting

Question 2

During a quarterly risk review, a hospital's security team identifies that legacy medical devices cannot be patched and run outdated operating systems. Which risk treatment strategy is most appropriate for these devices?

Accepted Answer

Implement compensating controls such as network segmentation and strict access control. Since the legacy medical devices cannot be patched due to vendor obsolescence, the most appropriate risk treatment strategy is to implement compensating controls. Network segmentation (e.g., VLANs or firewalls) isolates the devices from the main hospital network, while strict access control (e.g., 802.1X or MAC-based filtering) limits exposure to threats. This reduces the likelihood of exploitation without relying on patching the outdated operating systems.

Answer

Remediate by applying vendor patches

Answer

Retire and replace all devices immediately

Answer

Transfer the risk by purchasing cyber insurance

Question 3

A SOC analyst reviews an alert for a user who downloaded a large amount of data from a sensitive database at 3:00 AM. The user's manager confirms the user was not on call. Which type of risk indicator is this activity best described as?

Accepted Answer

User behavior risk indicator. The activity describes a user downloading a large volume of sensitive data at an anomalous time (3:00 AM) without authorization, which directly maps to a User Behavior Risk Indicator (UBRI). UBRI focuses on deviations from established baselines of user actions, such as unusual access times, data volumes, or locations, to detect potential insider threats or compromised accounts. This is not a technical vulnerability, error log, or configuration issue, but a behavioral anomaly that requires investigation.

Answer

Technical vulnerability indicator

Answer

Error log indicator

Answer

Configuration drift indicator

Question 4

An organization wants to identify risks related to a new cloud-based customer relationship management (CRM) system. Which approach would best identify threats and vulnerabilities specific to this system?

Accepted Answer

Perform a threat modeling exercise such as STRIDE. Threat modeling with STRIDE is the best approach because it systematically identifies threats (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) specific to the CRM's architecture, data flows, and trust boundaries. Unlike generic scans or assessments, STRIDE focuses on the unique attack surface of a cloud-based system, such as API endpoints, multi-tenancy risks, and shared responsibility model gaps.

Answer

Run a vulnerability scan on the CRM

Answer

Execute a business impact analysis (BIA)

Answer

Conduct a qualitative risk assessment using a generic framework

Question 5

After a security incident, the CISO asks for a report detailing which assets were affected, the attack vector, and the financial impact. Which of the following best describes this report?

Accepted Answer

Lessons learned report. A lessons learned report is a post-incident document that captures what happened during a security incident, including affected assets, the attack vector, and financial impact. It is used to improve future incident response processes and is distinct from operational plans or risk assessments.

Answer

Incident response plan

Answer

Risk register

Answer

Business impact analysis (BIA)

Question 6

A financial institution uses a quantitative risk analysis to evaluate a new online payment system. The asset value is $5 million, the exposure factor is 40%, and the annualized rate of occurrence (ARO) is 0.5. What is the annualized loss expectancy (ALE)?

Accepted Answer

$1,000,000. The annualized loss expectancy (ALE) is calculated as single loss expectancy (SLE) multiplied by the annualized rate of occurrence (ARO). SLE is asset value ($5,000,000) times exposure factor (40%) = $2,000,000. Then ALE = $2,000,000 × 0.5 = $1,000,000. This quantitative risk analysis formula is standard in financial risk assessments for payment systems.

Answer

$800,000

Answer

$2,000,000

Answer

$2,500,000

Question 7

A security team discovers that an employee's credentials were used to access the HR database from an unrecognized IP address in a foreign country. The employee is currently in the office. Which risk identification technique is most directly responsible for detecting this anomaly?

Accepted Answer

User and entity behavior analytics (UEBA). UEBA is the correct answer because it uses machine learning and statistical models to establish a baseline of normal user behavior (e.g., typical login times, geolocations, and access patterns). When the employee's credentials are used from a foreign IP address while the employee is physically in the office, UEBA detects this as an anomalous deviation from the baseline, triggering an alert. This technique is specifically designed for real-time anomaly detection in user and entity activities, making it the most direct method for identifying this type of credential misuse.

Answer

Manual log review

Answer

Vulnerability scanning

Answer

Threat intelligence feeds

Question 8

During a risk assessment, the team identifies that a critical database server is not included in the backup schedule. Which risk term best describes this condition?

Accepted Answer

Vulnerability. A vulnerability is a weakness in a system that can be exploited by a threat. The database server missing from the backup schedule represents a weakness in the organization's data protection and disaster recovery posture, making it susceptible to data loss. This absence of a control (backup) is a classic example of a vulnerability, not an active threat or an exploit.

Answer

Threat

Answer

Risk

Answer

Exploit

Question 9

Which TWO of the following are primary purposes of a risk register?

Accepted Answer

Track the status of risk treatment plans. Option A is correct because a risk register is a living document used to track the status of risk treatment plans, including whether controls have been implemented, are in progress, or are overdue. This ensures that risk owners are accountable and that residual risk is managed over time. Option B is correct because the primary function of a risk register is to document identified risks along with their characteristics, such as probability, impact, risk score, and owner. These two functions are core to the risk management process as defined by frameworks like NIST SP 800-37 and ISO 31000.

Answer

Record network traffic logs

Answer

Store vulnerability scan results

Answer

Provide a checklist for compliance audits

Question 10

Which THREE of the following are common techniques for identifying risks?

Accepted Answer

Stakeholder interviews. Stakeholder interviews are a common technique for identifying risks because they leverage the knowledge and experience of individuals who have a direct interest in or are affected by the project or system. By engaging stakeholders, you can uncover risks that may not be apparent from documentation or technical analysis, as they provide insights into operational, regulatory, and business-specific threats. This aligns with the risk identification process in the SSCP domain, which emphasizes gathering input from diverse sources to build a comprehensive risk profile.

Answer

Penetration testing

Answer

Quantitative risk analysis

Question 11

Which TWO of the following are examples of key risk indicators (KRIs)?

Accepted Answer

Number of unpatched critical vulnerabilities. Option A is correct because the number of unpatched critical vulnerabilities directly measures the organization's exposure to known exploits. A KRI must be quantifiable and predictive of risk; unpatched vulnerabilities are a leading indicator of potential breaches, as attackers actively scan for and exploit such weaknesses. This metric is commonly tracked in vulnerability management programs to prioritize remediation efforts.

Answer

Total number of employees

Answer

Average user satisfaction score

Answer

Number of security incidents this quarter

Question 12

Refer to the exhibit. A security analyst reviews these logs from a server. What immediate risk is most indicated by this log pattern?

Accepted Answer

Active brute-force attack against the SSH service. The log pattern shows repeated failed SSH authentication attempts from multiple IP addresses in rapid succession, followed by a successful login from one of those IPs. This is the classic signature of a brute-force attack where an attacker tries many passwords until one works, indicating an active compromise of the SSH service.

Answer

Insider threat from user root

Answer

Malware infection on the server

Answer

Misconfigured SSH settings allowing root login

Question 13

Refer to the exhibit. A security engineer is reviewing an S3 bucket policy. Which risk is most directly introduced by this policy?

Accepted Answer

Exposure of bucket contents to the public. The S3 bucket policy grants public access via a Principal of '*' and an Effect of 'Allow' for the 's3:GetObject' action, which means any unauthenticated user on the internet can read objects in the bucket. This directly exposes the bucket contents to the public, making option D correct.

Answer

Unauthorized deletion of objects

Answer

Lack of encryption at rest

Answer

Inability to audit access

Question 14

You are the security analyst for a mid-sized e-commerce company that processes credit card payments. The company uses a legacy payment application on a Windows Server 2012 R2 system, which is scheduled for decommission in six months. The server is isolated in a separate VLAN with strict firewall rules allowing only outbound HTTPS to the payment processor and inbound management from a jump box on a different subnet. During a routine vulnerability scan, you discover that the server is missing over 50 critical patches, including one for a remote code execution vulnerability (CVE-2023-XXXX) that is being actively exploited in the wild. The server cannot be patched because the vendor stopped support and patches are not available. The company's risk appetite is low due to PCI DSS requirements. You need to recommend a course of action that balances risk reduction with business continuity. What should you do?

Accepted Answer

Implement additional compensating controls such as an application-layer firewall, disable all unnecessary services, restrict outbound traffic to only the payment processor IP, enable detailed logging, and accelerate the migration. Option A is correct because it implements compensating controls to reduce the risk of the unpatched remote code execution vulnerability while maintaining business continuity. By deploying an application-layer firewall (e.g., a WAF or host-based IPS), disabling unnecessary services, restricting outbound traffic to only the payment processor's IP via strict egress ACLs, enabling detailed logging for monitoring, and accelerating the migration to a supported system, you align with PCI DSS Requirement 6.2 (timely patching) and Requirement 11.5 (change detection) without causing an outage. This layered defense mitigates the active exploit risk until the legacy server can be decommissioned in six months.

Answer

Immediately decommission the server and migrate to the new payment system, accepting a temporary outage

Answer

Apply the vendor's hotfix from an unofficial source to patch the vulnerability

Answer

Accept the risk and purchase additional cyber insurance to cover potential losses

Question 15

You are a risk analyst at a healthcare organization. The organization recently deployed a new electronic health records (EHR) system. During the first month of operation, the IT helpdesk received multiple reports from doctors that the system becomes unresponsive for 10-15 seconds several times a day. The EHR vendor attributes this to insufficient database connection pooling, but the organization's system administrator notes that the database server's CPU and memory utilization never exceed 30%. The organization has a risk management policy that requires any system with availability <99.5% to be treated as a high risk. Based on initial data, the system has been unavailable for about 0.1% of the time (excluding planned maintenance). However, doctors report that the brief unresponsiveness is causing frustration and potential misdiagnosis due to interrupted workflows. You need to recommend a risk treatment approach. What should you do?

Accepted Answer

Conduct a deeper analysis to quantify the impact of these brief outages on clinical workflows and patient safety, then reassess risk. Option D is correct because the risk management policy defines high risk based on availability <99.5%, and the system currently shows 99.9% availability (0.1% unavailability). However, the brief 10-15 second unresponsiveness may still pose a clinical safety risk that is not captured by a simple uptime metric. A deeper analysis is required to quantify the actual impact on clinical workflows and patient safety before deciding on risk treatment, as the policy may need to consider functional availability rather than just binary uptime.

Answer

Accept the current risk because the system meets the 99.5% availability threshold

Answer

Reduce the risk by implementing a load balancer and additional application servers

Answer

Document the system as high risk and require immediate remediation, such as upgrading the database server hardware

Question 16

Drag and drop the steps to configure a static route on a Cisco IOS router into the correct order.

Question 17

Drag and drop the steps for properly disposing of a hard drive containing sensitive data into the correct order.

Question 18

Match each security control type to its example.

Question 19

Match each security policy type to its purpose.

Question 20

A security analyst notices a sudden increase in failed login attempts from a single IP address across multiple user accounts. Which risk response strategy is most appropriate to implement immediately?

Accepted Answer

Risk mitigation by blocking the IP address. Option C is correct because blocking the IP address reduces the immediate risk of further unauthorized access. Option A is wrong because accepting risk is not appropriate when an active threat is present. Option B is wrong because transferring risk (e.g., cyber insurance) does not stop the ongoing attack. Option D is wrong because remediation might involve patching or changing passwords, but this is not the immediate action; blocking is faster.

Answer

Risk remediation by changing all user passwords

Answer

Risk transfer

Answer

Risk acceptance