SSCP Risk Identification, Monitoring and Analysis Practice Test 2 — 15 Questions

Question 1

Drag and drop the steps to configure a static route on a Cisco IOS router into the correct order.

Question 2

Drag and drop the steps for properly disposing of a hard drive containing sensitive data into the correct order.

Question 3

Match each security control type to its example.

Question 4

Match each security policy type to its purpose.

Question 5

A security analyst notices a sudden increase in failed login attempts from a single IP address across multiple user accounts. Which risk response strategy is most appropriate to implement immediately?

Accepted Answer

Risk mitigation by blocking the IP address. Option C is correct because blocking the IP address reduces the immediate risk of further unauthorized access. Option A is wrong because accepting risk is not appropriate when an active threat is present. Option B is wrong because transferring risk (e.g., cyber insurance) does not stop the ongoing attack. Option D is wrong because remediation might involve patching or changing passwords, but this is not the immediate action; blocking is faster.

Answer

Risk remediation by changing all user passwords

Answer

Risk transfer

Answer

Risk acceptance

Question 6

During a quantitative risk analysis, the asset value is $500,000, the exposure factor is 40%, and the annual rate of occurrence is 0.5. What is the annualized loss expectancy (ALE)?

Accepted Answer

$100,000. The annualized loss expectancy (ALE) is calculated as single loss expectancy (SLE) multiplied by the annual rate of occurrence (ARO). SLE is asset value ($500,000) times exposure factor (40%) = $200,000. ALE = $200,000 × 0.5 = $100,000. This is the standard quantitative risk analysis formula per NIST SP 800-30.

Answer

$200,000

Answer

$500,000

Answer

$250,000

Question 7

A company is implementing a risk monitoring program. Which of the following is the best key performance indicator (KPI) to measure the effectiveness of the vulnerability management process?

Accepted Answer

Mean time to remediate (MTTR) critical vulnerabilities. Mean time to remediate (MTTR) critical vulnerabilities directly measures how quickly the organization closes the window of exposure for the highest-risk flaws. This KPI reflects the efficiency of the remediation workflow—from detection through patching or compensating control deployment—and is a standard metric in frameworks like NIST SP 800-40 and the CVSS scoring system. A lower MTTR indicates a more effective vulnerability management process because it reduces the time attackers have to exploit known weaknesses.

Answer

Percentage of systems with up-to-date patches

Answer

Number of vulnerability scans performed per month

Answer

Number of vulnerabilities discovered per scan

Question 8

A system administrator receives an alert from the SIEM indicating a possible brute-force attack on a server. The logs show 100 failed logins in 2 minutes from a single source. Which of the following is the best immediate action to verify and respond?

Accepted Answer

Check firewall logs for the source IP and block it in the firewall. Option B is correct because the immediate priority is to stop the ongoing attack by blocking the source IP at the firewall. Checking firewall logs confirms the source IP and ensures the block is applied to the correct address, preventing further authentication attempts. This aligns with the principle of containment before remediation in incident response.

Answer

Immediately disable the user account that was targeted most

Answer

Reset all user passwords and enable multi-factor authentication

Answer

Ignore the alert because it is likely a false positive

Question 9

In the context of risk assessment, which of the following best describes a vulnerability?

Accepted Answer

A weakness in a system that can be exploited. In risk assessment, a vulnerability is specifically a weakness in a system, application, or process that can be exploited by a threat. Option D correctly defines this as a weakness that can be exploited, which aligns with the NIST SP 800-30 definition of vulnerability as a flaw or weakness in system security procedures, design, implementation, or internal controls that could be exercised (accidentally triggered or intentionally exploited) and result in a security breach or a violation of the system’s security policy.

Answer

A potential event that can cause harm

Answer

The likelihood of a threat exploiting a weakness

Answer

An actual occurrence of a harmful event

Question 10

A security team is conducting a qualitative risk assessment for a new cloud application. They want to prioritize risks based on likelihood and impact. Which method should they use to combine these factors?

Accepted Answer

Risk matrix (heat map). A risk matrix (heat map) is the correct method because it combines qualitative assessments of likelihood and impact into a single visual grid, allowing the team to prioritize risks by their position in the matrix. This approach is standard for qualitative risk assessments where numerical data is unavailable, as it maps ordinal ratings (e.g., low, medium, high) to a color-coded priority level.

Answer

SWOT analysis

Answer

Annualized loss expectancy (ALE)

Answer

Business Impact Analysis (BIA)

Question 11

An organization has implemented a SIEM solution and wants to reduce false positives. Which of the following is the most effective approach?

Accepted Answer

Tune correlation rules to exclude known benign activities. Option C is correct because tuning correlation rules based on known false positive patterns reduces noise. Option A is wrong because increasing log sources may introduce more noise. Option B is wrong because lowering thresholds may increase false positives. Option D is wrong because manually verifying all alerts is inefficient and does not reduce false positives.

Answer

Increase the number of log sources feeding the SIEM

Answer

Raise the threshold for each correlation rule to reduce alerts

Answer

Assign more analysts to manually review all alerts

Question 12

Which of the following is the primary purpose of a risk register?

Accepted Answer

To document and track identified risks and their treatment. The primary purpose of a risk register is to document and track identified risks along with their treatment plans, including risk owners, likelihood, impact, and mitigation status. This aligns with the Risk Identification, Monitoring and Analysis domain, where the risk register serves as a central repository for risk management activities throughout the system development life cycle.

Answer

To record all security incidents after they occur

Answer

To track changes made to system configurations

Answer

To automatically detect vulnerabilities in the network

Question 13

A company's risk management policy states that all risks with a residual risk score of 8 or higher (on a scale of 1-10) must be treated. A risk is identified with an inherent risk score of 9, and after applying controls, the residual risk score is 7. What is the appropriate action?

Accepted Answer

Formally accept the residual risk. Option B is correct because the residual risk is below the threshold, so it can be accepted after formal acceptance. Option A is wrong because the residual risk is already below the threshold. Option C is wrong because residual risk already accounts for controls. Option D is wrong because insurance transfers risk but is not required if the risk is acceptable.

Answer

Apply additional controls to reduce the risk further

Answer

Purchase cyber insurance to transfer the risk

Answer

Reassess the inherent risk score

Question 14

Which TWO of the following are key components of a Security Information and Event Management (SIEM) system? (Select two.)

Accepted Answer

Centralized log collection and storage. Centralized log collection and storage is a core SIEM component because it aggregates logs from diverse sources (servers, firewalls, applications) into a single repository, enabling unified analysis and forensic investigation. Without this centralized data lake, the correlation engine would have no data to process, making the SIEM ineffective.

Answer

Vulnerability scanning

Answer

Intrusion detection system (IDS)

Answer

Data loss prevention (DLP)

Question 15

Which THREE of the following are valid risk treatment options according to ISO 31000? (Select three.)

Accepted Answer

Risk retention. Risk retention (A) is a valid risk treatment option under ISO 31000 because it involves accepting the current level of risk, often when the cost of mitigation exceeds the potential impact or when the risk is within the organization's risk appetite. This is a deliberate decision to bear the risk, typically documented in a risk register and monitored for changes.

Answer

Risk elimination

Answer

Risk duplication