SSCP Risk Identification, Monitoring and Analysis Practice Test 4 — 15 Questions

Question 1

Refer to the exhibit. An analyst reviews the sshd log. What should be the immediate response?

Accepted Answer

Change the root password and disable root SSH login. The sshd log shows repeated failed root login attempts from IP 203.0.113.5, indicating a brute-force attack targeting the root account. The immediate response is to change the root password and disable root SSH login (e.g., set `PermitRootLogin no` in `/etc/ssh/sshd_config`), as this directly mitigates the attack vector by removing the ability to authenticate as root via SSH. This aligns with the principle of least privilege and is a standard first step in SSH security hardening.

Answer

Block the source IP 203.0.113.5 on the firewall

Answer

Disable SSH service on the server

Answer

Inform the server administrator of the suspicious activity

Question 2

Refer to the exhibit. During a security review, an analyst finds these firewall rules. Which recommendation should be made to reduce risk?

Accepted Answer

Restrict the source for rule 10 to specific administrative IPs. Rule 10 allows SSH (TCP/22) from any source (0.0.0.0/0) to the internal server, which exposes the management interface to the entire internet. Restricting the source to specific administrative IPs reduces the attack surface by limiting who can initiate SSH connections, mitigating brute-force and unauthorized access risks. This aligns with the principle of least privilege and is a fundamental access control recommendation.

Answer

Enable logging on rule 15 as well

Answer

Require VPN access for all internal traffic

Answer

Remove rule 15 entirely

Question 3

Which TWO of the following are key components of a risk assessment process?

Accepted Answer

Asset identification. Asset identification (B) is a key component because you cannot assess risk without knowing what assets need protection. Threat identification (E) is also essential because risk is defined as the likelihood of a threat exploiting a vulnerability to cause harm to an asset. Together, asset and threat identification form the foundational inputs for calculating risk.

Answer

Control testing

Answer

Vulnerability identification

Answer

Risk treatment selection

Question 4

Which THREE of the following are examples of detective controls?

Accepted Answer

Intrusion detection system (IDS). An intrusion detection system (IDS) is a detective control because it passively monitors network traffic or system activity for signs of malicious behavior or policy violations, generating alerts when suspicious patterns are detected. Unlike a preventive control, an IDS does not block traffic; it only identifies and reports incidents after they occur or in real-time, making it a classic example of a detective security measure.

Answer

Data encryption at rest

Answer

Firewall with default-deny rule

Question 5

Which THREE of the following are key elements of a security incident response plan?

Accepted Answer

Preparation and training. Preparation and training (Option B) is a key element because an incident response plan must include establishing and rehearsing procedures, roles, and tools before an incident occurs. Without trained personnel and tested playbooks, the response will be chaotic and ineffective, regardless of other plan components.

Answer

Vendor management process

Answer

Restoring all systems from backup

Question 6

A security analyst notices an increase in failed login attempts from a single IP address. What is the best immediate action?

Accepted Answer

Check the SIEM for correlated events.. Checking the SIEM for correlated events (Option D) is the best immediate action because it allows the analyst to gather context around the failed login attempts—such as whether they target multiple accounts, originate from a known malicious IP, or coincide with other suspicious activity—before taking a potentially disruptive or irreversible step. This aligns with the incident response principle of 'verify before you act,' ensuring the response is proportional and informed by correlated data from multiple sources.

Answer

Run an antivirus scan.

Answer

Disable the user accounts.

Answer

Block the IP at the firewall.

Question 7

During a vulnerability scan, a critical vulnerability is found on a publicly accessible web server. The server hosts a legacy application that cannot be patched immediately. What should the risk manager do first?

Accepted Answer

Implement compensating controls.. Option A is correct because when a critical vulnerability cannot be patched immediately, implementing compensating controls is the appropriate first step to reduce risk while maintaining business operations. Compensating controls, such as a web application firewall (WAF) with custom rules to block exploit attempts or network segmentation with strict access control lists (ACLs), provide a temporary mitigation layer. This aligns with the risk management principle of reducing risk to an acceptable level without disrupting critical services.

Answer

Remove the server from the network.

Answer

Notify the application owner.

Answer

Accept the risk.

Question 8

A company uses a SIEM to monitor security events. Recently, they are experiencing false positives from a new IDS rule. Which approach would best reduce false positives while maintaining detection?

Accepted Answer

Adjust the rule threshold.. Adjusting the rule threshold (Option D) is the best approach because it fine-tunes the sensitivity of the IDS rule to reduce false positives without completely disabling detection. By raising the threshold (e.g., increasing the number of matching packets or the time window), the SIEM will only generate an alert when the rule's criteria are met more persistently, filtering out noise while still capturing genuine threats. This maintains the rule's detection capability for actual attacks that exceed the adjusted threshold.

Answer

Disable the rule.

Answer

Increase the log review frequency.

Answer

Whitelist false positive sources.

Question 9

An organization wants to perform a risk analysis for a new cloud application. Which quantitative metric is most commonly used to calculate risk?

Accepted Answer

Annualized Loss Expectancy (ALE).. Annualized Loss Expectancy (ALE) is the most commonly used quantitative metric for calculating risk because it combines the expected financial loss from a single event (Single Loss Expectancy) with the annual frequency of that event (Annualized Rate of Occurrence). This produces a dollar-value risk figure that organizations can directly compare against security control costs and budget decisions for a cloud application.

Answer

Control effectiveness.

Answer

Threat likelihood.

Answer

Residual risk.

Question 10

A security team is conducting a penetration test. In which phase would they attempt to exploit vulnerabilities found during scanning?

Accepted Answer

Gaining access.. The gaining access phase is where the penetration tester actively exploits vulnerabilities discovered during scanning to obtain unauthorized entry into the system. This phase involves using tools like Metasploit or custom exploits to leverage specific weaknesses, such as unpatched software or misconfigured services, to achieve initial foothold. It directly follows the scanning phase and precedes maintaining access, making D the correct choice.

Answer

Maintaining access.

Answer

Scanning.

Answer

Reconnaissance.

Question 11

An organization's risk register shows a high risk for phishing attacks. Which controls are considered detective controls for this risk?

Accepted Answer

User reporting mechanism.. A user reporting mechanism is a detective control because it enables users to identify and report suspected phishing emails after they have been received, allowing the security team to investigate and respond. Unlike preventive controls that block attacks, detective controls discover incidents that have already occurred, such as a user recognizing a malicious link or attachment in their inbox.

Answer

Security awareness training.

Answer

Email filtering.

Answer

Multi-factor authentication.

Question 12

A small business wants to identify vulnerabilities in its network. Which type of scan should they perform first to get an overview?

Accepted Answer

Ping sweep.. A ping sweep (ICMP Echo Request) is the correct first step because it quickly identifies which hosts are alive on the network, providing a baseline of active IP addresses. This overview allows the business to scope the subsequent vulnerability scan to only live targets, reducing noise and scan time. Without a ping sweep, a full port or vulnerability scan would waste resources scanning dead or unresponsive hosts.

Answer

Vulnerability scan.

Answer

Stealth scan.

Answer

Full port scan.

Question 13

After a security incident, the CSIRT is conducting lessons learned. Which output is most directly used to update the risk management process?

Accepted Answer

Risk register updates.. The risk management process is directly updated by incorporating new risk information derived from incident analysis. Risk register updates (option B) capture newly identified risks, changes in risk likelihood or impact, and the effectiveness of existing controls, which are the primary outputs that feed back into risk treatment decisions.

Answer

Updated incident response plan.

Answer

Corrective actions.

Answer

Forensic report.

Question 14

A security analyst is reviewing logs and sees an alert for a known malware signature on an endpoint. Upon investigation, the file is identified as a false positive. What should the analyst do next?

Accepted Answer

Create an exception in the detection rule.. Creating an exception in the detection rule is the correct next step because the file has been confirmed as a false positive. This action prevents the security tool from generating future alerts for the same benign file, reducing noise and allowing the analyst to focus on genuine threats. It is a standard whitelisting practice in endpoint detection and response (EDR) or antivirus systems to maintain operational efficiency without compromising security.

Answer

Quarantine the endpoint anyway.

Answer

Escalate to management.

Answer

Delete the alert from the SIEM.

Question 15

Which TWO of the following are key components of a Business Impact Analysis (BIA)?

Accepted Answer

Recovery time objective.. A Recovery Time Objective (RTO) is a key component of a Business Impact Analysis (BIA) because it defines the maximum acceptable downtime for a business process or system after a disruption. The BIA identifies critical functions and their dependencies, and RTO is derived from the financial and operational impact of downtime, directly informing recovery strategy and resource allocation.

Answer

Vulnerability assessment.

Answer

Likelihood estimation.

Answer

Threat modeling.

SSCP Risk Identification, Monitoring and Analysis Practice Test 4 — 15 Questions

Exhibit

SSCP Risk Identification, Monitoring and Analysis Practice Test 4 — 15 Questions

Exhibit