SSCP Risk Identification, Monitoring, and Analysis — 15 Questions

Question 1

A security analyst is reviewing logs and notices multiple failed login attempts for a user account, followed by a successful login from an unfamiliar IP address at 3:00 AM. Which type of risk is most directly indicated by this scenario?

Accepted Answer

Human intentional risk. The scenario describes a successful login after multiple failed attempts from an unfamiliar IP address at an unusual time (3:00 AM). This pattern strongly indicates a deliberate brute-force or credential-stuffing attack, where an attacker intentionally attempts to gain unauthorized access. Therefore, the risk is human intentional, as it involves a malicious actor's purposeful actions.

Answer

Environmental risk

Answer

Human accidental risk

Answer

Technical risk

Question 2

In a qualitative risk analysis, a risk is assigned a probability of 'High' and an impact of 'Medium'. According to common probability/impact matrices, what is the overall risk rating?

Accepted Answer

High. In a standard qualitative risk analysis probability/impact matrix, a 'High' probability combined with a 'Medium' impact typically yields an overall risk rating of 'High'. This is because the matrix is designed to prioritize risks where both factors are elevated, and the product or intersection of these two values falls into the 'High' category in most common 3x3 or 5x5 matrices used in frameworks like NIST SP 800-30 or ISO 31000.

Answer

Critical

Answer

Medium

Answer

Low

Question 3

An organization calculates the SLE for a server as $5,000 and the ARO as 0.2. What is the ALE?

Accepted Answer

$1,000. The Annualized Loss Expectancy (ALE) is calculated by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO). Given SLE = $5,000 and ARO = 0.2, the ALE is $5,000 × 0.2 = $1,000. This is the expected annual financial loss from the server risk.

Answer

$5,000

Answer

$10,000

Answer

$25,000

Question 4

During a vulnerability scan, a security analyst discovers that several workstations are missing critical security patches. The organization decides to implement a compensating control by restricting network access to these workstations until patches are applied. Which risk response strategy is being used?

Accepted Answer

Mitigation. Restricting network access to vulnerable workstations reduces the likelihood of exploitation by limiting their exposure to potential threats. This is a classic mitigation strategy because it does not eliminate the vulnerability (missing patches) but instead implements a compensating control to reduce the risk to an acceptable level until the patches can be applied. Mitigation focuses on reducing the impact or probability of a risk event, which is exactly what network access restrictions achieve.

Answer

Avoidance

Answer

Transfer

Answer

Acceptance

Question 5

Which type of IDS uses a baseline of normal behavior to detect anomalies?

Accepted Answer

Anomaly-based IDS. Anomaly-based IDS (B) is correct because it establishes a baseline of normal network or system behavior through statistical modeling or machine learning, then flags deviations from that baseline as potential intrusions. This contrasts with signature-based systems that rely on predefined patterns of known attacks. The core mechanism involves profiling metrics such as CPU usage, network traffic volume, or protocol deviations over time to identify anomalies.

Answer

Host-based IDS (HIDS)

Answer

Network-based IDS (NIDS)

Answer

Signature-based IDS

Question 6

A security team implements a SIEM solution to collect logs from firewalls, servers, and workstations. They create a correlation rule that triggers an alert when a single user logs in from more than three different geographic locations within one hour. This is an example of which detection method?

Accepted Answer

Behavior-based detection. The rule detects deviations from a user's normal login pattern by flagging logins from more than three geographic locations within an hour. This is behavior-based detection because it establishes a baseline of typical user behavior (e.g., logging in from one or two locations) and triggers an alert when the observed behavior deviates from that baseline. It does not rely on known attack signatures or static heuristics, but on learned patterns of user activity.

Answer

Heuristic-based detection

Answer

Anomaly-based detection

Answer

Signature-based detection

Question 7

An organization uses User Behavior Analytics (UBA) to detect insider threats. Which of the following activities would most likely trigger an alert for a compromised account?

Accepted Answer

User attempts to access a database at 2:00 AM, which is outside their normal pattern. User Behavior Analytics (UBA) establishes a baseline of normal user activity, including typical login times, locations, and access patterns. An attempt to access a database at 2:00 AM, which falls outside the user's established temporal baseline, represents a significant deviation that UBA algorithms flag as anomalous. This behavior is a classic indicator of a compromised account, as attackers often operate during off-hours to avoid detection.

Answer

User receives a large number of emails

Answer

User logs in from a recognized corporate device

Answer

User accesses the same files as usual during business hours

Question 8

A vulnerability management program requires that critical vulnerabilities be remediated within 72 hours. A scanner identifies a critical vulnerability on a server, but after patching, the scanner still reports it as vulnerable. What is the most likely cause?

Accepted Answer

The vulnerability is a false positive. False positives are common; the scanner may incorrectly flag the vulnerability even after patching.

Answer

The patch was not applied correctly

Answer

The remediation SLA was not met

Answer

The server was not rebooted after patching

Question 9

Which of the following is a vulnerability source explicitly based on publicly known flaws?

Accepted Answer

CVEs. C is correct because Common Vulnerabilities and Exposures (CVEs) are a standardized, publicly maintained list of known security flaws. Each CVE entry explicitly documents a specific vulnerability that has been discovered, verified, and published, making it a direct source of publicly known flaws used for vulnerability identification and remediation.

Answer

Configuration weaknesses

Answer

Hardware failure

Answer

Design flaws

Question 10

A company stores log files on a dedicated log server. To ensure log integrity, they implement a solution where logs are written to a WORM (Write Once, Read Many) device. Which property does this primarily protect?

Accepted Answer

Integrity. WORM (Write Once, Read Many) technology ensures that once data is written, it cannot be altered, deleted, or overwritten. This directly protects the integrity of the log files by preventing any unauthorized or accidental modification, which is critical for maintaining a reliable audit trail.

Answer

Non-repudiation

Answer

Availability

Answer

Confidentiality

Question 11

After a security incident, the incident response team needs to analyze logs from multiple sources to reconstruct the timeline. The SIEM retains logs for 90 days, but the incident occurred 120 days ago. Which action should the organization have taken to ensure log availability?

Accepted Answer

Extend log retention period to at least 1 year. Option D is correct because the organization's log retention policy was insufficient to cover the incident timeline. The SIEM retained logs for only 90 days, but the incident occurred 120 days ago, meaning the logs were overwritten or purged before the incident was discovered. Extending the retention period to at least one year ensures logs are available for post-incident forensic analysis, aligning with industry best practices (e.g., NIST SP 800-61) and regulatory requirements that often mandate 6–12 months of log retention.

Answer

Use a different SIEM vendor

Answer

Increase log verbosity

Answer

Implement real-time alerting

Question 12

An organization decides to implement CIS Benchmarks on all Windows servers. They choose Level 1 settings. What does Level 1 represent?

Accepted Answer

Basic security hygiene with minimal impact. CIS Benchmarks define Level 1 as a set of configuration settings intended to provide basic security hygiene with minimal impact on business operations. These settings are designed to be easily implemented without causing significant performance degradation or service disruption, making them suitable for most systems. Level 1 focuses on essential security controls that address common vulnerabilities while maintaining system usability.

Answer

Maximum security with high operational impact

Answer

Equivalent to DISA STIGs

Answer

Only applicable to critical systems

Question 13

A security analyst is reviewing SIEM alerts and wants to identify potential data exfiltration. Which TWO of the following indicators are most relevant?

Accepted Answer

Large outbound data transfers to an external IP. Option B is correct because large outbound data transfers to an external IP are a classic indicator of data exfiltration, where an attacker moves stolen data outside the network. SIEM tools can detect this by monitoring traffic volume anomalies, such as a sudden spike in outbound bytes to a single external destination, which deviates from baseline behavior. This directly aligns with the risk of unauthorized data leakage.

Answer

Successful logins during business hours

Answer

Multiple failed login attempts

Answer

Elevated CPU usage on a database server

Question 14

An organization is implementing a new vulnerability management program. The CISO wants to establish remediation SLAs based on risk severity. Which THREE of the following are commonly recommended SLAs?

Accepted Answer

High: 30 days. Option A is correct because high-severity vulnerabilities typically require remediation within 30 days to balance risk reduction with operational feasibility. This aligns with common industry frameworks like PCI DSS and NIST SP 800-53, which recommend 30-day SLAs for high-risk findings to prevent exploitation while allowing time for patching cycles.

Answer

Informational: No SLA

Answer

Low: 180 days

Question 15

A security manager is evaluating log sources for a SIEM implementation. Which THREE of the following are considered log types that should be included?

Accepted Answer

Security logs. Security logs (A) are correct because they record authentication events, privilege use, and policy violations, which are essential for detecting unauthorized access and compliance auditing in a SIEM. These logs typically come from operating systems, firewalls, and IDS/IPS, providing critical data for incident detection and forensic analysis.

Answer

Network logs

Answer

Physical access logs