SSCP Risk Identification, Monitoring, and Analysis — 25 Questions

Question 1

A security analyst is reviewing logs and notices multiple failed login attempts for a user account, followed by a successful login from an unfamiliar IP address at 3:00 AM. Which type of risk is most directly indicated by this scenario?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Human intentional risk. The scenario describes a successful login after multiple failed attempts from an unfamiliar IP address at an unusual time (3:00 AM). This pattern strongly indicates a deliberate brute-force or credential-stuffing attack, where an attacker intentionally attempts to gain unauthorized access. Therefore, the risk is human intentional, as it involves a malicious actor's purposeful actions.

Answer

Environmental risk

Answer

Human accidental risk

Answer

Technical risk

Question 2

An organization calculates the SLE for a server as $5,000 and the ARO as 0.2. What is the ALE?

Accepted Answer

$1,000. The Annualized Loss Expectancy (ALE) is calculated by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO). Given SLE = $5,000 and ARO = 0.2, the ALE is $5,000 × 0.2 = $1,000. This is the expected annual financial loss from the server risk.

Answer

$5,000

Answer

$10,000

Answer

$25,000

Question 3

During a vulnerability scan, a security analyst discovers that several workstations are missing critical security patches. The organization decides to implement a compensating control by restricting network access to these workstations until patches are applied. Which risk response strategy is being used?

Accepted Answer

Mitigation. Restricting network access to vulnerable workstations reduces the likelihood of exploitation by limiting their exposure to potential threats. This is a classic mitigation strategy because it does not eliminate the vulnerability (missing patches) but instead implements a compensating control to reduce the risk to an acceptable level until the patches can be applied. Mitigation focuses on reducing the impact or probability of a risk event, which is exactly what network access restrictions achieve.

Answer

Avoidance

Answer

Transfer

Answer

Acceptance

Question 4

Which type of IDS uses a baseline of normal behavior to detect anomalies?

Accepted Answer

Anomaly-based IDS. Anomaly-based IDS (B) is correct because it establishes a baseline of normal network or system behavior through statistical modeling or machine learning, then flags deviations from that baseline as potential intrusions. This contrasts with signature-based systems that rely on predefined patterns of known attacks. The core mechanism involves profiling metrics such as CPU usage, network traffic volume, or protocol deviations over time to identify anomalies.

Answer

Host-based IDS (HIDS)

Answer

Network-based IDS (NIDS)

Answer

Signature-based IDS

Question 5

A security team implements a SIEM solution to collect logs from firewalls, servers, and workstations. They create a correlation rule that triggers an alert when a single user logs in from more than three different geographic locations within one hour. This is an example of which detection method?

Accepted Answer

Behavior-based detection. The rule detects deviations from a user's normal login pattern by flagging logins from more than three geographic locations within an hour. This is behavior-based detection because it establishes a baseline of typical user behavior (e.g., logging in from one or two locations) and triggers an alert when the observed behavior deviates from that baseline. It does not rely on known attack signatures or static heuristics, but on learned patterns of user activity.

Answer

Heuristic-based detection

Answer

Anomaly-based detection

Answer

Signature-based detection

Question 6

An organization uses User Behavior Analytics (UBA) to detect insider threats. Which of the following activities would most likely trigger an alert for a compromised account?

Accepted Answer

User attempts to access a database at 2:00 AM, which is outside their normal pattern. User Behavior Analytics (UBA) establishes a baseline of normal user activity, including typical login times, locations, and access patterns. An attempt to access a database at 2:00 AM, which falls outside the user's established temporal baseline, represents a significant deviation that UBA algorithms flag as anomalous. This behavior is a classic indicator of a compromised account, as attackers often operate during off-hours to avoid detection.

Answer

User receives a large number of emails

Answer

User logs in from a recognized corporate device

Answer

User accesses the same files as usual during business hours

Question 7

A company stores log files on a dedicated log server. To ensure log integrity, they implement a solution where logs are written to a WORM (Write Once, Read Many) device. Which property does this primarily protect?

Accepted Answer

Integrity. WORM (Write Once, Read Many) technology ensures that once data is written, it cannot be altered, deleted, or overwritten. This directly protects the integrity of the log files by preventing any unauthorized or accidental modification, which is critical for maintaining a reliable audit trail.

Answer

Non-repudiation

Answer

Availability

Answer

Confidentiality

Question 8

After a security incident, the incident response team needs to analyze logs from multiple sources to reconstruct the timeline. The SIEM retains logs for 90 days, but the incident occurred 120 days ago. Which action should the organization have taken to ensure log availability?

Accepted Answer

Extend log retention period to at least 1 year. The organization's log retention policy was insufficient to cover the incident timeline. The SIEM retained logs for only 90 days, but the incident occurred 120 days ago, meaning the logs were overwritten or purged before the incident was discovered. Extending the retention period to at least one year ensures logs are available for post-incident forensic analysis, aligning with industry best practices (e.g., NIST SP 800-61) and regulatory requirements that often mandate 6–12 months of log retention.

Answer

Use a different SIEM vendor

Answer

Increase log verbosity

Answer

Implement real-time alerting

Question 9

An organization is implementing a new vulnerability management program. The CISO wants to establish remediation SLAs based on risk severity. Which THREE of the following are commonly recommended SLAs?

Accepted Answer

High: 30 days. High-severity vulnerabilities typically require remediation within 30 days to balance risk reduction with operational feasibility. This aligns with common industry frameworks like PCI DSS and NIST SP 800-53, which recommend 30-day SLAs for high-risk findings to prevent exploitation while allowing time for patching cycles.

Answer

Informational: No SLA

Answer

Low: 180 days

Question 10

Which type of IDS monitors network traffic at a specific network segment and analyzes packets for malicious patterns?

Accepted Answer

NIDS. A Network Intrusion Detection System (NIDS) is specifically designed to monitor traffic on a network segment, capturing packets in real time and analyzing them for known attack signatures or anomalous patterns. Unlike host-based systems, NIDS operates at the network layer, inspecting headers and payloads to detect malicious activity such as port scans, DoS attacks, or exploit attempts.

Answer

HIDS

Answer

UBA

Answer

SIEM

Question 11

An organization wants to detect insider threats by identifying abnormal user behavior. Which technology is best suited for this purpose?

Accepted Answer

User Behavior Analytics (UBA). User Behavior Analytics (UBA) is specifically designed to detect insider threats by establishing a baseline of normal user activity and then identifying anomalous deviations, such as unusual login times, abnormal data access patterns, or atypical file transfers. Unlike other security tools that rely on known signatures or network traffic patterns, UBA applies machine learning and statistical modeling to user-centric data (e.g., authentication logs, file system events, and endpoint activity) to uncover subtle, non-signature-based indicators of malicious insider behavior.

Answer

Network-based IDS

Answer

Vulnerability scanner

Answer

Signature-based antivirus

Question 12

A security manager needs to comply with PCI DSS requirement 11.2, which mandates quarterly vulnerability scans. The company uses an external Qualified Security Assessor (QSA) for the quarterly scans. However, the internal team also performs continuous scanning. Which of the following best describes the required scan frequency?

Accepted Answer

Both internal and external scans must be performed quarterly. PCI DSS Requirement 11.2 explicitly requires both internal and external vulnerability scans to be performed at least quarterly. Even though the internal team performs continuous scanning, the external scans by a Qualified Security Assessor (QSA) must still occur quarterly to satisfy compliance. Continuous scanning does not replace the mandated quarterly external scans because the standard requires independent validation of external-facing systems.

Answer

Scans are required only after significant changes to the network

Answer

Only the external scans need to be done quarterly; internal scans are optional

Answer

Continuous internal scanning eliminates the need for quarterly external scans

Question 13

A security analyst is reviewing logs for signs of data exfiltration. Which TWO log sources would provide the most relevant evidence? (Choose TWO.)

Accepted Answer

File server audit logs. File server audit logs track access to files, including reads, copies, and modifications, which directly indicate data exfiltration attempts. Firewall logs record outbound connections, destination IPs, and data volumes, revealing unauthorized data transfers to external hosts. Together, they provide both the source and destination evidence needed to confirm exfiltration.

Answer

Application logs

Answer

System logs

Answer

DNS logs

Question 14

A company is implementing a new SIEM. Which THREE factors are most important to ensure log integrity and usefulness for forensic investigations? (Choose THREE.)

Accepted Answer

Write-once storage to prevent modification. Write-once storage (e.g., WORM drives or append-only storage systems) prevents modification or deletion of log data after it is written. This immutability is critical for forensic investigations because it ensures that logs cannot be tampered with by an attacker or an insider, preserving the original evidence exactly as it was recorded.

Answer

Minimizing log retention to reduce storage costs

Answer

Aggregating logs from all sources into one centralized repository

Question 15

Which TWO of the following are examples of vulnerability sources? (Choose TWO.)

Accepted Answer

CVE entries. CVE entries are a structured, publicly accessible catalog of known vulnerabilities, each assigned a unique identifier (CVE-ID) and description. They serve as a primary source for identifying specific software or hardware weaknesses that can be exploited, making them a definitive vulnerability source for risk identification and monitoring.

Answer

Environmental disaster

Answer

Intentional human attack

Answer

Hardware failure

Question 16

Which of the following is a primary purpose of implementing a security baseline such as the CIS Benchmarks?

Accepted Answer

To establish a minimum level of security for system configurations. The primary purpose of implementing a security baseline such as the CIS Benchmarks is to establish a minimum level of security for system configurations. These benchmarks provide prescriptive, consensus-based configuration guidelines (e.g., disabling unnecessary services, setting file permissions, enforcing password policies) that reduce the attack surface and ensure a consistent, hardened starting point across all systems in an organization.

Answer

To automate incident response procedures

Answer

To detect real-time threats

Answer

To comply with regulatory requirements for log retention

Question 17

A security team is implementing a vulnerability management program. According to industry best practices, which THREE of the following are essential components of a mature vulnerability management process?

Accepted Answer

False positive management process. A false positive management process is essential for a mature vulnerability management program. Without it, security teams waste resources chasing non-existent vulnerabilities, leading to alert fatigue and missed genuine threats. A formal process to validate, document, and reduce false positives ensures scan results are actionable and trust in the program is maintained.

Answer

Manual patch management

Answer

Quarterly vulnerability scans

Question 18

A security analyst notices a large number of failed login attempts from a single IP address targeting multiple user accounts within a short time frame. Which type of detection method in a SIEM would most effectively identify this pattern?

Accepted Answer

Anomaly-based detection. Anomaly-based detection establishes a baseline of normal user behavior and flags deviations, such as a sudden spike in failed logins from a single IP across multiple accounts. This pattern—a brute-force attack—does not match a known signature, so anomaly detection is the most effective SIEM method for identifying it.

Answer

Signature-based detection

Answer

Heuristic detection

Answer

Rule-based detection

Question 19

Which of the following is a primary purpose of a security baseline, such as the CIS Benchmarks?

Accepted Answer

To provide a secure configuration standard for systems. A security baseline like the CIS Benchmarks establishes a hardened, consistent configuration standard for operating systems, applications, and network devices. This reduces the attack surface by disabling unnecessary services, enforcing least privilege, and applying specific registry or file permission settings. It is a foundational step in secure system deployment and ongoing compliance.

Answer

To calculate annualized loss expectancy

Answer

To replace the need for vulnerability scanning

Answer

To detect intrusions in real-time

Question 20

Which of the following is a common vulnerability source that would be documented in a risk register?

Accepted Answer

CVE entries. D is correct because CVE (Common Vulnerabilities and Exposures) entries are standardized identifiers for known security vulnerabilities, making them a direct source of vulnerability information that should be documented in a risk register. A risk register captures identified risks, including specific vulnerabilities, and CVE entries provide the precise technical details needed to assess and track those risks.

Answer

Password policies

Answer

Intrusion alerts

Answer

Firewall logs