SSCP Risk Identification, Monitoring, and Analysis — 50 Questions

Question 1

In a qualitative risk analysis, a risk is assigned a probability of 'High' and an impact of 'Medium'. According to common probability/impact matrices, what is the overall risk rating?

Accepted Answer

High. In a standard qualitative risk analysis probability/impact matrix, a 'High' probability combined with a 'Medium' impact typically yields an overall risk rating of 'High'. This is because the matrix is designed to prioritize risks where both factors are elevated, and the product or intersection of these two values falls into the 'High' category in most common 3x3 or 5x5 matrices used in frameworks like NIST SP 800-30 or ISO 31000.

Answer

Critical

Answer

Medium

Answer

Low

Question 2

A security team implements a SIEM solution to collect logs from firewalls, servers, and workstations. They create a correlation rule that triggers an alert when a single user logs in from more than three different geographic locations within one hour. This is an example of which detection method?

Accepted Answer

Behavior-based detection. The rule detects deviations from a user's normal login pattern by flagging logins from more than three geographic locations within an hour. This is behavior-based detection because it establishes a baseline of typical user behavior (e.g., logging in from one or two locations) and triggers an alert when the observed behavior deviates from that baseline. It does not rely on known attack signatures or static heuristics, but on learned patterns of user activity.

Answer

Heuristic-based detection

Answer

Anomaly-based detection

Answer

Signature-based detection

Question 3

A vulnerability management program requires that critical vulnerabilities be remediated within 72 hours. A scanner identifies a critical vulnerability on a server, but after patching, the scanner still reports it as vulnerable. What is the most likely cause?

Accepted Answer

The vulnerability is a false positive. False positives are common; the scanner may incorrectly flag the vulnerability even after patching.

Answer

The patch was not applied correctly

Answer

The remediation SLA was not met

Answer

The server was not rebooted after patching

Question 4

An organization is implementing a new vulnerability management program. The CISO wants to establish remediation SLAs based on risk severity. Which THREE of the following are commonly recommended SLAs?

Accepted Answer

High: 30 days. Option D is correct because critical vulnerabilities—those with high exploitability and severe impact (e.g., CVSS 9.0-10.0, often actively exploited or wormable)—are commonly given the shortest remediation SLA of 24-72 hours to minimize exposure window. Option A is correct because high-severity findings (typically CVSS 7.0-8.9) are generally assigned a 30-day SLA, balancing risk reduction with operational feasibility for patching and change management. Option C is correct because medium-severity issues (typically CVSS 4.0-6.9) are commonly given a 90-day SLA, reflecting their lower likelihood or impact while still ensuring timely remediation. Option B is not a recommended SLA because informational findings, while often not requiring remediation, are typically tracked and reviewed rather than formally excluded with 'no SLA' in a mature program. Option E is not a standard recommendation because low-severity issues are usually assigned a 180-day or longer SLA, but 180 days specifically is not one of the commonly cited benchmark values (e.g., 90/180/365 vary by framework), and it is not marked correct here.

Answer

Informational: No SLA

Answer

Low: 180 days

Question 5

A security manager is evaluating log sources for a SIEM implementation. Which THREE of the following are considered log types that should be included?

Accepted Answer

Security logs. Security logs (A) are essential SIEM inputs because they capture authentication events, authorization failures, IDS/IPS alerts, and firewall or antivirus detections that directly indicate malicious activity. System logs (B) are also required, as they record OS-level events such as service starts/stops, kernel messages, driver errors, and audit records that help correlate host behavior with security incidents. Application logs (E) belong in a SIEM because they provide web server, database, and business-app events (e.g., HTTP 4xx/5xx errors, SQL exceptions, transaction failures) that reveal exploitation attempts and application-layer attacks. Network logs (C) are not marked correct here even though flow/firewall data can be useful, and physical access logs (D) are also not marked correct because they are typically handled by physical security systems rather than being one of the three log types this question expects.

Answer

Network logs

Answer

Physical access logs

Question 6

During a qualitative risk analysis, an organization rates the likelihood of a flood as 'Low' and the impact as 'High'. Using a standard 3x3 risk matrix, what is the overall risk rating?

Accepted Answer

Medium. In a standard 3x3 risk matrix, the overall risk rating is derived by combining the likelihood and impact ratings. With likelihood rated as 'Low' and impact as 'High', the intersection in the matrix typically yields a 'Medium' risk rating. This is because the matrix is designed to balance low probability events with high consequences, resulting in a moderate overall risk level.

Answer

High

Answer

Critical

Answer

Low

Question 7

A company has implemented a new vulnerability scanner and the first scan reports 200 vulnerabilities. The security team needs to prioritize remediation. Which approach should they use first?

Accepted Answer

Prioritize based on CVSS score, starting with critical and high severity. The Common Vulnerability Scoring System (CVSS) provides a standardized, industry-accepted method for rating vulnerability severity based on exploitability, impact, and other metrics. Prioritizing critical and high CVSS scores (e.g., 9.0-10.0 and 7.0-8.9) ensures the team addresses vulnerabilities with the highest potential for damage and exploitation first, which is a fundamental risk-based remediation strategy. This approach aligns with the NIST SP 800-40 guidance on prioritizing vulnerabilities by risk, not by arbitrary ordering or waiting for confirmation.

Answer

Remediate only vulnerabilities that are exploitable from the internet

Answer

Wait for the next scan to confirm the results before action

Answer

Remediate all vulnerabilities in alphabetical order by CVE ID

Question 8

Which of the following is a technical threat source that could lead to a security breach?

Accepted Answer

Software bug. A software bug is a technical threat source because it is an unintentional flaw in code that can be exploited to cause a security breach. For example, a buffer overflow bug in a network service can allow an attacker to execute arbitrary code, bypassing access controls. This directly aligns with the definition of a technical threat as an inherent weakness in hardware or software.

Answer

Disgruntled employee

Answer

Configuration weakness

Answer

Flood

Question 9

A security manager needs to comply with PCI DSS requirement 11.2, which mandates quarterly vulnerability scans. The company uses an external Qualified Security Assessor (QSA) for the quarterly scans. However, the internal team also performs continuous scanning. Which of the following best describes the required scan frequency?

Accepted Answer

Both internal and external scans must be performed quarterly. PCI DSS Requirement 11.2 explicitly requires both internal and external vulnerability scans to be performed at least quarterly. Even though the internal team performs continuous scanning, the external scans by a Qualified Security Assessor (QSA) must still occur quarterly to satisfy compliance. Continuous scanning does not replace the mandated quarterly external scans because the standard requires independent validation of external-facing systems.

Answer

Scans are required only after significant changes to the network

Answer

Only the external scans need to be done quarterly; internal scans are optional

Answer

Continuous internal scanning eliminates the need for quarterly external scans

Question 10

A security analyst is reviewing logs for signs of data exfiltration. Which TWO log sources would provide the most relevant evidence? (Choose TWO.)

Accepted Answer

File server audit logs. File server audit logs (B) are correct because they record file access, read, copy, and delete events with user and object details, directly showing whether sensitive data was accessed or staged for exfiltration. Firewall logs (D) are correct because they capture outbound connection metadata (source/destination IP, port, protocol, bytes transferred, and allow/deny actions), which can reveal large or anomalous transfers to external hosts indicative of exfiltration. Application logs (A) focus on application-level errors and transactions rather than file access or network egress, so they are less directly relevant. System logs (C) cover OS events such as service starts, authentication, and hardware issues, not data movement. DNS logs (E) can show lookups to suspicious domains, but they do not provide the file-access or outbound transfer evidence that file server audit and firewall logs do.

Answer

Application logs

Answer

System logs

Answer

DNS logs

Question 11

A vulnerability scanner reports a medium-severity finding on a server. After investigation, the security team determines that the vulnerability is not exploitable due to existing compensating controls. How should this finding be classified in the vulnerability management process?

Accepted Answer

False positive. A false positive occurs when a vulnerability scanner reports a finding that, upon investigation, is determined not to be a real security risk. In this case, the vulnerability is not exploitable due to compensating controls, meaning the scanner's alert was incorrect in the context of the actual environment. Therefore, the finding should be classified as a false positive, not a true vulnerability.

Answer

True positive

Answer

Risk acceptance

Answer

False negative

Question 12

During a risk assessment, a bank identifies the following threats: flood, phishing attack, hardware failure, and power outage. Which TWO of these are considered environmental threat sources?

Accepted Answer

Flood. In risk assessment frameworks such as NIST SP 800-30, environmental threat sources are natural or man-made events that arise from the physical surroundings rather than from human actors or internal component defects. Option C (Flood) is correct because flooding is a natural environmental event that can physically damage or destroy facilities, servers, and network infrastructure. Option D (Power outage) is correct because it is an environmental or infrastructure-related disruption (often classified as an environmental/utility failure) that can interrupt availability of systems and data center operations. Option A (Hardware failure) is not environmental; it is a technical/component failure internal to the system. Option B (Software bug) is also a technical threat arising from code defects, not the environment. Option E (Phishing attack) is a human-driven adversarial threat (social engineering), not an environmental threat source.

Answer

Hardware failure

Answer

Software bug

Answer

Phishing attack

Question 13

An organization's risk register lists a vulnerability with an annualized loss expectancy (ALE) of $50,000. The cost of implementing a mitigation control is $40,000 with an expected lifespan of 5 years. The control is expected to reduce the ALE by 80%. What is the net present value (NPV) of implementing this control over 5 years, assuming a discount rate of 5%? (Ignore residual risk for simplicity.)

Accepted Answer

$133,180. The net present value (NPV) is calculated by subtracting the initial control cost from the present value of the annual savings over 5 years. The control reduces the ALE by 80%, saving $40,000 per year ($50,000 × 0.8). Using a 5% discount rate, the present value of these savings is $40,000 × 4.3295 (PV annuity factor for 5 years at 5%) = $173,180. Subtracting the $40,000 implementation cost gives an NPV of $133,180.

Answer

$120,000

Answer

$200,000

Answer

$160,000

Question 14

A security analyst notices a large number of failed login attempts from a single IP address targeting multiple user accounts within a short time frame. Which type of detection method in a SIEM would most effectively identify this pattern?

Accepted Answer

Anomaly-based detection. Anomaly-based detection establishes a baseline of normal user behavior and flags deviations, such as a sudden spike in failed logins from a single IP across multiple accounts. This pattern—a brute-force attack—does not match a known signature, so anomaly detection is the most effective SIEM method for identifying it.

Answer

Signature-based detection

Answer

Heuristic detection

Answer

Rule-based detection

Question 15

A vulnerability scan identifies a critical vulnerability with a CVSS score of 9.8. According to standard remediation SLAs, within what timeframe should this vulnerability typically be remediated?

Accepted Answer

24-72 hours. A CVSS score of 9.8 falls into the 'Critical' severity range (9.0–10.0). Standard remediation SLAs for critical vulnerabilities typically require action within 24–72 hours because such vulnerabilities often allow remote code execution or complete compromise without authentication, posing an immediate and severe risk to the organization.

Answer

30 days

Answer

7 days

Answer

90 days

Question 16

During a risk assessment, a team identifies that a legacy application cannot be patched due to vendor end-of-life. The business decides to continue using the application but implement compensating controls such as network segmentation and strict access controls. This risk response strategy is best classified as:

Accepted Answer

Risk acceptance. Risk acceptance means acknowledging the risk and taking no further action beyond existing controls. Compensating controls do not eliminate the risk; they reduce it to an acceptable level, which is still acceptance.

Answer

Risk mitigation

Answer

Risk transfer

Answer

Risk avoidance

Question 17

A SIEM correlation rule triggers when an administrative account logs in after hours and subsequently performs a bulk export of a customer database. Which THREE threat types does this scenario most likely indicate?

Accepted Answer

Privilege escalation. Option C (Privilege escalation) is correct because the rule keys on an administrative account performing actions beyond normal business activity, which is consistent with an attacker or insider gaining or abusing elevated rights to reach sensitive systems. Option D (Data exfiltration) is correct because the bulk export of a customer database is the classic indicator of unauthorized data transfer out of the environment, and the after-hours timing strengthens that signal. Option E (Insider threat) is correct because the scenario involves a legitimate administrative account behaving anomalously, which is the defining pattern of insider misuse or a compromised insider credential. Option A (Malware infection) is not the best fit because the described behavior is account- and data-centric rather than showing host-based malware artifacts such as process injection, C2 beaconing, or file encryption. Option B (Denial of service) is not indicated because nothing in the scenario suggests resource exhaustion, flooding, or service unavailability.

Answer

Malware infection

Answer

Denial of service

Question 18

A vulnerability scanner identifies a high-severity vulnerability in a web server that is exposed to the internet. According to common remediation SLAs, what is the typical timeframe to remediate a critical vulnerability?

Accepted Answer

24-72 hours. Critical vulnerabilities in internet-exposed systems typically require remediation within 24–72 hours under common SLAs (e.g., PCI DSS, NIST, or organizational security policies). This timeframe reflects the high risk of remote exploitation, where an attacker can compromise the server before a longer window expires.

Answer

90 days

Answer

7 days

Answer

30 days

Question 19

A security team is implementing User Behavior Analytics (UBA) to detect insider threats. Which THREE types of activities would most likely indicate a compromised account?

Accepted Answer

Accessing systems not normally used by the user. Option A is correct because accessing systems not normally used by the user is a classic UBA anomaly — the account's baseline resource-access profile is violated, which often signals credential compromise or lateral movement. Option B is correct because downloading large volumes of data (data exfiltration behavior) deviates from typical transfer baselines and is a strong indicator of a compromised account or insider data theft. Option E is correct because accessing sensitive files after hours breaks the normal time-of-day and resource-sensitivity baseline, a common UBA detection for compromised credentials. Option C is not correct because logging in during normal business hours from a known workstation matches the user's established baseline and is expected behavior. Option D is not correct because printing a document is a routine, low-risk activity that by itself does not indicate account compromise.

Answer

Logging in during normal business hours from a known workstation

Answer

Printing a document

Question 20

A security analyst is reviewing the organization's risk register and notices that a specific risk has a risk score that is significantly higher than others, but the annualized loss expectancy (ALE) is moderate. The analyst needs to ensure that the risk response is appropriate. Which of the following BEST explains why the risk score might be high despite a moderate ALE?

Accepted Answer

The risk has a high single loss expectancy (SLE) and a low annualized rate of occurrence (ARO).. The correct answer is the one describing a high single loss expectancy with a low annualized rate of occurrence. In risk analysis, the risk score often reflects the potential impact of a single event, not just the annualized loss expectancy. A high SLE indicates that if the risk materializes, the loss could be severe, which drives up the risk score even if the event is infrequent and the ALE is moderate. This ensures that low-frequency, high-impact risks receive appropriate attention.

Answer

The risk has a low SLE and a high ARO, resulting in a moderate ALE but a high risk score due to frequent occurrences.

Answer

The risk has been assigned a high probability and a high impact in a qualitative risk analysis.

Answer

The risk score is based solely on the ALE, and a moderate ALE always yields a moderate risk score.