SSCP Risk Identification, Monitoring, and Analysis — All Questions With Answers

Question 1easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

In a qualitative risk analysis, a risk is assigned a probability of 'High' and an impact of 'Medium'. According to common probability/impact matrices, what is the overall risk rating?

Question 2mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security team implements a SIEM solution to collect logs from firewalls, servers, and workstations. They create a correlation rule that triggers an alert when a single user logs in from more than three different geographic locations within one hour. This is an example of which detection method?

Question 3mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A vulnerability management program requires that critical vulnerabilities be remediated within 72 hours. A scanner identifies a critical vulnerability on a server, but after patching, the scanner still reports it as vulnerable. What is the most likely cause?

Question 4hardmulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization is implementing a new vulnerability management program. The CISO wants to establish remediation SLAs based on risk severity. Which THREE of the following are commonly recommended SLAs?

Question 5easymulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security manager is evaluating log sources for a SIEM implementation. Which THREE of the following are considered log types that should be included?

Question 6easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

During a qualitative risk analysis, an organization rates the likelihood of a flood as 'Low' and the impact as 'High'. Using a standard 3x3 risk matrix, what is the overall risk rating?

Question 7mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A company has implemented a new vulnerability scanner and the first scan reports 200 vulnerabilities. The security team needs to prioritize remediation. Which approach should they use first?

Question 8easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

Which of the following is a technical threat source that could lead to a security breach?

Question 9hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security manager needs to comply with PCI DSS requirement 11.2, which mandates quarterly vulnerability scans. The company uses an external Qualified Security Assessor (QSA) for the quarterly scans. However, the internal team also performs continuous scanning. Which of the following best describes the required scan frequency?

Question 10mediummulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst is reviewing logs for signs of data exfiltration. Which TWO log sources would provide the most relevant evidence? (Choose TWO.)

Question 11hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A vulnerability scanner reports a medium-severity finding on a server. After investigation, the security team determines that the vulnerability is not exploitable due to existing compensating controls. How should this finding be classified in the vulnerability management process?

Question 12mediummulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

During a risk assessment, a bank identifies the following threats: flood, phishing attack, hardware failure, and power outage. Which TWO of these are considered environmental threat sources?

Question 13hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization's risk register lists a vulnerability with an annualized loss expectancy (ALE) of $50,000. The cost of implementing a mitigation control is $40,000 with an expected lifespan of 5 years. The control is expected to reduce the ALE by 80%. What is the net present value (NPV) of implementing this control over 5 years, assuming a discount rate of 5%? (Ignore residual risk for simplicity.)

Question 14mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst notices a large number of failed login attempts from a single IP address targeting multiple user accounts within a short time frame. Which type of detection method in a SIEM would most effectively identify this pattern?

Question 15hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A vulnerability scan identifies a critical vulnerability with a CVSS score of 9.8. According to standard remediation SLAs, within what timeframe should this vulnerability typically be remediated?

Question 16mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

During a risk assessment, a team identifies that a legacy application cannot be patched due to vendor end-of-life. The business decides to continue using the application but implement compensating controls such as network segmentation and strict access controls. This risk response strategy is best classified as:

Question 17hardmulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A SIEM correlation rule triggers when an administrative account logs in after hours and subsequently performs a bulk export of a customer database. Which THREE threat types does this scenario most likely indicate?

Question 18easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A vulnerability scanner identifies a high-severity vulnerability in a web server that is exposed to the internet. According to common remediation SLAs, what is the typical timeframe to remediate a critical vulnerability?

Question 19hardmulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security team is implementing User Behavior Analytics (UBA) to detect insider threats. Which THREE types of activities would most likely indicate a compromised account?

Question 20mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst is reviewing the organization's risk register and notices that a specific risk has a risk score that is significantly higher than others, but the annualized loss expectancy (ALE) is moderate. The analyst needs to ensure that the risk response is appropriate. Which of the following BEST explains why the risk score might be high despite a moderate ALE?

Question 21mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security manager is conducting a risk assessment and wants to prioritize risks based on their potential impact and likelihood. The organization has a low risk appetite. Which risk response strategy is most appropriate for a high-impact, high-likelihood risk that exceeds the organization's risk tolerance?

Question 22hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst is examining network traffic and observes a series of packets with the same source IP address but different destination IP addresses, all sent to port 80. The packets have varying TCP sequence numbers and are not part of an established connection. Which type of scan is most likely being performed?

Question 23hardmulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security operations center is deploying a Security Information and Event Management (SIEM) platform and must define which log sources to onboard first to support incident detection and response. The team wants to prioritize sources that provide the greatest detection value while controlling ingestion costs. Which three log sources should the team prioritize? (Choose three.)

Question 24mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst is reviewing logs and notices multiple failed login attempts for a user account, followed by a successful login from an unfamiliar IP address at 3:00 AM. Which type of risk is most directly indicated by this scenario?

Question 25hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization calculates the SLE for a server as $5,000 and the ARO as 0.2. What is the ALE?

Question 26mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

During a vulnerability scan, a security analyst discovers that several workstations are missing critical security patches. The organization decides to implement a compensating control by restricting network access to these workstations until patches are applied. Which risk response strategy is being used?

Question 27easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

Which type of IDS uses a baseline of normal behavior to detect anomalies?

Question 28hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization uses User Behavior Analytics (UBA) to detect insider threats. Which of the following activities would most likely trigger an alert for a compromised account?

Question 29easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

Which of the following is a vulnerability source explicitly based on publicly known flaws?

Question 30mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A company stores log files on a dedicated log server. To ensure log integrity, they implement a solution where logs are written to a WORM (Write Once, Read Many) device. Which property does this primarily protect?

Question 31hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

After a security incident, the incident response team needs to analyze logs from multiple sources to reconstruct the timeline. The SIEM retains logs for 90 days, but the incident occurred 120 days ago. Which action should the organization have taken to ensure log availability?

Question 32mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization decides to implement CIS Benchmarks on all Windows servers. They choose Level 1 settings. What does Level 1 represent?

Question 33mediummulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst is reviewing SIEM alerts and wants to identify potential data exfiltration. Which TWO of the following indicators are most relevant?

Question 34mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst is reviewing logs and notices multiple failed login attempts from a single IP address against an administrative account. The SIEM has not generated an alert. Which configuration change would best detect this scenario?

Question 35hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization is calculating the Annualized Loss Expectancy (ALE) for a server. The Asset Value (AV) is $50,000, the Exposure Factor (EF) is 40%, and the Annualized Rate of Occurrence (ARO) is 0.5. What is the Single Loss Expectancy (SLE) and ALE?

Question 36mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst is tuning a SIEM to reduce false positives. Which of the following actions is most likely to reduce false positives while maintaining detection of real threats?

Question 37hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

During a vulnerability scan, a tool reports a critical vulnerability on a web server. The system owner claims it is a false positive because the server is not accessible from the internet. However, the server is accessible from the internal network. What is the best course of action?

Question 38mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A company wants to implement a security baseline for its Windows servers. Which of the following frameworks is most commonly used for this purpose?

Question 39easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

Which type of IDS monitors network traffic at a specific network segment and analyzes packets for malicious patterns?

Question 40mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization wants to detect insider threats by identifying abnormal user behavior. Which technology is best suited for this purpose?

Question 41mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

During a risk assessment, a company identifies that a legacy system cannot be patched due to vendor end-of-life. The system is critical to operations. Which risk response strategy is most appropriate initially?

Question 42hardmulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A company is implementing a new SIEM. Which THREE factors are most important to ensure log integrity and usefulness for forensic investigations? (Choose THREE.)

Question 43easymulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

Which TWO of the following are examples of vulnerability sources? (Choose TWO.)

Question 44mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst is reviewing logs from a SIEM and notices multiple failed login attempts for a privileged account from an IP address in a foreign country, followed by a successful login after hours. Which type of security monitoring tool would be most effective at detecting this pattern as anomalous behavior based on user baseline?

Question 45mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

During a qualitative risk analysis, an organization assesses a threat of a data breach due to weak encryption. The likelihood is rated as 'Medium' and the impact as 'High'. According to a standard 3x3 risk matrix, what is the overall risk rating?

Question 46hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization experiences a ransomware attack that encrypts file servers. The annualized loss expectancy (ALE) for this risk is calculated as $150,000. The single loss expectancy (SLE) is $30,000. What is the annualized rate of occurrence (ARO)?

Question 47easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security team identifies a vulnerability in a web application that allows SQL injection. Which risk response strategy involves implementing input validation and parameterized queries to reduce the risk to an acceptable level?

Question 48mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

After implementing security controls, a risk assessment shows that a residual risk of data exfiltration remains. Which document should formally record this residual risk and the decision to accept it?

Question 49mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A company's vulnerability scanner reports a critical vulnerability in a third-party library. The remediation SLA for critical vulnerabilities is 48 hours. However, the patch is not yet available from the vendor. Which of the following is the most appropriate immediate action?

Question 50hardmultiple choice

Read the full DNS explanation →

A security analyst is configuring a SIEM to detect data exfiltration. Which of the following correlation rules would best identify potential data exfiltration via DNS tunneling?

Question 51mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security engineer is reviewing system logs and notices that the log file size has not changed for several days, despite high system activity. Which log management concern does this indicate?

Question 52easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

Which of the following is a primary purpose of implementing a security baseline such as the CIS Benchmarks?

Question 53mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A vulnerability scan identifies a critical flaw in a web server. The server is currently in production and cannot be patched immediately due to compatibility issues. The risk response chosen is to implement a web application firewall (WAF) rule to block exploitation attempts. This is an example of which risk response?

Question 54hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst is tuning a SIEM and needs to reduce false positives from a rule that alerts on failed logins. The rule currently triggers on any single failed login. Which modification would best reduce false positives while still detecting brute-force attacks?

Question 55easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

Which type of IDS uses a database of known attack patterns to identify malicious activity?

Question 56mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A company's security policy requires that all logs be stored in a write-once, read-many (WORM) format. What is the primary security objective of this requirement?

Question 57mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization decides to outsource its data center operations to a cloud provider. The cloud provider is responsible for physical security and hardware maintenance. This is an example of which risk response strategy?

Question 58mediummulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst is configuring a SIEM to detect potential insider threats. Which TWO of the following data sources would be most relevant for detecting an employee exfiltrating sensitive data via email?

Question 59hardmulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security team is implementing a vulnerability management program. According to industry best practices, which THREE of the following are essential components of a mature vulnerability management process?

Question 60mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

During a qualitative risk analysis, an organization assigns a risk rating of 'High' for a specific threat. Which combination of factors most directly leads to this rating?

Question 61easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

Which of the following is a primary purpose of a security baseline, such as the CIS Benchmarks?

Question 62mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization is required to maintain audit logs for at least one year for compliance purposes. Which log management practice best ensures the integrity of these logs?

Question 63mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

Which of the following is a key advantage of using a behavior-based detection approach in a User and Entity Behavior Analytics (UEBA) system?

Question 64easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

Which of the following is a common vulnerability source that would be documented in a risk register?

Question 65mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization uses a network-based intrusion detection system (NIDS). An analyst receives an alert for a known exploit signature. Which type of detection is the NIDS using?

Question 66hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A company is preparing for a PCI DSS assessment. According to PCI DSS requirements, how frequently must internal vulnerability scans be performed?

Question 67easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

Which term describes the risk that remains after implementing risk mitigation controls?

Question 68mediummulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

Which TWO of the following are common techniques used in quantitative risk analysis?

Question 69mediummulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

Which TWO of the following are examples of technical threat sources that should be considered during risk identification?

Question 70mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization's web application experienced a data breach due to a SQL injection vulnerability. During the risk analysis phase, the security team calculated the SLE as $25,000 and the ARO as 0.5. What is the ALE?

Question 71mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst notices repeated failed login attempts from a single IP address targeting a domain controller. The SIEM alerts after 10 failed attempts within 5 minutes. Which detection type is most likely used?

Question 72hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

During a risk assessment, a company identifies that a legacy system has a known CVE with a CVSS score of 9.8. The system is critical but cannot be patched immediately. The management decides to implement strict network segmentation and monitor the system continuously. This risk response is best described as:

Question 73easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst is reviewing logs and notices that an application log shows an error message indicating 'unhandled exception' followed by a stack trace. This log is most likely categorized as which type?

Question 74mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

After implementing a new IDS, the security team receives numerous alerts about legitimate traffic being flagged as malicious. This phenomenon is known as:

Question 75hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A company's security policy requires that all servers be hardened according to CIS Level 1 benchmarks. During an audit, it is discovered that a server has password complexity settings that exceed Level 1 requirements. Which of the following is the most appropriate action?

Question 76mediummulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst is configuring a SIEM to detect potential data exfiltration. Which TWO log sources are most critical for detecting large outbound data transfers?

Question 77mediummulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization is developing a risk register. Which TWO elements are essential for each risk entry?

Question 78mediummulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A vulnerability management team is scanning a network. Which THREE factors should be considered to minimize false positives?

Question 79hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security operations center (SOC) analyst is investigating a series of alerts from the intrusion detection system (IDS) indicating possible command-and-control (C2) traffic. The analyst examines network flow logs and notices periodic outbound connections from an internal server to an external IP address every 30 minutes, with each connection transferring exactly 512 bytes. The external IP address has a low reputation score. Which of the following is the MOST likely explanation for this traffic pattern?

Question 80mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst is reviewing firewall logs and notices repeated inbound TCP SYN packets to multiple destination ports on an internal web server, but no corresponding ACK packets are returned. The source IP address is spoofed. Which type of activity does this pattern most likely indicate?

Question 81hardmultiple choice

Read the full network assurance explanation →

A financial services firm operates a Security Operations Center that ingests NetFlow records, firewall logs, and endpoint telemetry into a SIEM. An analyst wants to reduce alert fatigue while still surfacing high-fidelity detections. Which approach best supports this goal?

Question 82easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization wants to quantify the potential financial loss from a specific risk scenario. The risk team estimates that a data breach would cost $500,000 in direct expenses and that such an event is expected to occur once every five years. Which metric are they calculating?

Question 83mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst at a financial firm is reviewing the risk register and notes that the firm has purchased a cyber insurance policy to cover losses from a data breach. In risk management terms, which of the following best describes this action?

Question 84mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security operations center uses Nessus to scan its internal network nightly. A newly deployed web server is reporting a critical TLS vulnerability, but the vulnerability analyst confirms the server is configured to negotiate only TLS 1.3 with approved cipher suites. The scanner plugin was last updated eight weeks ago. Which action should the analyst take FIRST to resolve the discrepancy?

Question 85mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security administrator is configuring log collection for a new web application tier. The organization must retain logs for one year and needs to ensure that log data cannot be altered after collection. Which control best meets the integrity requirement?

Question 86mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A financial services firm wants to reduce the risk of unauthorized access to its customer database. The security manager proposes implementing role-based access controls, encrypting data at rest, and enabling database activity monitoring. After these controls are in place, the residual risk is still considered high by the CISO. Which risk response strategy is the firm currently applying, and what should be done next?

Question 87hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security operations center (SOC) manager is evaluating a new intrusion detection system (IDS). The vendor claims the system can detect previously unknown attacks by building a baseline of normal network behavior and flagging deviations. Which detection methodology is the vendor describing?

Question 88mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst reviews the health dashboard of the organization's Security Information and Event Management (SIEM) platform and notices that event ingestion from the primary domain controllers stopped at 02:00, while all other log sources continue to report normally. Which of the following should the analyst investigate FIRST to determine why domain controller logs are missing?

Question 89hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An analyst is tuning an intrusion detection system that generates far too many alerts. The analyst wants to reduce noise while preserving detection of genuinely suspicious behavior. Which approach BEST supports this goal?

Question 90mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst is reviewing the organization's SIEM and notices that the daily log volume dropped by 60 percent overnight, but no maintenance window was scheduled. The analyst must determine whether this is a genuine reduction in activity or a monitoring failure. Which action should the analyst take FIRST to validate the health of the monitoring capability?

Question 91hardmultiple choice

Read the full network assurance explanation →

A security analyst is reviewing netflow data and notices a workstation periodically sending large amounts of data to an external IP address during non-business hours. The destination IP is not associated with any known business partner. The analyst suspects data exfiltration but needs to confirm before escalating. Which of the following actions would BEST validate the suspicion while preserving evidence?

Question 92mediummulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A risk analyst is conducting a quantitative risk analysis for a data center. The analyst needs to calculate the annualized loss expectancy (ALE). Which TWO of the following values are required to compute ALE? (Choose two.)

Question 93easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A risk analyst is documenting threats for a new cloud-hosted application. The analyst must classify threat sources. Which of the following is an example of an environmental threat source rather than a human threat source?

Question 94mediummultiple choice

Read the full network assurance explanation →

A financial services firm runs a Security Information and Event Management (SIEM) platform that ingests Windows Security event logs, firewall syslog, and NetFlow records. The CISO asks the analyst to detect brute-force attacks against Active Directory domain accounts. Which approach should the analyst implement to achieve this goal?

Question 95hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A financial services firm classifies its customer database as its most critical asset. The risk register shows a single entry for "unauthorized database access" with an annualized loss expectancy of $2,000,000. Management approves a database activity monitoring (DAM) solution plus tokenization of account numbers, which reduces the annualized loss expectancy to $300,000. Which of the following BEST describes the $300,000 figure in risk terms?

Question 96hardmulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A risk analyst is building a risk register for a cloud-hosted customer portal and must classify threats by their source. Which TWO of the following are examples of environmental threat sources that should be documented? (Choose two.)

Question 97hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization uses a risk register to track identified risks. A risk owner reports that a mitigation control was implemented six months ago, but the residual risk rating has not been updated and no post-implementation review was performed. Which activity is MOST important for maintaining the integrity of the risk management process?

Question 98easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security administrator is reviewing a vulnerability scan report and notices a finding labeled as a false positive. What is the most appropriate immediate action?

Question 99mediummulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security team is building a continuous monitoring program for a regulated environment. The compliance manager wants assurance that monitoring data is trustworthy and that deviations are detected promptly. Which THREE activities should be included in the monitoring program? (Choose three.)

Question 100easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security administrator is reviewing the organization's risk register and notices that a risk related to outdated antivirus signatures has been assigned a low risk score because the likelihood is considered low. However, the impact if realized would be severe. Which risk analysis approach is being used, and what is a potential limitation of this approach?

Question 101easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

During a risk assessment, a team identifies that a legacy inventory application has no vendor support and cannot be patched. Leadership decides to accept the risk because replacing the application would cost more than the potential loss. Which term best describes this decision?

Question 102easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A healthcare organization has completed a risk assessment and documented a set of identified risks in its risk register. Management decides not to purchase cyber insurance and not to implement any additional safeguards for a specific risk involving legacy medical devices. Which risk response strategy has management chosen?

Question 103mediummulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

An analyst is reviewing alerts from a network-based intrusion detection system (NIDS) deployed on a span port at the internet edge. Several alerts reference exploit attempts against services that are not exposed to the internet. Which TWO actions should the analyst take to improve the fidelity of the monitoring data? (Choose two.)

Question 104mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security operations center is deploying a network-based intrusion detection system. The team wants to detect attacks that span multiple packets and sessions, such as a slow port scan followed by exploitation attempts. Which detection method should the team prioritize to correlate these related events?

Question 105mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization wants to reduce the likelihood that a terminated employee's credentials can still be used to access SaaS applications after departure. Which control BEST addresses this risk?

Question 106mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security manager is assessing the risk of insider threat for a healthcare organization. Which of the following is the most appropriate way to categorize a malicious insider who intentionally exfiltrates patient data?

Question 107hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security operations center (SOC) receives an alert from its intrusion detection system (IDS) about a possible SQL injection attack against a web server. The SOC analyst reviews the IDS signature and sees that it triggered on a request containing the string 'OR 1=1'. However, the web application logs show that the request was blocked by a web application firewall (WAF) and returned a 403 error. Which of the following BEST describes the nature of this alert?

Question 108easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security administrator has been asked to establish baseline monitoring for a set of Linux web servers so that unexpected changes to critical system files are detected quickly. The administrator wants the tool to compute cryptographic hashes of files, store them, and alert when they change. Which of the following should the administrator deploy to meet this requirement?

Question 109hardmulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A risk analyst is building a threat model for a new customer-facing web application. The analyst must identify threat sources and classify them appropriately. Which TWO of the following are examples of environmental or natural threat sources that should be documented in the risk assessment? (Choose two.)

Question 110mediummulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security team is conducting a risk assessment for a new cloud-based collaboration platform. They need to identify potential threats and vulnerabilities. Which TWO of the following are examples of technical vulnerabilities that should be considered? (Choose two.)

Question 111hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security operations center uses a SIEM to monitor authentication activity. The team wants to detect a password spraying campaign in which a single source attempts a small number of common passwords against many different user accounts, staying below the per-account lockout threshold. Which correlation approach would BEST detect this activity?

Question 112easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization's security team is reviewing the results of a recent risk assessment. Management decides to accept a particular risk because the cost of the control exceeds the potential loss, and the risk falls within the stated risk appetite. Which term best describes this decision?

Question 113mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An analyst reviewing the risk register notices that a web application vulnerability has an annualized loss expectancy (ALE) of $40,000 before controls. A web application firewall (WAF) would cost $12,000 per year to operate and is expected to reduce the ALE to $10,000. Based on this quantitative analysis, what should the analyst recommend?

Question 114hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst is reviewing alerts from a Network Intrusion Detection System (NIDS) that monitors a demilitarized zone segment. Over one week, the same alert fires hundreds of times for traffic that the business has confirmed is a legitimate partner integration. The analyst has verified the signature is correctly written and the traffic is truly benign. What is the most appropriate action?

Question 1easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

In a qualitative risk analysis, a risk is assigned a probability of 'High' and an impact of 'Medium'. According to common probability/impact matrices, what is the overall risk rating?

Question 2mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security team implements a SIEM solution to collect logs from firewalls, servers, and workstations. They create a correlation rule that triggers an alert when a single user logs in from more than three different geographic locations within one hour. This is an example of which detection method?

Question 3mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A vulnerability management program requires that critical vulnerabilities be remediated within 72 hours. A scanner identifies a critical vulnerability on a server, but after patching, the scanner still reports it as vulnerable. What is the most likely cause?

Question 4hardmulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization is implementing a new vulnerability management program. The CISO wants to establish remediation SLAs based on risk severity. Which THREE of the following are commonly recommended SLAs?

Question 5easymulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security manager is evaluating log sources for a SIEM implementation. Which THREE of the following are considered log types that should be included?

Question 6easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

During a qualitative risk analysis, an organization rates the likelihood of a flood as 'Low' and the impact as 'High'. Using a standard 3x3 risk matrix, what is the overall risk rating?

Question 7mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A company has implemented a new vulnerability scanner and the first scan reports 200 vulnerabilities. The security team needs to prioritize remediation. Which approach should they use first?

Question 8easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

Which of the following is a technical threat source that could lead to a security breach?

Question 9hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security manager needs to comply with PCI DSS requirement 11.2, which mandates quarterly vulnerability scans. The company uses an external Qualified Security Assessor (QSA) for the quarterly scans. However, the internal team also performs continuous scanning. Which of the following best describes the required scan frequency?

Question 10mediummulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst is reviewing logs for signs of data exfiltration. Which TWO log sources would provide the most relevant evidence? (Choose TWO.)

Question 11hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A vulnerability scanner reports a medium-severity finding on a server. After investigation, the security team determines that the vulnerability is not exploitable due to existing compensating controls. How should this finding be classified in the vulnerability management process?

Question 12mediummulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

During a risk assessment, a bank identifies the following threats: flood, phishing attack, hardware failure, and power outage. Which TWO of these are considered environmental threat sources?

Question 13hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization's risk register lists a vulnerability with an annualized loss expectancy (ALE) of $50,000. The cost of implementing a mitigation control is $40,000 with an expected lifespan of 5 years. The control is expected to reduce the ALE by 80%. What is the net present value (NPV) of implementing this control over 5 years, assuming a discount rate of 5%? (Ignore residual risk for simplicity.)

Question 14mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst notices a large number of failed login attempts from a single IP address targeting multiple user accounts within a short time frame. Which type of detection method in a SIEM would most effectively identify this pattern?

Question 15hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A vulnerability scan identifies a critical vulnerability with a CVSS score of 9.8. According to standard remediation SLAs, within what timeframe should this vulnerability typically be remediated?

Question 16mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

During a risk assessment, a team identifies that a legacy application cannot be patched due to vendor end-of-life. The business decides to continue using the application but implement compensating controls such as network segmentation and strict access controls. This risk response strategy is best classified as:

Question 17hardmulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A SIEM correlation rule triggers when an administrative account logs in after hours and subsequently performs a bulk export of a customer database. Which THREE threat types does this scenario most likely indicate?

Question 18easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A vulnerability scanner identifies a high-severity vulnerability in a web server that is exposed to the internet. According to common remediation SLAs, what is the typical timeframe to remediate a critical vulnerability?

Question 19hardmulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security team is implementing User Behavior Analytics (UBA) to detect insider threats. Which THREE types of activities would most likely indicate a compromised account?

Question 20mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst is reviewing the organization's risk register and notices that a specific risk has a risk score that is significantly higher than others, but the annualized loss expectancy (ALE) is moderate. The analyst needs to ensure that the risk response is appropriate. Which of the following BEST explains why the risk score might be high despite a moderate ALE?

Question 21mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security manager is conducting a risk assessment and wants to prioritize risks based on their potential impact and likelihood. The organization has a low risk appetite. Which risk response strategy is most appropriate for a high-impact, high-likelihood risk that exceeds the organization's risk tolerance?

Question 22hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst is examining network traffic and observes a series of packets with the same source IP address but different destination IP addresses, all sent to port 80. The packets have varying TCP sequence numbers and are not part of an established connection. Which type of scan is most likely being performed?

Question 23hardmulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security operations center is deploying a Security Information and Event Management (SIEM) platform and must define which log sources to onboard first to support incident detection and response. The team wants to prioritize sources that provide the greatest detection value while controlling ingestion costs. Which three log sources should the team prioritize? (Choose three.)

Question 24mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst is reviewing logs and notices multiple failed login attempts for a user account, followed by a successful login from an unfamiliar IP address at 3:00 AM. Which type of risk is most directly indicated by this scenario?

Question 25hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization calculates the SLE for a server as $5,000 and the ARO as 0.2. What is the ALE?

Question 26mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

During a vulnerability scan, a security analyst discovers that several workstations are missing critical security patches. The organization decides to implement a compensating control by restricting network access to these workstations until patches are applied. Which risk response strategy is being used?

Question 27easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

Which type of IDS uses a baseline of normal behavior to detect anomalies?

Question 28hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization uses User Behavior Analytics (UBA) to detect insider threats. Which of the following activities would most likely trigger an alert for a compromised account?

Question 29easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

Which of the following is a vulnerability source explicitly based on publicly known flaws?

Question 30mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A company stores log files on a dedicated log server. To ensure log integrity, they implement a solution where logs are written to a WORM (Write Once, Read Many) device. Which property does this primarily protect?

Question 31hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

After a security incident, the incident response team needs to analyze logs from multiple sources to reconstruct the timeline. The SIEM retains logs for 90 days, but the incident occurred 120 days ago. Which action should the organization have taken to ensure log availability?

Question 32mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization decides to implement CIS Benchmarks on all Windows servers. They choose Level 1 settings. What does Level 1 represent?

Question 33mediummulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst is reviewing SIEM alerts and wants to identify potential data exfiltration. Which TWO of the following indicators are most relevant?

Question 34mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst is reviewing logs and notices multiple failed login attempts from a single IP address against an administrative account. The SIEM has not generated an alert. Which configuration change would best detect this scenario?

Question 35hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization is calculating the Annualized Loss Expectancy (ALE) for a server. The Asset Value (AV) is $50,000, the Exposure Factor (EF) is 40%, and the Annualized Rate of Occurrence (ARO) is 0.5. What is the Single Loss Expectancy (SLE) and ALE?

Question 36mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst is tuning a SIEM to reduce false positives. Which of the following actions is most likely to reduce false positives while maintaining detection of real threats?

Question 37hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

During a vulnerability scan, a tool reports a critical vulnerability on a web server. The system owner claims it is a false positive because the server is not accessible from the internet. However, the server is accessible from the internal network. What is the best course of action?

Question 38mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A company wants to implement a security baseline for its Windows servers. Which of the following frameworks is most commonly used for this purpose?

Question 39easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

Which type of IDS monitors network traffic at a specific network segment and analyzes packets for malicious patterns?

Question 40mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization wants to detect insider threats by identifying abnormal user behavior. Which technology is best suited for this purpose?

Question 41mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

During a risk assessment, a company identifies that a legacy system cannot be patched due to vendor end-of-life. The system is critical to operations. Which risk response strategy is most appropriate initially?

Question 42hardmulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A company is implementing a new SIEM. Which THREE factors are most important to ensure log integrity and usefulness for forensic investigations? (Choose THREE.)

Question 43easymulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

Which TWO of the following are examples of vulnerability sources? (Choose TWO.)

Question 44mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst is reviewing logs from a SIEM and notices multiple failed login attempts for a privileged account from an IP address in a foreign country, followed by a successful login after hours. Which type of security monitoring tool would be most effective at detecting this pattern as anomalous behavior based on user baseline?

Question 45mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

During a qualitative risk analysis, an organization assesses a threat of a data breach due to weak encryption. The likelihood is rated as 'Medium' and the impact as 'High'. According to a standard 3x3 risk matrix, what is the overall risk rating?

Question 46hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization experiences a ransomware attack that encrypts file servers. The annualized loss expectancy (ALE) for this risk is calculated as $150,000. The single loss expectancy (SLE) is $30,000. What is the annualized rate of occurrence (ARO)?

Question 47easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security team identifies a vulnerability in a web application that allows SQL injection. Which risk response strategy involves implementing input validation and parameterized queries to reduce the risk to an acceptable level?

Question 48mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

After implementing security controls, a risk assessment shows that a residual risk of data exfiltration remains. Which document should formally record this residual risk and the decision to accept it?

Question 49mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A company's vulnerability scanner reports a critical vulnerability in a third-party library. The remediation SLA for critical vulnerabilities is 48 hours. However, the patch is not yet available from the vendor. Which of the following is the most appropriate immediate action?

Question 50hardmultiple choice

Read the full DNS explanation →

A security analyst is configuring a SIEM to detect data exfiltration. Which of the following correlation rules would best identify potential data exfiltration via DNS tunneling?

Question 51mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security engineer is reviewing system logs and notices that the log file size has not changed for several days, despite high system activity. Which log management concern does this indicate?

Question 52easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

Which of the following is a primary purpose of implementing a security baseline such as the CIS Benchmarks?

Question 53mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A vulnerability scan identifies a critical flaw in a web server. The server is currently in production and cannot be patched immediately due to compatibility issues. The risk response chosen is to implement a web application firewall (WAF) rule to block exploitation attempts. This is an example of which risk response?

Question 54hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst is tuning a SIEM and needs to reduce false positives from a rule that alerts on failed logins. The rule currently triggers on any single failed login. Which modification would best reduce false positives while still detecting brute-force attacks?

Question 55easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

Which type of IDS uses a database of known attack patterns to identify malicious activity?

Question 56mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A company's security policy requires that all logs be stored in a write-once, read-many (WORM) format. What is the primary security objective of this requirement?

Question 57mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization decides to outsource its data center operations to a cloud provider. The cloud provider is responsible for physical security and hardware maintenance. This is an example of which risk response strategy?

Question 58mediummulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst is configuring a SIEM to detect potential insider threats. Which TWO of the following data sources would be most relevant for detecting an employee exfiltrating sensitive data via email?

Question 59hardmulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security team is implementing a vulnerability management program. According to industry best practices, which THREE of the following are essential components of a mature vulnerability management process?

Question 60mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

During a qualitative risk analysis, an organization assigns a risk rating of 'High' for a specific threat. Which combination of factors most directly leads to this rating?

Question 61easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

Which of the following is a primary purpose of a security baseline, such as the CIS Benchmarks?

Question 62mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization is required to maintain audit logs for at least one year for compliance purposes. Which log management practice best ensures the integrity of these logs?

Question 63mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

Which of the following is a key advantage of using a behavior-based detection approach in a User and Entity Behavior Analytics (UEBA) system?

Question 64easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

Which of the following is a common vulnerability source that would be documented in a risk register?

Question 65mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization uses a network-based intrusion detection system (NIDS). An analyst receives an alert for a known exploit signature. Which type of detection is the NIDS using?

Question 66hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A company is preparing for a PCI DSS assessment. According to PCI DSS requirements, how frequently must internal vulnerability scans be performed?

Question 67easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

Which term describes the risk that remains after implementing risk mitigation controls?

Question 68mediummulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

Which TWO of the following are common techniques used in quantitative risk analysis?

Question 69mediummulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

Which TWO of the following are examples of technical threat sources that should be considered during risk identification?

Question 70mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization's web application experienced a data breach due to a SQL injection vulnerability. During the risk analysis phase, the security team calculated the SLE as $25,000 and the ARO as 0.5. What is the ALE?

Question 71mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst notices repeated failed login attempts from a single IP address targeting a domain controller. The SIEM alerts after 10 failed attempts within 5 minutes. Which detection type is most likely used?

Question 72hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

During a risk assessment, a company identifies that a legacy system has a known CVE with a CVSS score of 9.8. The system is critical but cannot be patched immediately. The management decides to implement strict network segmentation and monitor the system continuously. This risk response is best described as:

Question 73easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst is reviewing logs and notices that an application log shows an error message indicating 'unhandled exception' followed by a stack trace. This log is most likely categorized as which type?

Question 74mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

After implementing a new IDS, the security team receives numerous alerts about legitimate traffic being flagged as malicious. This phenomenon is known as:

Question 75hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A company's security policy requires that all servers be hardened according to CIS Level 1 benchmarks. During an audit, it is discovered that a server has password complexity settings that exceed Level 1 requirements. Which of the following is the most appropriate action?

Question 76mediummulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst is configuring a SIEM to detect potential data exfiltration. Which TWO log sources are most critical for detecting large outbound data transfers?

Question 77mediummulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization is developing a risk register. Which TWO elements are essential for each risk entry?

Question 78mediummulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A vulnerability management team is scanning a network. Which THREE factors should be considered to minimize false positives?

Question 79hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security operations center (SOC) analyst is investigating a series of alerts from the intrusion detection system (IDS) indicating possible command-and-control (C2) traffic. The analyst examines network flow logs and notices periodic outbound connections from an internal server to an external IP address every 30 minutes, with each connection transferring exactly 512 bytes. The external IP address has a low reputation score. Which of the following is the MOST likely explanation for this traffic pattern?

Question 80mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst is reviewing firewall logs and notices repeated inbound TCP SYN packets to multiple destination ports on an internal web server, but no corresponding ACK packets are returned. The source IP address is spoofed. Which type of activity does this pattern most likely indicate?

Question 81hardmultiple choice

Read the full network assurance explanation →

A financial services firm operates a Security Operations Center that ingests NetFlow records, firewall logs, and endpoint telemetry into a SIEM. An analyst wants to reduce alert fatigue while still surfacing high-fidelity detections. Which approach best supports this goal?

Question 82easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization wants to quantify the potential financial loss from a specific risk scenario. The risk team estimates that a data breach would cost $500,000 in direct expenses and that such an event is expected to occur once every five years. Which metric are they calculating?

Question 83mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst at a financial firm is reviewing the risk register and notes that the firm has purchased a cyber insurance policy to cover losses from a data breach. In risk management terms, which of the following best describes this action?

Question 84mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security operations center uses Nessus to scan its internal network nightly. A newly deployed web server is reporting a critical TLS vulnerability, but the vulnerability analyst confirms the server is configured to negotiate only TLS 1.3 with approved cipher suites. The scanner plugin was last updated eight weeks ago. Which action should the analyst take FIRST to resolve the discrepancy?

Question 85mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security administrator is configuring log collection for a new web application tier. The organization must retain logs for one year and needs to ensure that log data cannot be altered after collection. Which control best meets the integrity requirement?

Question 86mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A financial services firm wants to reduce the risk of unauthorized access to its customer database. The security manager proposes implementing role-based access controls, encrypting data at rest, and enabling database activity monitoring. After these controls are in place, the residual risk is still considered high by the CISO. Which risk response strategy is the firm currently applying, and what should be done next?

Question 87hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security operations center (SOC) manager is evaluating a new intrusion detection system (IDS). The vendor claims the system can detect previously unknown attacks by building a baseline of normal network behavior and flagging deviations. Which detection methodology is the vendor describing?

Question 88mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst reviews the health dashboard of the organization's Security Information and Event Management (SIEM) platform and notices that event ingestion from the primary domain controllers stopped at 02:00, while all other log sources continue to report normally. Which of the following should the analyst investigate FIRST to determine why domain controller logs are missing?

Question 89hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An analyst is tuning an intrusion detection system that generates far too many alerts. The analyst wants to reduce noise while preserving detection of genuinely suspicious behavior. Which approach BEST supports this goal?

Question 90mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst is reviewing the organization's SIEM and notices that the daily log volume dropped by 60 percent overnight, but no maintenance window was scheduled. The analyst must determine whether this is a genuine reduction in activity or a monitoring failure. Which action should the analyst take FIRST to validate the health of the monitoring capability?

Question 91hardmultiple choice

Read the full network assurance explanation →

A security analyst is reviewing netflow data and notices a workstation periodically sending large amounts of data to an external IP address during non-business hours. The destination IP is not associated with any known business partner. The analyst suspects data exfiltration but needs to confirm before escalating. Which of the following actions would BEST validate the suspicion while preserving evidence?

Question 92mediummulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A risk analyst is conducting a quantitative risk analysis for a data center. The analyst needs to calculate the annualized loss expectancy (ALE). Which TWO of the following values are required to compute ALE? (Choose two.)

Question 93easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A risk analyst is documenting threats for a new cloud-hosted application. The analyst must classify threat sources. Which of the following is an example of an environmental threat source rather than a human threat source?

Question 94mediummultiple choice

Read the full network assurance explanation →

A financial services firm runs a Security Information and Event Management (SIEM) platform that ingests Windows Security event logs, firewall syslog, and NetFlow records. The CISO asks the analyst to detect brute-force attacks against Active Directory domain accounts. Which approach should the analyst implement to achieve this goal?

Question 95hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A financial services firm classifies its customer database as its most critical asset. The risk register shows a single entry for "unauthorized database access" with an annualized loss expectancy of $2,000,000. Management approves a database activity monitoring (DAM) solution plus tokenization of account numbers, which reduces the annualized loss expectancy to $300,000. Which of the following BEST describes the $300,000 figure in risk terms?

Question 96hardmulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A risk analyst is building a risk register for a cloud-hosted customer portal and must classify threats by their source. Which TWO of the following are examples of environmental threat sources that should be documented? (Choose two.)

Question 97hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization uses a risk register to track identified risks. A risk owner reports that a mitigation control was implemented six months ago, but the residual risk rating has not been updated and no post-implementation review was performed. Which activity is MOST important for maintaining the integrity of the risk management process?

Question 98easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security administrator is reviewing a vulnerability scan report and notices a finding labeled as a false positive. What is the most appropriate immediate action?

Question 99mediummulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security team is building a continuous monitoring program for a regulated environment. The compliance manager wants assurance that monitoring data is trustworthy and that deviations are detected promptly. Which THREE activities should be included in the monitoring program? (Choose three.)

Question 100easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security administrator is reviewing the organization's risk register and notices that a risk related to outdated antivirus signatures has been assigned a low risk score because the likelihood is considered low. However, the impact if realized would be severe. Which risk analysis approach is being used, and what is a potential limitation of this approach?

Question 101easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

During a risk assessment, a team identifies that a legacy inventory application has no vendor support and cannot be patched. Leadership decides to accept the risk because replacing the application would cost more than the potential loss. Which term best describes this decision?

Question 102easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A healthcare organization has completed a risk assessment and documented a set of identified risks in its risk register. Management decides not to purchase cyber insurance and not to implement any additional safeguards for a specific risk involving legacy medical devices. Which risk response strategy has management chosen?

Question 103mediummulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

An analyst is reviewing alerts from a network-based intrusion detection system (NIDS) deployed on a span port at the internet edge. Several alerts reference exploit attempts against services that are not exposed to the internet. Which TWO actions should the analyst take to improve the fidelity of the monitoring data? (Choose two.)

Question 104mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security operations center is deploying a network-based intrusion detection system. The team wants to detect attacks that span multiple packets and sessions, such as a slow port scan followed by exploitation attempts. Which detection method should the team prioritize to correlate these related events?

Question 105mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization wants to reduce the likelihood that a terminated employee's credentials can still be used to access SaaS applications after departure. Which control BEST addresses this risk?

Question 106mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security manager is assessing the risk of insider threat for a healthcare organization. Which of the following is the most appropriate way to categorize a malicious insider who intentionally exfiltrates patient data?

Question 107hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security operations center (SOC) receives an alert from its intrusion detection system (IDS) about a possible SQL injection attack against a web server. The SOC analyst reviews the IDS signature and sees that it triggered on a request containing the string 'OR 1=1'. However, the web application logs show that the request was blocked by a web application firewall (WAF) and returned a 403 error. Which of the following BEST describes the nature of this alert?

Question 108easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security administrator has been asked to establish baseline monitoring for a set of Linux web servers so that unexpected changes to critical system files are detected quickly. The administrator wants the tool to compute cryptographic hashes of files, store them, and alert when they change. Which of the following should the administrator deploy to meet this requirement?

Question 109hardmulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A risk analyst is building a threat model for a new customer-facing web application. The analyst must identify threat sources and classify them appropriately. Which TWO of the following are examples of environmental or natural threat sources that should be documented in the risk assessment? (Choose two.)

Question 110mediummulti select

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security team is conducting a risk assessment for a new cloud-based collaboration platform. They need to identify potential threats and vulnerabilities. Which TWO of the following are examples of technical vulnerabilities that should be considered? (Choose two.)

Question 111hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security operations center uses a SIEM to monitor authentication activity. The team wants to detect a password spraying campaign in which a single source attempts a small number of common passwords against many different user accounts, staying below the per-account lockout threshold. Which correlation approach would BEST detect this activity?

Question 112easymultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An organization's security team is reviewing the results of a recent risk assessment. Management decides to accept a particular risk because the cost of the control exceeds the potential loss, and the risk falls within the stated risk appetite. Which term best describes this decision?

Question 113mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

An analyst reviewing the risk register notices that a web application vulnerability has an annualized loss expectancy (ALE) of $40,000 before controls. A web application firewall (WAF) would cost $12,000 per year to operate and is expected to reduce the ALE to $10,000. Based on this quantitative analysis, what should the analyst recommend?

Question 114hardmultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst is reviewing alerts from a Network Intrusion Detection System (NIDS) that monitors a demilitarized zone segment. Over one week, the same alert fires hundreds of times for traffic that the business has confirmed is a legitimate partner integration. The analyst has verified the signature is correctly written and the traffic is truly benign. What is the most appropriate action?