SSCP Risk Identification, Monitoring, and Analysis Practice Test 2 — 15 Questions

Question 1

A security analyst is reviewing logs and notices multiple failed login attempts from a single IP address against an administrative account. The SIEM has not generated an alert. Which configuration change would best detect this scenario?

Accepted Answer

Create a SIEM correlation rule to alert on multiple failed logins from the same source. Option C is correct because a SIEM correlation rule can specifically detect multiple failed login attempts from the same source IP address by aggregating and analyzing log events in real time. Unlike signature-based or host-based IDS solutions, a SIEM correlation rule can be tuned to match this exact behavioral pattern, triggering an alert when the configured threshold (e.g., 5 failures within 10 minutes) is exceeded. This directly addresses the gap where the SIEM failed to generate an alert due to the absence of such a rule.

Answer

Enable signature-based detection on the IDS

Answer

Implement a host-based IDS on the server

Answer

Increase log retention to 1 year

Question 2

During a qualitative risk analysis, an organization rates the likelihood of a flood as 'Low' and the impact as 'High'. Using a standard 3x3 risk matrix, what is the overall risk rating?

Accepted Answer

Medium. In a standard 3x3 risk matrix, the overall risk rating is derived by combining the likelihood and impact ratings. With likelihood rated as 'Low' and impact as 'High', the intersection in the matrix typically yields a 'Medium' risk rating. This is because the matrix is designed to balance low probability events with high consequences, resulting in a moderate overall risk level.

Answer

High

Answer

Critical

Answer

Low

Question 3

An organization is calculating the Annualized Loss Expectancy (ALE) for a server. The Asset Value (AV) is $50,000, the Exposure Factor (EF) is 40%, and the Annualized Rate of Occurrence (ARO) is 0.5. What is the Single Loss Expectancy (SLE) and ALE?

Accepted Answer

SLE = $20,000, ALE = $10,000. The Single Loss Expectancy (SLE) is calculated as Asset Value (AV) × Exposure Factor (EF) = $50,000 × 0.40 = $20,000. The Annualized Loss Expectancy (ALE) is then SLE × Annualized Rate of Occurrence (ARO) = $20,000 × 0.5 = $10,000. This matches option A exactly.

Answer

SLE = $50,000, ALE = $25,000

Answer

SLE = $10,000, ALE = $5,000

Answer

SLE = $20,000, ALE = $40,000

Question 4

A company has implemented a new vulnerability scanner and the first scan reports 200 vulnerabilities. The security team needs to prioritize remediation. Which approach should they use first?

Accepted Answer

Prioritize based on CVSS score, starting with critical and high severity. Option C is correct because the Common Vulnerability Scoring System (CVSS) provides a standardized, industry-accepted method for rating vulnerability severity based on exploitability, impact, and other metrics. Prioritizing critical and high CVSS scores (e.g., 9.0-10.0 and 7.0-8.9) ensures the team addresses vulnerabilities with the highest potential for damage and exploitation first, which is a fundamental risk-based remediation strategy. This approach aligns with the NIST SP 800-40 guidance on prioritizing vulnerabilities by risk, not by arbitrary ordering or waiting for confirmation.

Answer

Remediate only vulnerabilities that are exploitable from the internet

Answer

Wait for the next scan to confirm the results before action

Answer

Remediate all vulnerabilities in alphabetical order by CVE ID

Question 5

Which of the following is a technical threat source that could lead to a security breach?

Accepted Answer

Software bug. A software bug is a technical threat source because it is an unintentional flaw in code that can be exploited to cause a security breach. For example, a buffer overflow bug in a network service can allow an attacker to execute arbitrary code, bypassing access controls. This directly aligns with the definition of a technical threat as an inherent weakness in hardware or software.

Answer

Disgruntled employee

Answer

Configuration weakness

Answer

Flood

Question 6

A security analyst is tuning a SIEM to reduce false positives. Which of the following actions is most likely to reduce false positives while maintaining detection of real threats?

Accepted Answer

Modify correlation rules to require multiple events before alerting. Modifying correlation rules to require multiple events before alerting reduces false positives by ensuring that a single benign event does not trigger an alert. This technique, often called 'thresholding' or 'event correlation,' filters out noise while still detecting multi-step attack patterns, such as a brute-force login attempt that requires multiple failed logins within a time window.

Answer

Increase the severity of all alerts to high

Answer

Disable all anomaly-based detection rules

Answer

Create a whitelist for known benign IP addresses

Question 7

During a vulnerability scan, a tool reports a critical vulnerability on a web server. The system owner claims it is a false positive because the server is not accessible from the internet. However, the server is accessible from the internal network. What is the best course of action?

Accepted Answer

Verify the vulnerability manually and if confirmed, remediate according to internal risk. Option D is correct because a vulnerability that is exploitable from the internal network still poses a significant risk, as internal threats (e.g., compromised endpoints, malicious insiders) can leverage it. The system owner’s claim that the server is not internet-facing does not negate the need for verification and remediation; internal attack surfaces must be managed according to the organization’s risk appetite. Manual verification ensures the scanner’s report is accurate, and if confirmed, remediation should follow internal risk-based prioritization.

Answer

Accept the risk and close the finding

Answer

Ignore the finding as the vulnerability scanner is known for false positives

Answer

Remove the server from the network to eliminate the risk

Question 8

A company wants to implement a security baseline for its Windows servers. Which of the following frameworks is most commonly used for this purpose?

Accepted Answer

CIS Benchmarks. CIS Benchmarks are widely adopted security configuration guidelines for various systems, including Windows servers. They provide Level 1 (basic) and Level 2 (defense-in-depth) recommendations.

Answer

ISO 27001

Answer

ITIL

Answer

COBIT

Question 9

Which type of IDS monitors network traffic at a specific network segment and analyzes packets for malicious patterns?

Accepted Answer

NIDS. A Network Intrusion Detection System (NIDS) is specifically designed to monitor traffic on a network segment, capturing packets in real time and analyzing them for known attack signatures or anomalous patterns. Unlike host-based systems, NIDS operates at the network layer, inspecting headers and payloads to detect malicious activity such as port scans, DoS attacks, or exploit attempts.

Answer

HIDS

Answer

UBA

Answer

SIEM

Question 10

An organization wants to detect insider threats by identifying abnormal user behavior. Which technology is best suited for this purpose?

Accepted Answer

User Behavior Analytics (UBA). User Behavior Analytics (UBA) is specifically designed to detect insider threats by establishing a baseline of normal user activity and then identifying anomalous deviations, such as unusual login times, abnormal data access patterns, or atypical file transfers. Unlike other security tools that rely on known signatures or network traffic patterns, UBA applies machine learning and statistical modeling to user-centric data (e.g., authentication logs, file system events, and endpoint activity) to uncover subtle, non-signature-based indicators of malicious insider behavior.

Answer

Network-based IDS

Answer

Vulnerability scanner

Answer

Signature-based antivirus

Question 11

A security manager needs to comply with PCI DSS requirement 11.2, which mandates quarterly vulnerability scans. The company uses an external Qualified Security Assessor (QSA) for the quarterly scans. However, the internal team also performs continuous scanning. Which of the following best describes the required scan frequency?

Accepted Answer

Both internal and external scans must be performed quarterly. PCI DSS Requirement 11.2 explicitly requires both internal and external vulnerability scans to be performed at least quarterly. Even though the internal team performs continuous scanning, the external scans by a Qualified Security Assessor (QSA) must still occur quarterly to satisfy compliance. Continuous scanning does not replace the mandated quarterly external scans because the standard requires independent validation of external-facing systems.

Answer

Scans are required only after significant changes to the network

Answer

Only the external scans need to be done quarterly; internal scans are optional

Answer

Continuous internal scanning eliminates the need for quarterly external scans

Question 12

During a risk assessment, a company identifies that a legacy system cannot be patched due to vendor end-of-life. The system is critical to operations. Which risk response strategy is most appropriate initially?

Accepted Answer

Mitigate the risk by implementing compensating controls. Option D is correct because when a legacy system cannot be patched due to vendor end-of-life, the most appropriate initial risk response is to implement compensating controls. Compensating controls, such as network segmentation, strict access controls, or an intrusion detection system, reduce the likelihood or impact of exploitation without requiring a patch. This approach balances operational necessity with security, as immediate decommissioning (avoidance) may be infeasible for a critical system.

Answer

Avoid the risk by decommissioning the system immediately

Answer

Transfer the risk by purchasing cyber insurance

Answer

Accept the risk without any further action

Question 13

A security analyst is reviewing logs for signs of data exfiltration. Which TWO log sources would provide the most relevant evidence? (Choose TWO.)

Accepted Answer

File server audit logs. File server audit logs track access to files, including reads, copies, and modifications, which directly indicate data exfiltration attempts. Firewall logs record outbound connections, destination IPs, and data volumes, revealing unauthorized data transfers to external hosts. Together, they provide both the source and destination evidence needed to confirm exfiltration.

Answer

Application logs

Answer

System logs

Answer

DNS logs

Question 14

A company is implementing a new SIEM. Which THREE factors are most important to ensure log integrity and usefulness for forensic investigations? (Choose THREE.)

Accepted Answer

Write-once storage to prevent modification. Write-once storage (e.g., WORM drives or append-only storage systems) prevents modification or deletion of log data after it is written. This immutability is critical for forensic investigations because it ensures that logs cannot be tampered with by an attacker or an insider, preserving the original evidence exactly as it was recorded.

Answer

Minimizing log retention to reduce storage costs

Answer

Aggregating logs from all sources into one centralized repository

Question 15

Which TWO of the following are examples of vulnerability sources? (Choose TWO.)

Accepted Answer

CVE entries. CVE entries are a structured, publicly accessible catalog of known vulnerabilities, each assigned a unique identifier (CVE-ID) and description. They serve as a primary source for identifying specific software or hardware weaknesses that can be exploited, making them a definitive vulnerability source for risk identification and monitoring.

Answer

Environmental disaster

Answer

Intentional human attack

Answer

Hardware failure