SSCP Risk Identification, Monitoring, and Analysis Practice Test 2 — 15 Questions

Question 1

Which of the following is a primary purpose of implementing a security baseline such as the CIS Benchmarks?

Accepted Answer

To establish a minimum level of security for system configurations. The primary purpose of implementing a security baseline such as the CIS Benchmarks is to establish a minimum level of security for system configurations. These benchmarks provide prescriptive, consensus-based configuration guidelines (e.g., disabling unnecessary services, setting file permissions, enforcing password policies) that reduce the attack surface and ensure a consistent, hardened starting point across all systems in an organization.

Answer

To automate incident response procedures

Answer

To detect real-time threats

Answer

To comply with regulatory requirements for log retention

Question 2

A security team is implementing a vulnerability management program. According to industry best practices, which THREE of the following are essential components of a mature vulnerability management process?

Accepted Answer

False positive management process. A false positive management process is essential for a mature vulnerability management program. Without it, security teams waste resources chasing non-existent vulnerabilities, leading to alert fatigue and missed genuine threats. A formal process to validate, document, and reduce false positives ensures scan results are actionable and trust in the program is maintained.

Answer

Manual patch management

Answer

Quarterly vulnerability scans

Question 3

A security analyst notices a large number of failed login attempts from a single IP address targeting multiple user accounts within a short time frame. Which type of detection method in a SIEM would most effectively identify this pattern?

Accepted Answer

Anomaly-based detection. Anomaly-based detection establishes a baseline of normal user behavior and flags deviations, such as a sudden spike in failed logins from a single IP across multiple accounts. This pattern—a brute-force attack—does not match a known signature, so anomaly detection is the most effective SIEM method for identifying it.

Answer

Signature-based detection

Answer

Heuristic detection

Answer

Rule-based detection

Question 4

Which of the following is a primary purpose of a security baseline, such as the CIS Benchmarks?

Accepted Answer

To provide a secure configuration standard for systems. A security baseline like the CIS Benchmarks establishes a hardened, consistent configuration standard for operating systems, applications, and network devices. This reduces the attack surface by disabling unnecessary services, enforcing least privilege, and applying specific registry or file permission settings. It is a foundational step in secure system deployment and ongoing compliance.

Answer

To calculate annualized loss expectancy

Answer

To replace the need for vulnerability scanning

Answer

To detect intrusions in real-time

Question 5

Which of the following is a common vulnerability source that would be documented in a risk register?

Accepted Answer

CVE entries. D is correct because CVE (Common Vulnerabilities and Exposures) entries are standardized identifiers for known security vulnerabilities, making them a direct source of vulnerability information that should be documented in a risk register. A risk register captures identified risks, including specific vulnerabilities, and CVE entries provide the precise technical details needed to assess and track those risks.

Answer

Password policies

Answer

Intrusion alerts

Answer

Firewall logs

Question 6

Which TWO of the following are common techniques used in quantitative risk analysis?

Accepted Answer

Exposure Factor (EF). Exposure Factor (EF) is a core quantitative metric representing the percentage of asset value lost when a specific threat occurs. It is used in quantitative risk analysis to calculate Single Loss Expectancy (SLE = AV × EF) and Annualized Loss Expectancy (ALE = SLE × ARO), enabling numerical risk prioritization.

Answer

Risk rating (High/Medium/Low)

Answer

Probability and impact matrix

Answer

Delphi technique

Question 7

A security analyst is configuring a SIEM to detect potential data exfiltration. Which TWO log sources are most critical for detecting large outbound data transfers?

Accepted Answer

Network flow logs (e.g., NetFlow). Network flow logs (e.g., NetFlow) are critical because they provide metadata about all network conversations, including source/destination IPs, ports, protocols, and byte counts. By analyzing flow records, a SIEM can detect anomalous spikes in outbound traffic volume or connections to unusual external hosts, which are strong indicators of data exfiltration. NetFlow does not inspect packet payloads, but its aggregated traffic patterns make it ideal for identifying large-scale transfers.

Answer

DNS logs

Answer

System event logs

Answer

Application error logs

Question 8

An organization is developing a risk register. Which TWO elements are essential for each risk entry?

Accepted Answer

Risk description. A risk description is essential because it provides a clear, unambiguous statement of the risk event, its cause, and its potential impact, enabling consistent understanding and analysis. The likelihood and impact rating is essential because it quantifies the risk's probability and consequence, forming the basis for prioritization and response planning. Without these two elements, a risk entry lacks the fundamental context and measurable criteria needed for effective risk management.

Answer

Risk owner

Answer

Residual risk level

Answer

Mitigation cost

Question 9

In a qualitative risk analysis, a risk is assigned a probability of 'High' and an impact of 'Medium'. According to common probability/impact matrices, what is the overall risk rating?

Accepted Answer

High. In a standard qualitative risk analysis probability/impact matrix, a 'High' probability combined with a 'Medium' impact typically yields an overall risk rating of 'High'. This is because the matrix is designed to prioritize risks where both factors are elevated, and the product or intersection of these two values falls into the 'High' category in most common 3x3 or 5x5 matrices used in frameworks like NIST SP 800-30 or ISO 31000.

Answer

Critical

Answer

Medium

Answer

Low

Question 10

A vulnerability management program requires that critical vulnerabilities be remediated within 72 hours. A scanner identifies a critical vulnerability on a server, but after patching, the scanner still reports it as vulnerable. What is the most likely cause?

Accepted Answer

The vulnerability is a false positive. False positives are common; the scanner may incorrectly flag the vulnerability even after patching.

Answer

The patch was not applied correctly

Answer

The remediation SLA was not met

Answer

The server was not rebooted after patching

Question 11

Which of the following is a vulnerability source explicitly based on publicly known flaws?

Accepted Answer

CVEs. C is correct because Common Vulnerabilities and Exposures (CVEs) are a standardized, publicly maintained list of known security flaws. Each CVE entry explicitly documents a specific vulnerability that has been discovered, verified, and published, making it a direct source of publicly known flaws used for vulnerability identification and remediation.

Answer

Configuration weaknesses

Answer

Hardware failure

Answer

Design flaws

Question 12

An organization decides to implement CIS Benchmarks on all Windows servers. They choose Level 1 settings. What does Level 1 represent?

Accepted Answer

Basic security hygiene with minimal impact. CIS Benchmarks define Level 1 as a set of configuration settings intended to provide basic security hygiene with minimal impact on business operations. These settings are designed to be easily implemented without causing significant performance degradation or service disruption, making them suitable for most systems. Level 1 focuses on essential security controls that address common vulnerabilities while maintaining system usability.

Answer

Maximum security with high operational impact

Answer

Equivalent to DISA STIGs

Answer

Only applicable to critical systems

Question 13

A security analyst is reviewing SIEM alerts and wants to identify potential data exfiltration. Which TWO of the following indicators are most relevant?

Accepted Answer

Large outbound data transfers to an external IP. Large outbound data transfers to an external IP are a classic indicator of data exfiltration, where an attacker moves stolen data outside the network. SIEM tools can detect this by monitoring traffic volume anomalies, such as a sudden spike in outbound bytes to a single external destination, which deviates from baseline behavior. This directly aligns with the risk of unauthorized data leakage.

Answer

Successful logins during business hours

Answer

Multiple failed login attempts

Answer

Elevated CPU usage on a database server

Question 14

A security manager is evaluating log sources for a SIEM implementation. Which THREE of the following are considered log types that should be included?

Accepted Answer

Security logs. Security logs (A) are correct because they record authentication events, privilege use, and policy violations, which are essential for detecting unauthorized access and compliance auditing in a SIEM. These logs typically come from operating systems, firewalls, and IDS/IPS, providing critical data for incident detection and forensic analysis.

Answer

Network logs

Answer

Physical access logs

Question 15

A security analyst is reviewing logs and notices multiple failed login attempts from a single IP address against an administrative account. The SIEM has not generated an alert. Which configuration change would best detect this scenario?

Accepted Answer

Create a SIEM correlation rule to alert on multiple failed logins from the same source. A SIEM correlation rule can specifically detect multiple failed login attempts from the same source IP address by aggregating and analyzing log events in real time. Unlike signature-based or host-based IDS solutions, a SIEM correlation rule can be tuned to match this exact behavioral pattern, triggering an alert when the configured threshold (e.g., 5 failures within 10 minutes) is exceeded. This directly addresses the gap where the SIEM failed to generate an alert due to the absence of such a rule.

Answer

Enable signature-based detection on the IDS

Answer

Implement a host-based IDS on the server

Answer

Increase log retention to 1 year