SSCP Risk Identification, Monitoring, and Analysis Practice Test 4 — 15 Questions

Question 1

A security engineer is reviewing system logs and notices that the log file size has not changed for several days, despite high system activity. Which log management concern does this indicate?

Accepted Answer

Log tampering or disabled logging. The log file size remaining static despite high system activity strongly indicates that logging has been disabled or the log files have been tampered with (e.g., truncated or replaced with empty files). Under normal operation, a busy system generates continuous log entries, causing the log file size to increase. A complete lack of size change over several days is a classic red flag for log integrity compromise, not a benign administrative action.

Answer

Incorrect time synchronization

Answer

Normal log rotation

Answer

Insufficient storage capacity

Question 2

A vulnerability scan identifies a critical flaw in a web server. The server is currently in production and cannot be patched immediately due to compatibility issues. The risk response chosen is to implement a web application firewall (WAF) rule to block exploitation attempts. This is an example of which risk response?

Accepted Answer

Risk mitigation. Implementing a WAF rule to block exploitation attempts reduces the likelihood or impact of the vulnerability without removing the flaw itself. This is a classic risk mitigation technique, as it applies a compensating control to lower residual risk while the server remains unpatched. Risk mitigation involves taking action to reduce risk to an acceptable level, which is exactly what deploying a WAF signature achieves.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer

Question 3

A security analyst is tuning a SIEM and needs to reduce false positives from a rule that alerts on failed logins. The rule currently triggers on any single failed login. Which modification would best reduce false positives while still detecting brute-force attacks?

Accepted Answer

Add a threshold of 5 failed logins within 5 minutes. Adding a threshold of 5 failed logins within 5 minutes reduces false positives from isolated accidental lockouts while still detecting the sustained pattern of failed attempts characteristic of brute-force attacks. This aligns with SIEM tuning best practices where aggregation over a time window filters out noise without losing signal.

Answer

Disable the rule entirely

Answer

Increase the severity level of the alert

Answer

Ignore failed logins from known users

Question 4

Which type of IDS uses a database of known attack patterns to identify malicious activity?

Accepted Answer

Signature-based IDS. Signature-based IDS (D) is correct because it relies on a pre-defined database of known attack patterns, or signatures, to match against network traffic or system activity. When a packet or event matches a signature, the IDS generates an alert. This is the traditional method used by systems like Snort, which compares traffic against rule sets containing specific byte sequences or protocol anomalies.

Answer

Behavior-based IDS

Answer

Network-based IDS

Answer

Anomaly-based IDS

Question 5

A company's security policy requires that all logs be stored in a write-once, read-many (WORM) format. What is the primary security objective of this requirement?

Accepted Answer

To maintain log integrity. WORM storage ensures that logs cannot be altered after creation, preserving their integrity for forensic purposes.

Answer

To ensure log availability

Answer

To improve log review speed

Answer

To reduce storage costs

Question 6

An organization decides to outsource its data center operations to a cloud provider. The cloud provider is responsible for physical security and hardware maintenance. This is an example of which risk response strategy?

Accepted Answer

Risk transfer. Transferring risk to a third party (cloud provider) is risk transfer.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk mitigation

Question 7

A vulnerability scanner reports a medium-severity finding on a server. After investigation, the security team determines that the vulnerability is not exploitable due to existing compensating controls. How should this finding be classified in the vulnerability management process?

Accepted Answer

False positive. A false positive occurs when a vulnerability scanner reports a finding that, upon investigation, is determined not to be a real security risk. In this case, the vulnerability is not exploitable due to compensating controls, meaning the scanner's alert was incorrect in the context of the actual environment. Therefore, the finding should be classified as a false positive, not a true vulnerability.

Answer

True positive

Answer

Risk acceptance

Answer

False negative

Question 8

A security analyst is configuring a SIEM to detect potential insider threats. Which TWO of the following data sources would be most relevant for detecting an employee exfiltrating sensitive data via email?

Accepted Answer

Email gateway logs. Email gateway logs capture metadata and content of outbound emails, including sender, recipient, subject, and attachments, enabling detection of anomalous data transfers. Data Loss Prevention (DLP) logs provide detailed policy violation alerts when sensitive data patterns (e.g., credit card numbers, classified text) are matched in email content, directly identifying exfiltration attempts.

Answer

Physical access logs

Answer

Firewall logs

Answer

DNS logs

Question 9

During a risk assessment, a bank identifies the following threats: flood, phishing attack, hardware failure, and power outage. Which TWO of these are considered environmental threat sources?

Accepted Answer

Flood. Flood (C) is an environmental threat source because it originates from natural or physical conditions outside the organization's control, such as weather or geographic location. Power outage (D) is also an environmental threat source as it stems from utility infrastructure failures or natural events, not from human or system actions. Both are classified under environmental threats in risk assessment frameworks like NIST SP 800-30.

Answer

Hardware failure

Answer

Software bug

Answer

Phishing attack

Question 10

During a qualitative risk analysis, an organization assigns a risk rating of 'High' for a specific threat. Which combination of factors most directly leads to this rating?

Accepted Answer

High probability and high impact. In qualitative risk analysis, risk rating is determined by the product of probability and impact. A 'High' rating directly results from both high probability and high impact, as this combination represents the greatest potential for loss. This aligns with the risk matrix approach where the highest risk scores occupy the top-right quadrant.

Answer

Low probability and low impact

Answer

High probability and low impact

Answer

Low probability and high impact

Question 11

An organization's risk register lists a vulnerability with an annualized loss expectancy (ALE) of $50,000. The cost of implementing a mitigation control is $40,000 with an expected lifespan of 5 years. The control is expected to reduce the ALE by 80%. What is the net present value (NPV) of implementing this control over 5 years, assuming a discount rate of 5%? (Ignore residual risk for simplicity.)

Accepted Answer

$133,180. The net present value (NPV) is calculated by subtracting the initial control cost from the present value of the annual savings over 5 years. The control reduces the ALE by 80%, saving $40,000 per year ($50,000 × 0.8). Using a 5% discount rate, the present value of these savings is $40,000 × 4.3295 (PV annuity factor for 5 years at 5%) = $173,180. Subtracting the $40,000 implementation cost gives an NPV of $133,180.

Answer

$120,000

Answer

$200,000

Answer

$160,000

Question 12

An organization is required to maintain audit logs for at least one year for compliance purposes. Which log management practice best ensures the integrity of these logs?

Accepted Answer

Using write-once storage and digitally signing each log entry. Write-once storage (e.g., WORM media or append-only filesystems) prevents any modification or deletion of log entries after they are written. Digitally signing each log entry ensures that any tampering can be detected by verifying the signature against the log data. Together, these provide non-repudiation and integrity, meeting compliance requirements for immutable audit logs.

Answer

Encrypting logs during transmission only

Answer

Compressing logs to save space

Answer

Storing logs on a standard file server with restricted permissions

Question 13

A vulnerability scan identifies a critical vulnerability with a CVSS score of 9.8. According to standard remediation SLAs, within what timeframe should this vulnerability typically be remediated?

Accepted Answer

24-72 hours. A CVSS score of 9.8 falls into the 'Critical' severity range (9.0–10.0). Standard remediation SLAs for critical vulnerabilities typically require action within 24–72 hours because such vulnerabilities often allow remote code execution or complete compromise without authentication, posing an immediate and severe risk to the organization.

Answer

30 days

Answer

7 days

Answer

90 days

Question 14

Which of the following is a key advantage of using a behavior-based detection approach in a User and Entity Behavior Analytics (UEBA) system?

Accepted Answer

Ability to detect previously unknown threats based on anomalous behavior. Behavior-based detection in UEBA establishes a baseline of normal user and entity activity using machine learning and statistical models. It then identifies deviations from this baseline, enabling the detection of novel or previously unknown threats, such as zero-day exploits or insider threats, without relying on pre-defined signatures.

Answer

Requires less data processing than signature-based detection

Answer

Easier to configure and maintain

Answer

Lower false positive rates compared to signature-based detection

Question 15

During a risk assessment, a team identifies that a legacy application cannot be patched due to vendor end-of-life. The business decides to continue using the application but implement compensating controls such as network segmentation and strict access controls. This risk response strategy is best classified as:

Accepted Answer

Risk acceptance. Risk acceptance means acknowledging the risk and taking no further action beyond existing controls. Compensating controls do not eliminate the risk; they reduce it to an acceptable level, which is still acceptance.

Answer

Risk mitigation

Answer

Risk transfer

Answer

Risk avoidance