SSCP Risk Identification, Monitoring, and Analysis Practice Test 4 — 15 Questions

Question 1

A security analyst is configuring a SIEM to detect potential insider threats. Which TWO of the following data sources would be most relevant for detecting an employee exfiltrating sensitive data via email?

Accepted Answer

Email gateway logs. Email gateway logs capture metadata and content of outbound emails, including sender, recipient, subject, and attachments, enabling detection of anomalous data transfers. Data Loss Prevention (DLP) logs provide detailed policy violation alerts when sensitive data patterns (e.g., credit card numbers, classified text) are matched in email content, directly identifying exfiltration attempts.

Answer

Physical access logs

Answer

Firewall logs

Answer

DNS logs

Question 2

During a risk assessment, a bank identifies the following threats: flood, phishing attack, hardware failure, and power outage. Which TWO of these are considered environmental threat sources?

Accepted Answer

Flood. Flood (C) is an environmental threat source because it originates from natural or physical conditions outside the organization's control, such as weather or geographic location. Power outage (D) is also an environmental threat source as it stems from utility infrastructure failures or natural events, not from human or system actions. Both are classified under environmental threats in risk assessment frameworks like NIST SP 800-30.

Answer

Hardware failure

Answer

Software bug

Answer

Phishing attack

Question 3

A security team is implementing a vulnerability management program. According to industry best practices, which THREE of the following are essential components of a mature vulnerability management process?

Accepted Answer

False positive management process. Option C is correct because a false positive management process is essential for a mature vulnerability management program. Without it, security teams waste resources chasing non-existent vulnerabilities, leading to alert fatigue and missed genuine threats. A formal process to validate, document, and reduce false positives ensures scan results are actionable and trust in the program is maintained.

Answer

Manual patch management

Answer

Quarterly vulnerability scans

Question 4

During a qualitative risk analysis, an organization assigns a risk rating of 'High' for a specific threat. Which combination of factors most directly leads to this rating?

Accepted Answer

High probability and high impact. In qualitative risk analysis, risk rating is determined by the product of probability and impact. A 'High' rating directly results from both high probability and high impact, as this combination represents the greatest potential for loss. This aligns with the risk matrix approach where the highest risk scores occupy the top-right quadrant.

Answer

Low probability and low impact

Answer

High probability and low impact

Answer

Low probability and high impact

Question 5

An organization's risk register lists a vulnerability with an annualized loss expectancy (ALE) of $50,000. The cost of implementing a mitigation control is $40,000 with an expected lifespan of 5 years. The control is expected to reduce the ALE by 80%. What is the net present value (NPV) of implementing this control over 5 years, assuming a discount rate of 5%? (Ignore residual risk for simplicity.)

Accepted Answer

$133,180. The correct answer is B because the net present value (NPV) is calculated by subtracting the initial control cost from the present value of the annual savings over 5 years. The control reduces the ALE by 80%, saving $40,000 per year ($50,000 × 0.8). Using a 5% discount rate, the present value of these savings is $40,000 × 4.3295 (PV annuity factor for 5 years at 5%) = $173,180. Subtracting the $40,000 implementation cost gives an NPV of $133,180.

Answer

$120,000

Answer

$200,000

Answer

$160,000

Question 6

A security analyst notices a large number of failed login attempts from a single IP address targeting multiple user accounts within a short time frame. Which type of detection method in a SIEM would most effectively identify this pattern?

Accepted Answer

Anomaly-based detection. Anomaly-based detection establishes a baseline of normal user behavior and flags deviations, such as a sudden spike in failed logins from a single IP across multiple accounts. This pattern—a brute-force attack—does not match a known signature, so anomaly detection is the most effective SIEM method for identifying it.

Answer

Signature-based detection

Answer

Heuristic detection

Answer

Rule-based detection

Question 7

Which of the following is a primary purpose of a security baseline, such as the CIS Benchmarks?

Accepted Answer

To provide a secure configuration standard for systems. A security baseline like the CIS Benchmarks establishes a hardened, consistent configuration standard for operating systems, applications, and network devices. This reduces the attack surface by disabling unnecessary services, enforcing least privilege, and applying specific registry or file permission settings. It is a foundational step in secure system deployment and ongoing compliance.

Answer

To calculate annualized loss expectancy

Answer

To replace the need for vulnerability scanning

Answer

To detect intrusions in real-time

Question 8

An organization is required to maintain audit logs for at least one year for compliance purposes. Which log management practice best ensures the integrity of these logs?

Accepted Answer

Using write-once storage and digitally signing each log entry. Write-once storage (e.g., WORM media or append-only filesystems) prevents any modification or deletion of log entries after they are written. Digitally signing each log entry ensures that any tampering can be detected by verifying the signature against the log data. Together, these provide non-repudiation and integrity, meeting compliance requirements for immutable audit logs.

Answer

Encrypting logs during transmission only

Answer

Compressing logs to save space

Answer

Storing logs on a standard file server with restricted permissions

Question 9

A vulnerability scan identifies a critical vulnerability with a CVSS score of 9.8. According to standard remediation SLAs, within what timeframe should this vulnerability typically be remediated?

Accepted Answer

24-72 hours. A CVSS score of 9.8 falls into the 'Critical' severity range (9.0–10.0). Standard remediation SLAs for critical vulnerabilities typically require action within 24–72 hours because such vulnerabilities often allow remote code execution or complete compromise without authentication, posing an immediate and severe risk to the organization.

Answer

30 days

Answer

7 days

Answer

90 days

Question 10

Which of the following is a key advantage of using a behavior-based detection approach in a User and Entity Behavior Analytics (UEBA) system?

Accepted Answer

Ability to detect previously unknown threats based on anomalous behavior. Behavior-based detection in UEBA establishes a baseline of normal user and entity activity using machine learning and statistical models. It then identifies deviations from this baseline, enabling the detection of novel or previously unknown threats, such as zero-day exploits or insider threats, without relying on pre-defined signatures.

Answer

Requires less data processing than signature-based detection

Answer

Easier to configure and maintain

Answer

Lower false positive rates compared to signature-based detection

Question 11

During a risk assessment, a team identifies that a legacy application cannot be patched due to vendor end-of-life. The business decides to continue using the application but implement compensating controls such as network segmentation and strict access controls. This risk response strategy is best classified as:

Accepted Answer

Risk acceptance. Risk acceptance means acknowledging the risk and taking no further action beyond existing controls. Compensating controls do not eliminate the risk; they reduce it to an acceptable level, which is still acceptance.

Answer

Risk mitigation

Answer

Risk transfer

Answer

Risk avoidance

Question 12

Which of the following is a common vulnerability source that would be documented in a risk register?

Accepted Answer

CVE entries. D is correct because CVE (Common Vulnerabilities and Exposures) entries are standardized identifiers for known security vulnerabilities, making them a direct source of vulnerability information that should be documented in a risk register. A risk register captures identified risks, including specific vulnerabilities, and CVE entries provide the precise technical details needed to assess and track those risks.

Answer

Password policies

Answer

Intrusion alerts

Answer

Firewall logs

Question 13

An organization uses a network-based intrusion detection system (NIDS). An analyst receives an alert for a known exploit signature. Which type of detection is the NIDS using?

Accepted Answer

Signature-based detection. The NIDS generated an alert based on a known exploit signature, which means it compared network traffic against a database of predefined patterns or fingerprints of known attacks. This is the defining characteristic of signature-based detection, where the system relies on exact or pattern matches to known malicious activity.

Answer

Anomaly-based detection

Answer

Behavior-based detection

Answer

Heuristic detection

Question 14

A company is preparing for a PCI DSS assessment. According to PCI DSS requirements, how frequently must internal vulnerability scans be performed?

Accepted Answer

Quarterly. PCI DSS Requirement 11.2.1 mandates that internal vulnerability scans must be performed at least quarterly and after any significant change in the network. This frequency ensures that new vulnerabilities introduced since the last scan are identified and remediated before they can be exploited. Quarterly scans are a minimum; more frequent scanning is recommended for high-risk environments.

Answer

Annually

Answer

Monthly

Answer

Weekly

Question 15

Which term describes the risk that remains after implementing risk mitigation controls?

Accepted Answer

Residual risk. Residual risk is the risk that remains after all risk mitigation controls have been applied. It represents the portion of the original risk that cannot be eliminated or reduced further, and it must be accepted by management if it falls within the organization's risk appetite.

Answer

Accepted risk

Answer

Inherent risk

Answer

Control risk