SSCP Risk Identification, Monitoring, and Analysis — Timed 20 Questions

Question 1

A security analyst is reviewing logs and notices multiple failed login attempts for a user account, followed by a successful login from an unfamiliar IP address at 3:00 AM. Which type of risk is most directly indicated by this scenario?

Accepted Answer

Human intentional risk. The scenario describes a successful login after multiple failed attempts from an unfamiliar IP address at an unusual time (3:00 AM). This pattern strongly indicates a deliberate brute-force or credential-stuffing attack, where an attacker intentionally attempts to gain unauthorized access. Therefore, the risk is human intentional, as it involves a malicious actor's purposeful actions.

Answer

Environmental risk

Answer

Human accidental risk

Answer

Technical risk

Question 2

In a qualitative risk analysis, a risk is assigned a probability of 'High' and an impact of 'Medium'. According to common probability/impact matrices, what is the overall risk rating?

Accepted Answer

High. In a standard qualitative risk analysis probability/impact matrix, a 'High' probability combined with a 'Medium' impact typically yields an overall risk rating of 'High'. This is because the matrix is designed to prioritize risks where both factors are elevated, and the product or intersection of these two values falls into the 'High' category in most common 3x3 or 5x5 matrices used in frameworks like NIST SP 800-30 or ISO 31000.

Answer

Critical

Answer

Medium

Answer

Low

Question 3

An organization calculates the SLE for a server as $5,000 and the ARO as 0.2. What is the ALE?

Accepted Answer

$1,000. The Annualized Loss Expectancy (ALE) is calculated by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO). Given SLE = $5,000 and ARO = 0.2, the ALE is $5,000 × 0.2 = $1,000. This is the expected annual financial loss from the server risk.

Answer

$5,000

Answer

$10,000

Answer

$25,000

Question 4

During a vulnerability scan, a security analyst discovers that several workstations are missing critical security patches. The organization decides to implement a compensating control by restricting network access to these workstations until patches are applied. Which risk response strategy is being used?

Accepted Answer

Mitigation. Restricting network access to vulnerable workstations reduces the likelihood of exploitation by limiting their exposure to potential threats. This is a classic mitigation strategy because it does not eliminate the vulnerability (missing patches) but instead implements a compensating control to reduce the risk to an acceptable level until the patches can be applied. Mitigation focuses on reducing the impact or probability of a risk event, which is exactly what network access restrictions achieve.

Answer

Avoidance

Answer

Transfer

Answer

Acceptance

Question 5

Which type of IDS uses a baseline of normal behavior to detect anomalies?

Accepted Answer

Anomaly-based IDS. Anomaly-based IDS (B) is correct because it establishes a baseline of normal network or system behavior through statistical modeling or machine learning, then flags deviations from that baseline as potential intrusions. This contrasts with signature-based systems that rely on predefined patterns of known attacks. The core mechanism involves profiling metrics such as CPU usage, network traffic volume, or protocol deviations over time to identify anomalies.

Answer

Host-based IDS (HIDS)

Answer

Network-based IDS (NIDS)

Answer

Signature-based IDS

Question 6

A security team implements a SIEM solution to collect logs from firewalls, servers, and workstations. They create a correlation rule that triggers an alert when a single user logs in from more than three different geographic locations within one hour. This is an example of which detection method?

Accepted Answer

Behavior-based detection. The rule detects deviations from a user's normal login pattern by flagging logins from more than three geographic locations within an hour. This is behavior-based detection because it establishes a baseline of typical user behavior (e.g., logging in from one or two locations) and triggers an alert when the observed behavior deviates from that baseline. It does not rely on known attack signatures or static heuristics, but on learned patterns of user activity.

Answer

Heuristic-based detection

Answer

Anomaly-based detection

Answer

Signature-based detection

Question 7

An organization uses User Behavior Analytics (UBA) to detect insider threats. Which of the following activities would most likely trigger an alert for a compromised account?

Accepted Answer

User attempts to access a database at 2:00 AM, which is outside their normal pattern. User Behavior Analytics (UBA) establishes a baseline of normal user activity, including typical login times, locations, and access patterns. An attempt to access a database at 2:00 AM, which falls outside the user's established temporal baseline, represents a significant deviation that UBA algorithms flag as anomalous. This behavior is a classic indicator of a compromised account, as attackers often operate during off-hours to avoid detection.

Answer

User receives a large number of emails

Answer

User logs in from a recognized corporate device

Answer

User accesses the same files as usual during business hours

Question 8

A vulnerability management program requires that critical vulnerabilities be remediated within 72 hours. A scanner identifies a critical vulnerability on a server, but after patching, the scanner still reports it as vulnerable. What is the most likely cause?

Accepted Answer

The vulnerability is a false positive. False positives are common; the scanner may incorrectly flag the vulnerability even after patching.

Answer

The patch was not applied correctly

Answer

The remediation SLA was not met

Answer

The server was not rebooted after patching

Question 9

Which of the following is a vulnerability source explicitly based on publicly known flaws?

Accepted Answer

CVEs. C is correct because Common Vulnerabilities and Exposures (CVEs) are a standardized, publicly maintained list of known security flaws. Each CVE entry explicitly documents a specific vulnerability that has been discovered, verified, and published, making it a direct source of publicly known flaws used for vulnerability identification and remediation.

Answer

Configuration weaknesses

Answer

Hardware failure

Answer

Design flaws

Question 10

A company stores log files on a dedicated log server. To ensure log integrity, they implement a solution where logs are written to a WORM (Write Once, Read Many) device. Which property does this primarily protect?

Accepted Answer

Integrity. WORM (Write Once, Read Many) technology ensures that once data is written, it cannot be altered, deleted, or overwritten. This directly protects the integrity of the log files by preventing any unauthorized or accidental modification, which is critical for maintaining a reliable audit trail.

Answer

Non-repudiation

Answer

Availability

Answer

Confidentiality

Question 11

After a security incident, the incident response team needs to analyze logs from multiple sources to reconstruct the timeline. The SIEM retains logs for 90 days, but the incident occurred 120 days ago. Which action should the organization have taken to ensure log availability?

Accepted Answer

Extend log retention period to at least 1 year. Option D is correct because the organization's log retention policy was insufficient to cover the incident timeline. The SIEM retained logs for only 90 days, but the incident occurred 120 days ago, meaning the logs were overwritten or purged before the incident was discovered. Extending the retention period to at least one year ensures logs are available for post-incident forensic analysis, aligning with industry best practices (e.g., NIST SP 800-61) and regulatory requirements that often mandate 6–12 months of log retention.

Answer

Use a different SIEM vendor

Answer

Increase log verbosity

Answer

Implement real-time alerting

Question 12

An organization decides to implement CIS Benchmarks on all Windows servers. They choose Level 1 settings. What does Level 1 represent?

Accepted Answer

Basic security hygiene with minimal impact. CIS Benchmarks define Level 1 as a set of configuration settings intended to provide basic security hygiene with minimal impact on business operations. These settings are designed to be easily implemented without causing significant performance degradation or service disruption, making them suitable for most systems. Level 1 focuses on essential security controls that address common vulnerabilities while maintaining system usability.

Answer

Maximum security with high operational impact

Answer

Equivalent to DISA STIGs

Answer

Only applicable to critical systems

Question 13

A security analyst is reviewing SIEM alerts and wants to identify potential data exfiltration. Which TWO of the following indicators are most relevant?

Accepted Answer

Large outbound data transfers to an external IP. Option B is correct because large outbound data transfers to an external IP are a classic indicator of data exfiltration, where an attacker moves stolen data outside the network. SIEM tools can detect this by monitoring traffic volume anomalies, such as a sudden spike in outbound bytes to a single external destination, which deviates from baseline behavior. This directly aligns with the risk of unauthorized data leakage.

Answer

Successful logins during business hours

Answer

Multiple failed login attempts

Answer

Elevated CPU usage on a database server

Question 14

An organization is implementing a new vulnerability management program. The CISO wants to establish remediation SLAs based on risk severity. Which THREE of the following are commonly recommended SLAs?

Accepted Answer

High: 30 days. Option A is correct because high-severity vulnerabilities typically require remediation within 30 days to balance risk reduction with operational feasibility. This aligns with common industry frameworks like PCI DSS and NIST SP 800-53, which recommend 30-day SLAs for high-risk findings to prevent exploitation while allowing time for patching cycles.

Answer

Informational: No SLA

Answer

Low: 180 days

Question 15

A security manager is evaluating log sources for a SIEM implementation. Which THREE of the following are considered log types that should be included?

Accepted Answer

Security logs. Security logs (A) are correct because they record authentication events, privilege use, and policy violations, which are essential for detecting unauthorized access and compliance auditing in a SIEM. These logs typically come from operating systems, firewalls, and IDS/IPS, providing critical data for incident detection and forensic analysis.

Answer

Network logs

Answer

Physical access logs

Question 16

A security analyst is reviewing logs and notices multiple failed login attempts from a single IP address against an administrative account. The SIEM has not generated an alert. Which configuration change would best detect this scenario?

Accepted Answer

Create a SIEM correlation rule to alert on multiple failed logins from the same source. Option C is correct because a SIEM correlation rule can specifically detect multiple failed login attempts from the same source IP address by aggregating and analyzing log events in real time. Unlike signature-based or host-based IDS solutions, a SIEM correlation rule can be tuned to match this exact behavioral pattern, triggering an alert when the configured threshold (e.g., 5 failures within 10 minutes) is exceeded. This directly addresses the gap where the SIEM failed to generate an alert due to the absence of such a rule.

Answer

Enable signature-based detection on the IDS

Answer

Implement a host-based IDS on the server

Answer

Increase log retention to 1 year

Question 17

During a qualitative risk analysis, an organization rates the likelihood of a flood as 'Low' and the impact as 'High'. Using a standard 3x3 risk matrix, what is the overall risk rating?

Accepted Answer

Medium. In a standard 3x3 risk matrix, the overall risk rating is derived by combining the likelihood and impact ratings. With likelihood rated as 'Low' and impact as 'High', the intersection in the matrix typically yields a 'Medium' risk rating. This is because the matrix is designed to balance low probability events with high consequences, resulting in a moderate overall risk level.

Answer

High

Answer

Critical

Answer

Low

Question 18

An organization is calculating the Annualized Loss Expectancy (ALE) for a server. The Asset Value (AV) is $50,000, the Exposure Factor (EF) is 40%, and the Annualized Rate of Occurrence (ARO) is 0.5. What is the Single Loss Expectancy (SLE) and ALE?

Accepted Answer

SLE = $20,000, ALE = $10,000. The Single Loss Expectancy (SLE) is calculated as Asset Value (AV) × Exposure Factor (EF) = $50,000 × 0.40 = $20,000. The Annualized Loss Expectancy (ALE) is then SLE × Annualized Rate of Occurrence (ARO) = $20,000 × 0.5 = $10,000. This matches option A exactly.

Answer

SLE = $50,000, ALE = $25,000

Answer

SLE = $10,000, ALE = $5,000

Answer

SLE = $20,000, ALE = $40,000

Question 19

A company has implemented a new vulnerability scanner and the first scan reports 200 vulnerabilities. The security team needs to prioritize remediation. Which approach should they use first?

Accepted Answer

Prioritize based on CVSS score, starting with critical and high severity. Option C is correct because the Common Vulnerability Scoring System (CVSS) provides a standardized, industry-accepted method for rating vulnerability severity based on exploitability, impact, and other metrics. Prioritizing critical and high CVSS scores (e.g., 9.0-10.0 and 7.0-8.9) ensures the team addresses vulnerabilities with the highest potential for damage and exploitation first, which is a fundamental risk-based remediation strategy. This approach aligns with the NIST SP 800-40 guidance on prioritizing vulnerabilities by risk, not by arbitrary ordering or waiting for confirmation.

Answer

Remediate only vulnerabilities that are exploitable from the internet

Answer

Wait for the next scan to confirm the results before action

Answer

Remediate all vulnerabilities in alphabetical order by CVE ID

Question 20

Which of the following is a technical threat source that could lead to a security breach?

Accepted Answer

Software bug. A software bug is a technical threat source because it is an unintentional flaw in code that can be exploited to cause a security breach. For example, a buffer overflow bug in a network service can allow an attacker to execute arbitrary code, bypassing access controls. This directly aligns with the definition of a technical threat as an inherent weakness in hardware or software.

Answer

Disgruntled employee

Answer

Configuration weakness

Answer

Flood