SSCP · topic practice

Risk Identification, Monitoring, and Analysis practice questions

Q: How should I use these Risk Identification, Monitoring, and Analysis practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Q: Can I practise just Risk Identification, Monitoring, and Analysis questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Risk Identification, Monitoring, and Analysis domain.

Practise Systems Security Certified Practitioner SSCP Risk Identification, Monitoring, and Analysis practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Risk Identification, Monitoring, and Analysis

Practice 10 questions Browse domain →

What the exam tests

What to know about Risk Identification, Monitoring, and Analysis

Risk Identification, Monitoring, and Analysis questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Risk Identification, Monitoring, and Analysis exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Risk Identification, Monitoring, and Analysis questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Risk Identification, Monitoring, and Analysis explanation →

A security analyst is reviewing logs and notices multiple failed login attempts for a user account, followed by a successful login from an unfamiliar IP address at 3:00 AM. Which type of risk is most directly indicated by this scenario?

Trap 1: Environmental risk

Environmental risk involves natural disasters like floods or fire.

Trap 2: Human accidental risk

Accidental risk involves unintentional errors, not deliberate attacks.

Trap 3: Technical risk

Technical risk includes hardware failure or software bugs.

Study all Risk Identification, Monitoring, and Analysis common traps →

A
Environmental risk
Why wrong: Environmental risk involves natural disasters like floods or fire.
B
Human intentional risk
Failed logins followed by after-hours access indicate intentional malicious behavior.
C
Human accidental risk
Why wrong: Accidental risk involves unintentional errors, not deliberate attacks.
D
Technical risk
Why wrong: Technical risk includes hardware failure or software bugs.

Risk Identification, Monitoring, and Analysis practice questions

What to know about Risk Identification, Monitoring, and Analysis

Common Risk Identification, Monitoring, and Analysis exam traps

Risk Identification, Monitoring, and Analysis questions

A security analyst is reviewing logs and notices multiple failed login attempts for a user account, followed by a successful login from an unfamiliar IP address at 3:00 AM. Which type of risk is most directly indicated by this scenario?

In a qualitative risk analysis, a risk is assigned a probability of 'High' and an impact of 'Medium'. According to common probability/impact matrices, what is the overall risk rating?

An organization calculates the SLE for a server as $5,000 and the ARO as 0.2. What is the ALE?

Which type of IDS uses a baseline of normal behavior to detect anomalies?

A security team implements a SIEM solution to collect logs from firewalls, servers, and workstations. They create a correlation rule that triggers an alert when a single user logs in from more than three different geographic locations within one hour. This is an example of which detection method?

An organization uses User Behavior Analytics (UBA) to detect insider threats. Which of the following activities would most likely trigger an alert for a compromised account?

A vulnerability management program requires that critical vulnerabilities be remediated within 72 hours. A scanner identifies a critical vulnerability on a server, but after patching, the scanner still reports it as vulnerable. What is the most likely cause?

Which of the following is a vulnerability source explicitly based on publicly known flaws?

A company stores log files on a dedicated log server. To ensure log integrity, they implement a solution where logs are written to a WORM (Write Once, Read Many) device. Which property does this primarily protect?

After a security incident, the incident response team needs to analyze logs from multiple sources to reconstruct the timeline. The SIEM retains logs for 90 days, but the incident occurred 120 days ago. Which action should the organization have taken to ensure log availability?

An organization decides to implement CIS Benchmarks on all Windows servers. They choose Level 1 settings. What does Level 1 represent?

A security analyst is reviewing SIEM alerts and wants to identify potential data exfiltration. Which TWO of the following indicators are most relevant?

An organization is implementing a new vulnerability management program. The CISO wants to establish remediation SLAs based on risk severity. Which THREE of the following are commonly recommended SLAs?

A security manager is evaluating log sources for a SIEM implementation. Which THREE of the following are considered log types that should be included?

A security analyst is reviewing logs and notices multiple failed login attempts from a single IP address against an administrative account. The SIEM has not generated an alert. Which configuration change would best detect this scenario?

During a qualitative risk analysis, an organization rates the likelihood of a flood as 'Low' and the impact as 'High'. Using a standard 3x3 risk matrix, what is the overall risk rating?

An organization is calculating the Annualized Loss Expectancy (ALE) for a server. The Asset Value (AV) is $50,000, the Exposure Factor (EF) is 40%, and the Annualized Rate of Occurrence (ARO) is 0.5. What is the Single Loss Expectancy (SLE) and ALE?

A company has implemented a new vulnerability scanner and the first scan reports 200 vulnerabilities. The security team needs to prioritize remediation. Which approach should they use first?

Which of the following is a technical threat source that could lead to a security breach?

Track your progress over time

Start a Risk Identification, Monitoring, and Analysis only practice session

Related SSCP topic practice pages

Access Controls practice questions

Risk Identification, Monitoring, and Analysis practice questions

Incident Response and Recovery practice questions

Security Operations and Administration practice questions

Cryptography practice questions

Network and Communications Security practice questions

Systems and Application Security practice questions

Risk Identification, Monitoring and Analysis practice questions

SSCP fundamentals practice questions

SSCP scenario practice questions

SSCP troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid