SSCP Security Monitoring and Analysis Questions and Answers

Question 1

An intrusion detection system (IDS) flags a nightly database backup job as a potential data exfiltration attempt. A security analyst confirms the traffic is legitimate. This type of alert is BEST described as a:

Accepted Answer

False positive

Answer

A false positive occurs when a security system incorrectly identifies benign activity as malicious. In this scenario, the legitimate backup job was flagged as an attack. The primary risk of too many false positives is 'alert fatigue,' where analysts may become desensitized and overlook a real threat.

Question 2

A security analyst is investigating a suspected SQL injection attack against a public-facing web server. Which of the following log sources is MOST likely to contain the specific malicious strings and commands used in the attack?

Accepted Answer

Web server access logs

Answer

Web server access logs record the incoming HTTP requests, including the full URL and any submitted form data. This is where the malicious SQL strings, such as 'OR 1=1', would be visible. Firewall logs would show the connection, but likely not the application-layer details, and database logs would show the executed query but not necessarily the raw, unfiltered input from the web request.

Question 3

Which of the following is a static Indicator of Compromise (IoC) that is commonly used in threat intelligence feeds to identify known malware files?

Accepted Answer

A file's cryptographic hash (e.g., SHA-256)

Answer

A file's cryptographic hash is a unique and static identifier for that specific file. Threat intelligence platforms widely share file hashes of known malware so organizations can quickly scan their systems for these specific artifacts. The other options describe behaviors or anomalies, which are also valuable indicators but are not static identifiers of a specific file.

Question 4

A security team needs to perform a vulnerability scan on an internal application server to get the most comprehensive and accurate details about missing patches, insecure software versions, and configuration weaknesses. Which type of scan should they perform?

Accepted Answer

Authenticated scan

Answer

An authenticated (or credentialed) scan uses valid user credentials to log in to the target system. This allows the scanner to inspect the system from the inside, providing a much more detailed and accurate view of installed software, patch levels, and service configurations than an unauthenticated scan, which only sees the system from an external perspective.

Question 5

An Intrusion Prevention System (IPS) is configured to identify and block threats by comparing network traffic against a large database of known malicious packet sequences and exploit payloads. What type of detection method is being used?

Accepted Answer

Signature-based

Answer

Signature-based detection works by comparing observed data (like network traffic) against a database of known patterns, or 'signatures,' of malicious activity. This method is very effective at stopping known threats. Anomaly, behavior, and heuristic methods focus on identifying deviations from a baseline of normal activity and are better suited for detecting new or unknown threats.

SSCP Certification Practice Test

SSCP Certification Practice Test

SSCP Security Monitoring and Analysis Questions and Answers