SSCP Certification SSCP Security Monitoring and Analysis 2

Question 1

Which SIEM capability correlates events from multiple sources to identify attack patterns that individual log analysis would miss?

Accepted Answer

Event correlation

Answer

Log normalization

Answer

Alert throttling

Answer

Data archiving

Question 2

A security analyst notices a baseline deviation where a server that typically generates 500 MB of outbound traffic per day suddenly generates 8 GB. What type of analysis detected this?

Accepted Answer

Anomaly-based detection

Answer

Signature-based detection

Answer

Heuristic scanning

Answer

Protocol analysis

Question 3

Which network monitoring technique captures full packet payloads and allows deep forensic reconstruction of sessions?

Accepted Answer

Full packet capture (PCAP)

Answer

NetFlow analysis

Answer

SNMP polling

Answer

Syslog collection

Question 4

When tuning a security monitoring system to reduce false positives, which risk does the analyst accept?

Accepted Answer

Higher likelihood of false negatives

Answer

Increased storage costs

Answer

Reduced log retention periods

Answer

Slower query performance

Question 5

Which protocol is most commonly used to forward log messages from network devices to a centralized log server?

Accepted Answer

Syslog (UDP 514)

Answer

SNMP

Answer

NetFlow

Answer

RADIUS

Question 6

An IDS that monitors network traffic and compares it against known attack signatures is classified as which type?

Accepted Answer

Signature-based NIDS

Answer

HIDS

Answer

NBA

Answer

Anomaly-based IDS

Question 7

What is the primary purpose of a Security Operations Center (SOC) Tier 1 analyst role?

Accepted Answer

Triaging alerts and escalating confirmed incidents

Answer

Performing malware reverse engineering

Answer

Developing detection rules and use cases

Answer

Conducting penetration tests