SSCP Certification SSCP Security Monitoring and Analysis 2 — Questions and Answers
Question 1: Which SIEM capability correlates events from multiple sources to identify attack patterns that individual log analysis would miss?
- Log normalization
- Event correlation (Correct answer)
- Alert throttling
- Data archiving
Correct answer: Event correlation
Event correlation aggregates and analyzes logs from disparate sources to detect multi-stage attack patterns invisible in any single log stream.
Question 2: A security analyst notices a baseline deviation where a server that typically generates 500 MB of outbound traffic per day suddenly generates 8 GB. What type of analysis detected this?
- Signature-based detection
- Anomaly-based detection (Correct answer)
- Heuristic scanning
- Protocol analysis
Correct answer: Anomaly-based detection
Anomaly-based detection establishes a behavioral baseline and alerts when activity deviates significantly from normal patterns.
Question 3: Which network monitoring technique captures full packet payloads and allows deep forensic reconstruction of sessions?
- NetFlow analysis
- Full packet capture (PCAP) (Correct answer)
- SNMP polling
- Syslog collection
Correct answer: Full packet capture (PCAP)
Full packet capture (PCAP) records the complete content of network packets, enabling detailed forensic analysis and session reconstruction.
Question 4: When tuning a security monitoring system to reduce false positives, which risk does the analyst accept?
- Increased storage costs
- Higher likelihood of false negatives (Correct answer)
- Reduced log retention periods
- Slower query performance
Correct answer: Higher likelihood of false negatives
Reducing false positives by raising alert thresholds risks missing real attacks (false negatives), creating a classic sensitivity-specificity tradeoff.
Question 5: Which protocol is most commonly used to forward log messages from network devices to a centralized log server?
- SNMP
- Syslog (UDP 514) (Correct answer)
- NetFlow
- RADIUS
Correct answer: Syslog (UDP 514)
Syslog over UDP port 514 is the de facto standard for forwarding log messages from routers, firewalls, and other devices to a central collector.
Question 6: An IDS that monitors network traffic and compares it against known attack signatures is classified as which type?
- HIDS
- NBA
- Signature-based NIDS (Correct answer)
- Anomaly-based IDS
Correct answer: Signature-based NIDS
A signature-based Network Intrusion Detection System (NIDS) inspects network traffic and matches patterns against a database of known attack signatures.
Question 7: What is the primary purpose of a Security Operations Center (SOC) Tier 1 analyst role?
- Performing malware reverse engineering
- Triaging alerts and escalating confirmed incidents (Correct answer)
- Developing detection rules and use cases
- Conducting penetration tests
Correct answer: Triaging alerts and escalating confirmed incidents
Tier 1 SOC analysts perform initial alert triage, dismiss false positives, and escalate confirmed or suspected incidents to Tier 2 for deeper investigation.
SSCP Certification SSCP Security Monitoring and Analysis 2
Which SIEM capability correlates events from multiple sources to identify attack patterns that individual log analysis would miss?