SSCP Certification SSCP Security Monitoring and Analysis 2

Question 1

Which SIEM capability correlates events from multiple sources to identify attack patterns that individual log analysis would miss?

Accepted Answer

Event correlation

Answer

Event correlation aggregates and analyzes logs from disparate sources to detect multi-stage attack patterns invisible in any single log stream.

Question 2

A security analyst notices a baseline deviation where a server that typically generates 500 MB of outbound traffic per day suddenly generates 8 GB. What type of analysis detected this?

Accepted Answer

Anomaly-based detection

Answer

Anomaly-based detection establishes a behavioral baseline and alerts when activity deviates significantly from normal patterns.

Question 3

Which network monitoring technique captures full packet payloads and allows deep forensic reconstruction of sessions?

Accepted Answer

Full packet capture (PCAP)

Answer

Full packet capture (PCAP) records the complete content of network packets, enabling detailed forensic analysis and session reconstruction.

Question 4

When tuning a security monitoring system to reduce false positives, which risk does the analyst accept?

Accepted Answer

Higher likelihood of false negatives

Answer

Reducing false positives by raising alert thresholds risks missing real attacks (false negatives), creating a classic sensitivity-specificity tradeoff.

Question 5

Which protocol is most commonly used to forward log messages from network devices to a centralized log server?

Accepted Answer

Syslog (UDP 514)

Answer

Syslog over UDP port 514 is the de facto standard for forwarding log messages from routers, firewalls, and other devices to a central collector.

SSCP Certification Practice Test

SSCP Certification Practice Test

SSCP Certification SSCP Security Monitoring and Analysis 2