SSCP Certification SSCP Security Monitoring and Analysis 3 — Questions and Answers
Question 1: Which log source would be most valuable when investigating a suspected privilege escalation on a Windows domain controller?
- Web server access logs
- Windows Security Event Logs (Correct answer)
- Network flow records
- DNS query logs
Correct answer: Windows Security Event Logs
Windows Security Event Logs record authentication events, account management changes, and privilege use, making them essential for privilege escalation investigations.
Question 2: A threat actor uses encrypted HTTPS traffic to exfiltrate data. Which monitoring technique can still detect this activity without decrypting the traffic?
- Deep packet inspection of payload
- TLS certificate and metadata analysis (Correct answer)
- Signature-based payload matching
- Application layer filtering
Correct answer: TLS certificate and metadata analysis
TLS metadata analysis examines certificate details, session duration, data volume, and connection patterns to detect anomalous behavior without decrypting content.
Question 3: Which metric measures the average time elapsed between a security event occurring and its detection by the security team?
- Mean Time to Repair (MTTR)
- Mean Time to Detect (MTTD) (Correct answer)
- Recovery Point Objective (RPO)
- Recovery Time Objective (RTO)
Correct answer: Mean Time to Detect (MTTD)
Mean Time to Detect (MTTD) measures how long it takes from when a security event occurs until it is identified, and reducing it is a key SOC performance goal.
Question 4: What does a host-based IDS (HIDS) monitor that a network-based IDS (NIDS) cannot?
- Network packet headers
- Internal system calls and file integrity (Correct answer)
- Router configuration changes
- Inter-VLAN traffic
Correct answer: Internal system calls and file integrity
HIDS operates on individual endpoints and can monitor system calls, file changes, registry modifications, and local log events that network traffic analysis cannot observe.
Question 5: During log analysis, an analyst discovers thousands of failed SSH login attempts from a single IP followed by one successful login. This pattern most likely indicates what?
- A misconfigured SSH daemon
- A successful brute-force attack (Correct answer)
- Normal administrative activity
- A network scanning event
Correct answer: A successful brute-force attack
Many failures followed by a success is the classic signature of a brute-force attack where the attacker exhausted credentials until finding the correct one.
Question 6: Which concept describes organizing detected threats by tactics, techniques, and procedures to understand attacker behavior?
- Kill chain mapping
- MITRE ATT&CK framework alignment (Correct answer)
- CVE categorization
- Risk scoring
Correct answer: MITRE ATT&CK framework alignment
The MITRE ATT&CK framework organizes adversary behavior into tactics (goals) and techniques (methods), helping analysts understand and detect attacker TTPs.
Question 7: What is the main advantage of using threat intelligence feeds in a SIEM?
- They replace the need for human analysts
- They enrich alerts with context about known malicious indicators (Correct answer)
- They eliminate false positives completely
- They automate vulnerability patching
Correct answer: They enrich alerts with context about known malicious indicators
Threat intelligence feeds provide IOCs (IP addresses, domains, hashes) and context that enrich SIEM alerts, helping analysts prioritize and investigate faster.
SSCP Certification SSCP Security Monitoring and Analysis 3
Which log source would be most valuable when investigating a suspected privilege escalation on a Windows domain controller?