SSCP Certification SSCP Security Monitoring and Analysis 3

Question 1

Which log source would be most valuable when investigating a suspected privilege escalation on a Windows domain controller?

Accepted Answer

Windows Security Event Logs

Answer

Windows Security Event Logs record authentication events, account management changes, and privilege use, making them essential for privilege escalation investigations.

Question 2

A threat actor uses encrypted HTTPS traffic to exfiltrate data. Which monitoring technique can still detect this activity without decrypting the traffic?

Accepted Answer

TLS certificate and metadata analysis

Answer

TLS metadata analysis examines certificate details, session duration, data volume, and connection patterns to detect anomalous behavior without decrypting content.

Question 3

Which metric measures the average time elapsed between a security event occurring and its detection by the security team?

Accepted Answer

Mean Time to Detect (MTTD)

Answer

Mean Time to Detect (MTTD) measures how long it takes from when a security event occurs until it is identified, and reducing it is a key SOC performance goal.

Question 4

What does a host-based IDS (HIDS) monitor that a network-based IDS (NIDS) cannot?

Accepted Answer

Internal system calls and file integrity

Answer

HIDS operates on individual endpoints and can monitor system calls, file changes, registry modifications, and local log events that network traffic analysis cannot observe.

Question 5

During log analysis, an analyst discovers thousands of failed SSH login attempts from a single IP followed by one successful login. This pattern most likely indicates what?

Accepted Answer

A successful brute-force attack

Answer

Many failures followed by a success is the classic signature of a brute-force attack where the attacker exhausted credentials until finding the correct one.

SSCP Certification Practice Test

SSCP Certification Practice Test

SSCP Certification SSCP Security Monitoring and Analysis 3