SSCP Certification SSCP Security Monitoring and Analysis 4 ā Questions and Answers
Question 1: Which type of analysis involves examining memory dumps, disk images, and network captures after an incident to reconstruct what occurred?
- Predictive analysis
- Forensic analysis (Correct answer)
- Real-time monitoring
- Behavioral profiling
Correct answer: Forensic analysis
Forensic analysis uses artifacts like memory dumps, disk images, and packet captures to reconstruct the sequence of events that occurred during an incident.
Question 2: An organization's IDS generates 200 alerts per day, of which 190 are false positives. What is the false positive rate?
- 5%
- 10%
- 90%
- 95% (Correct answer)
Correct answer: 95%
With 190 false positives out of 200 total alerts, the false positive rate is 190/200 = 95%, indicating the IDS needs significant tuning.
Question 3: Which network analysis tool provides flow-level visibility (IP, port, protocol, byte counts) without capturing full packet content?
- Wireshark
- NetFlow/IPFIX (Correct answer)
- Snort
- Zeek
Correct answer: NetFlow/IPFIX
NetFlow and IPFIX record flow metadataāsource/destination IPs, ports, protocol, and byte countsāwithout storing packet payloads, enabling scalable traffic analysis.
Question 4: What is the purpose of baselining in security monitoring?
- To define access control policies
- To establish normal behavior patterns for anomaly detection (Correct answer)
- To configure firewall rules
- To set patch management schedules
Correct answer: To establish normal behavior patterns for anomaly detection
Baselining documents normal system and network behavior so that deviationsāpotential indicators of compromiseācan be reliably identified.
Question 5: A SOC analyst receives an alert for a port scan against internal servers originating from a known internal vulnerability scanner. What should the analyst do?
- Immediately escalate as a critical incident
- Whitelist the scanner and close the alert as a false positive (Correct answer)
- Block the scanner's IP address
- Quarantine the scanned servers
Correct answer: Whitelist the scanner and close the alert as a false positive
Authorized internal vulnerability scanners are expected to generate port scan alerts; the analyst should whitelist the known scanner to reduce noise and close the alert.
Question 6: Which indicator type describes observable artifacts of a compromise, such as malicious IP addresses, file hashes, or domain names?
- Key Risk Indicators (KRIs)
- Indicators of Compromise (IOCs) (Correct answer)
- Key Performance Indicators (KPIs)
- Indicators of Exposure (IOEs)
Correct answer: Indicators of Compromise (IOCs)
Indicators of Compromise (IOCs) are specific forensic artifactsāIPs, hashes, domainsāthat indicate a system may have been compromised.
Question 7: What does the term 'dwell time' refer to in the context of security monitoring?
- Time taken to patch a vulnerability after disclosure
- Duration an attacker remains undetected within a network (Correct answer)
- Time required to recover systems after an incident
- Period between security audits
Correct answer: Duration an attacker remains undetected within a network
Dwell time measures how long an attacker operates within a network before being detected; minimizing dwell time is a primary goal of security monitoring programs.
SSCP Certification SSCP Security Monitoring and Analysis 4
Which type of analysis involves examining memory dumps, disk images, and network captures after an incident to reconstruct what occurred?