SSCP Certification SSCP Security Monitoring and Analysis 4

Question 1

Which type of analysis involves examining memory dumps, disk images, and network captures after an incident to reconstruct what occurred?

Accepted Answer

Forensic analysis

Answer

Forensic analysis uses artifacts like memory dumps, disk images, and packet captures to reconstruct the sequence of events that occurred during an incident.

Question 2

An organization's IDS generates 200 alerts per day, of which 190 are false positives. What is the false positive rate?

Accepted Answer

95%

Answer

With 190 false positives out of 200 total alerts, the false positive rate is 190/200 = 95%, indicating the IDS needs significant tuning.

Question 3

Which network analysis tool provides flow-level visibility (IP, port, protocol, byte counts) without capturing full packet content?

Accepted Answer

NetFlow/IPFIX

Answer

NetFlow and IPFIX record flow metadata—source/destination IPs, ports, protocol, and byte counts—without storing packet payloads, enabling scalable traffic analysis.

Question 4

What is the purpose of baselining in security monitoring?

Accepted Answer

To establish normal behavior patterns for anomaly detection

Answer

Baselining documents normal system and network behavior so that deviations—potential indicators of compromise—can be reliably identified.

Question 5

A SOC analyst receives an alert for a port scan against internal servers originating from a known internal vulnerability scanner. What should the analyst do?

Accepted Answer

Whitelist the scanner and close the alert as a false positive

Answer

Authorized internal vulnerability scanners are expected to generate port scan alerts; the analyst should whitelist the known scanner to reduce noise and close the alert.

SSCP Certification Practice Test

SSCP Certification Practice Test

SSCP Certification SSCP Security Monitoring and Analysis 4