SSCP Certification SSCP Security Monitoring and Analysis 5 — Questions and Answers
Question 1: Which SIEM feature allows automated responses to specific alert conditions, such as blocking an IP after repeated failed logins?
- Log normalization
- Security Orchestration, Automation, and Response (SOAR) integration (Correct answer)
- Data retention policies
- Threat modeling
Correct answer: Security Orchestration, Automation, and Response (SOAR) integration
SOAR integration enables automated playbooks that trigger responses (e.g., IP blocking, ticket creation) based on SIEM alert conditions without manual intervention.
Question 2: An analyst is reviewing DNS logs and notices repeated queries for randomly generated subdomains (e.g., xk3jq.evil.com). What attack technique does this suggest?
- DNS cache poisoning
- Domain Generation Algorithm (DGA) malware C2 (Correct answer)
- DNS amplification DDoS
- Zone transfer attack
Correct answer: Domain Generation Algorithm (DGA) malware C2
Malware using Domain Generation Algorithms (DGAs) generates pseudo-random domain names to contact C2 servers, evading static domain blacklists.
Question 3: Which approach to security monitoring focuses on proactively searching for hidden threats rather than waiting for automated alerts?
- Reactive monitoring
- Threat hunting (Correct answer)
- Vulnerability scanning
- Compliance auditing
Correct answer: Threat hunting
Threat hunting is the proactive, hypothesis-driven search for threats that have evaded automated detection tools, requiring skilled analysts to query data directly.
Question 4: A monitoring system flags an alert every time a user accesses a file server after hours. After investigating, the analyst confirms this is an authorized admin performing backups. What should be done?
- Disable all after-hours alerts
- Create a tuning exception for this specific authorized activity (Correct answer)
- Terminate the admin's access
- Escalate to incident response
Correct answer: Create a tuning exception for this specific authorized activity
Tuning exceptions for known authorized activity reduces false positives while preserving detection of truly anomalous after-hours access by unauthorized users.
Question 5: What is the primary difference between an Intrusion Detection System (IDS) and an Intrusion Prevention System (IPS)?
- IDS uses signatures; IPS uses anomaly detection
- IDS only detects and alerts; IPS can actively block malicious traffic (Correct answer)
- IDS is network-based; IPS is host-based
- IDS monitors encrypted traffic; IPS cannot
Correct answer: IDS only detects and alerts; IPS can actively block malicious traffic
An IDS passively monitors and generates alerts, while an IPS sits inline in the traffic path and can actively block or drop malicious packets in real time.
Question 6: Which log management practice ensures that logs cannot be tampered with after collection, preserving their evidentiary value?
- Log compression
- Write-once log storage with cryptographic hashing (Correct answer)
- Log rotation
- Log filtering
Correct answer: Write-once log storage with cryptographic hashing
Storing logs on write-once media and applying cryptographic hashes ensures integrity, making tampering detectable and preserving logs as admissible evidence.
Question 7: During a security review, analysts find that an employee's account logged in from New York at 8 AM and from Tokyo at 9 AM. This is an example of which type of indicator?
- Indicator of Exposure
- Impossible travel anomaly (Correct answer)
- Credential stuffing pattern
- Insider threat baseline
Correct answer: Impossible travel anomaly
Impossible travel detection flags logins from geographically distant locations within a timeframe that is physically impossible, suggesting credential compromise.
SSCP Certification SSCP Security Monitoring and Analysis 5
Which SIEM feature allows automated responses to specific alert conditions, such as blocking an IP after repeated failed logins?