SSCP Certification SSCP Security Monitoring and Analysis 5

Question 1

Which SIEM feature allows automated responses to specific alert conditions, such as blocking an IP after repeated failed logins?

Accepted Answer

Security Orchestration, Automation, and Response (SOAR) integration

Answer

SOAR integration enables automated playbooks that trigger responses (e.g., IP blocking, ticket creation) based on SIEM alert conditions without manual intervention.

Question 2

An analyst is reviewing DNS logs and notices repeated queries for randomly generated subdomains (e.g., xk3jq.evil.com). What attack technique does this suggest?

Accepted Answer

Domain Generation Algorithm (DGA) malware C2

Answer

Malware using Domain Generation Algorithms (DGAs) generates pseudo-random domain names to contact C2 servers, evading static domain blacklists.

Question 3

Which approach to security monitoring focuses on proactively searching for hidden threats rather than waiting for automated alerts?

Accepted Answer

Threat hunting

Answer

Threat hunting is the proactive, hypothesis-driven search for threats that have evaded automated detection tools, requiring skilled analysts to query data directly.

Question 4

A monitoring system flags an alert every time a user accesses a file server after hours. After investigating, the analyst confirms this is an authorized admin performing backups. What should be done?

Accepted Answer

Create a tuning exception for this specific authorized activity

Answer

Tuning exceptions for known authorized activity reduces false positives while preserving detection of truly anomalous after-hours access by unauthorized users.

Question 5

What is the primary difference between an Intrusion Detection System (IDS) and an Intrusion Prevention System (IPS)?

Accepted Answer

IDS only detects and alerts; IPS can actively block malicious traffic

Answer

An IDS passively monitors and generates alerts, while an IPS sits inline in the traffic path and can actively block or drop malicious packets in real time.

SSCP Certification Practice Test

SSCP Certification Practice Test

SSCP Certification SSCP Security Monitoring and Analysis 5