SSCP Certification SSCP Security Operations 2 — Questions and Answers
Question 1: A security analyst notices repeated failed login attempts on a privileged account during off-hours. What is the MOST appropriate immediate action?
- Disable the account and notify the account owner (Correct answer)
- Document and continue monitoring for 24 hours
- Reset the password without notification
- Block the source IP and take no further action
Correct answer: Disable the account and notify the account owner
Disabling the account prevents potential compromise while notification initiates the incident response process.
Question 2: Which log type is MOST useful for detecting lateral movement within a network after an initial compromise?
- Application error logs
- Network flow logs (Correct answer)
- Web server access logs
- Database transaction logs
Correct answer: Network flow logs
Network flow logs record connections between internal hosts, making lateral movement visible as unusual internal traffic patterns.
Question 3: When implementing a change management process, which document authorizes a change to be made to a production system?
- Change request form
- Risk assessment report
- Change advisory board approval (Correct answer)
- Post-implementation review
Correct answer: Change advisory board approval
The Change Advisory Board (CAB) provides formal authorization after reviewing the request, risk, and rollback plan.
Question 4: An organization uses a Security Information and Event Management (SIEM) system. What is the PRIMARY purpose of correlation rules within a SIEM?
- Encrypt log data in transit
- Identify patterns across multiple events that indicate a security incident (Correct answer)
- Compress logs to reduce storage costs
- Authenticate users before log ingestion
Correct answer: Identify patterns across multiple events that indicate a security incident
Correlation rules link disparate events across sources to surface attack patterns that individual logs would not reveal alone.
Question 5: Which concept describes the practice of granting users only the permissions necessary to perform their job functions?
- Separation of duties
- Least privilege (Correct answer)
- Need to know
- Role-based access control
Correct answer: Least privilege
Least privilege limits access rights to the minimum required, reducing the attack surface if credentials are compromised.
Question 6: During a security incident, an analyst captures volatile memory from a compromised workstation. Why is this step prioritized before disk imaging?
- Memory is easier to acquire than disk images
- Volatile data including running processes and network connections is lost at shutdown (Correct answer)
- Memory data is admissible in court while disk data is not
- Disk imaging requires specialized hardware unavailable on-site
Correct answer: Volatile data including running processes and network connections is lost at shutdown
RAM contains transient data such as active processes, encryption keys, and open connections that disappear when power is removed.
Question 7: What is the purpose of a bastion host in network security operations?
- To serve as a decoy to attract and analyze attacker activity
- To provide a hardened single point of entry for administrative access to internal systems (Correct answer)
- To balance network traffic across multiple servers
- To store backup copies of critical security logs
Correct answer: To provide a hardened single point of entry for administrative access to internal systems
A bastion host is a hardened gateway that concentrates and controls administrative access, reducing the attack surface for internal management traffic.
SSCP Certification SSCP Security Operations 2
A security analyst notices repeated failed login attempts on a privileged account during off-hours.
What is the MOST appropriate immediate action?