SSCP Certification SSCP Security Operations 2

Question 1

A security analyst notices repeated failed login attempts on a privileged account during off-hours. What is the MOST appropriate immediate action?

Accepted Answer

Disable the account and notify the account owner

Answer

Document and continue monitoring for 24 hours

Answer

Reset the password without notification

Answer

Block the source IP and take no further action

Question 2

Which log type is MOST useful for detecting lateral movement within a network after an initial compromise?

Accepted Answer

Network flow logs

Answer

Application error logs

Answer

Web server access logs

Answer

Database transaction logs

Question 3

When implementing a change management process, which document authorizes a change to be made to a production system?

Accepted Answer

Change advisory board approval

Answer

Change request form

Answer

Risk assessment report

Answer

Post-implementation review

Question 4

An organization uses a Security Information and Event Management (SIEM) system. What is the PRIMARY purpose of correlation rules within a SIEM?

Accepted Answer

Identify patterns across multiple events that indicate a security incident

Answer

Encrypt log data in transit

Answer

Compress logs to reduce storage costs

Answer

Authenticate users before log ingestion

Question 5

Which concept describes the practice of granting users only the permissions necessary to perform their job functions?

Accepted Answer

Least privilege

Answer

Separation of duties

Answer

Need to know

Answer

Role-based access control

Question 6

During a security incident, an analyst captures volatile memory from a compromised workstation. Why is this step prioritized before disk imaging?

Accepted Answer

Volatile data including running processes and network connections is lost at shutdown

Answer

Memory is easier to acquire than disk images

Answer

Memory data is admissible in court while disk data is not

Answer

Disk imaging requires specialized hardware unavailable on-site

Question 7

What is the purpose of a bastion host in network security operations?

Accepted Answer

To provide a hardened single point of entry for administrative access to internal systems

Answer

To serve as a decoy to attract and analyze attacker activity

Answer

To balance network traffic across multiple servers

Answer

To store backup copies of critical security logs