SSCP Certification SSCP Security Operations 2

Question 1

A security analyst notices repeated failed login attempts on a privileged account during off-hours. What is the MOST appropriate immediate action?

Accepted Answer

Disable the account and notify the account owner

Answer

Disabling the account prevents potential compromise while notification initiates the incident response process.

Question 2

Which log type is MOST useful for detecting lateral movement within a network after an initial compromise?

Accepted Answer

Network flow logs

Answer

Network flow logs record connections between internal hosts, making lateral movement visible as unusual internal traffic patterns.

Question 3

When implementing a change management process, which document authorizes a change to be made to a production system?

Accepted Answer

Change advisory board approval

Answer

The Change Advisory Board (CAB) provides formal authorization after reviewing the request, risk, and rollback plan.

Question 4

An organization uses a Security Information and Event Management (SIEM) system. What is the PRIMARY purpose of correlation rules within a SIEM?

Accepted Answer

Identify patterns across multiple events that indicate a security incident

Answer

Correlation rules link disparate events across sources to surface attack patterns that individual logs would not reveal alone.

Question 5

Which concept describes the practice of granting users only the permissions necessary to perform their job functions?

Accepted Answer

Least privilege

Answer

Least privilege limits access rights to the minimum required, reducing the attack surface if credentials are compromised.

SSCP Certification Practice Test