SSCP Certification SSCP Security Operations 4

Question 1

When classifying a security incident, which factor PRIMARILY determines the severity level assigned?

Accepted Answer

The potential business impact and scope of systems affected

Answer

Incident severity is driven by the actual or potential impact to business operations, data, and affected system scope.

Question 2

A security team is implementing network segmentation. Which benefit does this provide during an incident?

Accepted Answer

It limits the blast radius of a compromise by containing lateral movement

Answer

Segmentation creates boundaries that restrict an attacker's ability to move freely between systems after gaining initial access.

Question 3

Which of the following BEST describes the role of a Security Operations Center (SOC) Tier 1 analyst?

Accepted Answer

Monitoring alerts, triaging events, and escalating confirmed incidents

Answer

Tier 1 analysts are responsible for initial alert triage, distinguishing true positives from false positives, and escalating as needed.

Question 4

What is the purpose of a lessons learned meeting after a security incident is resolved?

Accepted Answer

To document findings and improve processes to prevent recurrence

Answer

Lessons learned meetings capture what worked and what failed so processes, controls, and training can be improved before the next incident.

Question 5

An analyst is implementing patch management for a fleet of servers. Which priority order is MOST appropriate?

Accepted Answer

Critical vulnerabilities with known exploits first, then high, medium, and low

Answer

Prioritizing by exploitability and severity ensures the highest-risk vulnerabilities are addressed before attackers can leverage them.

SSCP Certification Practice Test