SSCP Security Monitoring and Analysis Questions and Answers — Questions and Answers
Question 1: An intrusion detection system (IDS) flags a nightly database backup job as a potential data exfiltration attempt. A security analyst confirms the traffic is legitimate. This type of alert is BEST described as a:
- True negative
- False negative
- False positive (Correct answer)
- True positive
Correct answer: False positive
A false positive occurs when a security system incorrectly identifies benign activity as malicious. In this scenario, the legitimate backup job was flagged as an attack. The primary risk of too many false positives is 'alert fatigue,' where analysts may become desensitized and overlook a real threat.
Question 2: A security analyst is investigating a suspected SQL injection attack against a public-facing web server. Which of the following log sources is MOST likely to contain the specific malicious strings and commands used in the attack?
- Operating system security event logs
- Web server access logs (Correct answer)
- Firewall traffic logs
- Database audit logs
Correct answer: Web server access logs
Web server access logs record the incoming HTTP requests, including the full URL and any submitted form data. This is where the malicious SQL strings, such as 'OR 1=1', would be visible. Firewall logs would show the connection, but likely not the application-layer details, and database logs would show the executed query but not necessarily the raw, unfiltered input from the web request.
Question 3: Which of the following is a static Indicator of Compromise (IoC) that is commonly used in threat intelligence feeds to identify known malware files?
- A file's cryptographic hash (e.g., SHA-256) (Correct answer)
- The sequence of API calls made by a process
- An unusual pattern of outbound network traffic
- A user account logging in at an unusual time
Correct answer: A file's cryptographic hash (e.g., SHA-256)
A file's cryptographic hash is a unique and static identifier for that specific file. Threat intelligence platforms widely share file hashes of known malware so organizations can quickly scan their systems for these specific artifacts. The other options describe behaviors or anomalies, which are also valuable indicators but are not static identifiers of a specific file.
Question 4: A security team needs to perform a vulnerability scan on an internal application server to get the most comprehensive and accurate details about missing patches, insecure software versions, and configuration weaknesses. Which type of scan should they perform?
- Unauthenticated scan
- Passive scan
- Network port scan
- Authenticated scan (Correct answer)
Correct answer: Authenticated scan
An authenticated (or credentialed) scan uses valid user credentials to log in to the target system. This allows the scanner to inspect the system from the inside, providing a much more detailed and accurate view of installed software, patch levels, and service configurations than an unauthenticated scan, which only sees the system from an external perspective.
Question 5: An Intrusion Prevention System (IPS) is configured to identify and block threats by comparing network traffic against a large database of known malicious packet sequences and exploit payloads. What type of detection method is being used?
- Heuristic-based
- Behavior-based
- Signature-based (Correct answer)
- Anomaly-based
Correct answer: Signature-based
Signature-based detection works by comparing observed data (like network traffic) against a database of known patterns, or 'signatures,' of malicious activity. This method is very effective at stopping known threats. Anomaly, behavior, and heuristic methods focus on identifying deviations from a baseline of normal activity and are better suited for detecting new or unknown threats.
Question 6: While analyzing network flow logs, a security analyst notices an internal workstation sending a large volume of traffic to multiple external IP addresses over TCP port 53. Standard DNS queries typically use UDP port 53. This activity is a strong indicator of:
- A misconfigured NTP client
- A DNS zone transfer
- An internal port scanning attempt
- DNS tunneling for command and control (Correct answer)
Correct answer: DNS tunneling for command and control
DNS tunneling is a technique used by attackers to exfiltrate data or establish a command-and-control (C2) channel by encapsulating other protocols within DNS queries. Because DNS traffic (especially on port 53) is often allowed through firewalls with little inspection, attackers exploit it to bypass security controls. The use of TCP for many small queries to various destinations is highly anomalous and characteristic of this technique.
SSCP Security Monitoring and Analysis Questions and Answers
An intrusion detection system (IDS) flags a nightly database backup job as a potential data exfiltration attempt.
A security analyst confirms the traffic is legitimate.
This type of alert is BEST described as a: