SSCP Security Monitoring and Analysis Questions and Answers

Question 1

An intrusion detection system (IDS) flags a nightly database backup job as a potential data exfiltration attempt.
A security analyst confirms the traffic is legitimate.
This type of alert is BEST described as a:

Accepted Answer

False positive

Answer

True negative

Answer

False negative

Answer

True positive

Question 2

A security analyst is investigating a suspected SQL injection attack against a public-facing web server. Which of the following log sources is MOST likely to contain the specific malicious strings and commands used in the attack?

Accepted Answer

Web server access logs

Answer

Operating system security event logs

Answer

Firewall traffic logs

Answer

Database audit logs

Question 3

Which of the following is a static Indicator of Compromise (IoC) that is commonly used in threat intelligence feeds to identify known malware files?

Accepted Answer

A file's cryptographic hash (e.g., SHA-256)

Answer

The sequence of API calls made by a process

Answer

An unusual pattern of outbound network traffic

Answer

A user account logging in at an unusual time

Question 4

A security team needs to perform a vulnerability scan on an internal application server to get the most comprehensive and accurate details about missing patches, insecure software versions, and configuration weaknesses. Which type of scan should they perform?

Accepted Answer

Authenticated scan

Answer

Unauthenticated scan

Answer

Passive scan

Answer

Network port scan

Question 5

An Intrusion Prevention System (IPS) is configured to identify and block threats by comparing network traffic against a large database of known malicious packet sequences and exploit payloads. What type of detection method is being used?

Accepted Answer

Signature-based

Answer

Heuristic-based

Answer

Behavior-based

Answer

Anomaly-based

Question 6

While analyzing network flow logs, a security analyst notices an internal workstation sending a large volume of traffic to multiple external IP addresses over TCP port 53. Standard DNS queries typically use UDP port 53. This activity is a strong indicator of:

Accepted Answer

DNS tunneling for command and control

Answer

A misconfigured NTP client

Answer

A DNS zone transfer

Answer

An internal port scanning attempt

An intrusion detection system (IDS) flags a nightly database backup job as a potential data exfiltration attempt.A security analyst confirms the traffic is legitimate.This type of alert is BEST described as a:

An intrusion detection system (IDS) flags a nightly database backup job as a potential data exfiltration attempt.
A security analyst confirms the traffic is legitimate.
This type of alert is BEST described as a: