Mixed Deck — All SSCP Topics Flashcards

When Security Operations and Administration assessment results are inconclusive, the BEST practice is to:

Answer: Conduct additional assessment using alternative methods

Alternative methods help triangulate and clarify findings.

Which document outlines the process for responding to security incidents?

Answer: Incident response plan

An incident response plan is a critical document that details the systematic process an organization will follow when a security incident occurs. It outlines steps for detection, analysis, containment, eradication, recovery, and post-incident review. Having a well-defined plan ensures a coordinated, efficient, and effective response, minimizing damage, recovery time, and overall impact on the organization.

What is the MOST effective way for new SSCP professionals to build competency?

Answer: Combine formal education, mentored practice, and ongoing development

Multiple complementary approaches build comprehensive competency.

In the context of patch management, what does 'patch prioritization' primarily consider?

Answer: The severity of the vulnerability and asset criticality

Patch prioritization weighs the CVSS severity score of the vulnerability against the criticality of the affected asset to determine remediation order.

What distinguishes a Security Operations and Administration certified professional from non-certified practitioners?

Answer: Validated competency through standardized assessment

Certification provides objective validation through standardized assessment.

What is the MOST effective way for new SSCP professionals to build competency?

Answer: Combine formal education, mentored practice, and ongoing development

Multiple complementary approaches build comprehensive competency.

Which foundational principle is MOST important for Security Operations and Administration success?

Answer: Continuous learning, ethical practice, and quality outcomes

Success requires learning, ethics, and quality focus.

Which ISO 27001 document establishes the scope, objectives, and policies of an organization's information security management system?

Answer: Information Security Policy

The Information Security Policy sets top-level direction and commitment from management for the ISMS, defining scope and objectives.

Under SOX Section 404, management and external auditors must report on the effectiveness of:

Answer: Internal controls over financial reporting

SOX Section 404 requires management to assess and report on internal controls over financial reporting (ICFR), with external auditor attestation.

Which configuration management practice ensures that all changes to production systems are reviewed and approved before implementation?

Answer: Change control process

A change control process requires formal review and approval of system changes, reducing the risk of unauthorized or poorly planned modifications to production environments.

During an ISO 27001 surveillance audit, the auditor identifies a control that was previously certified but is now missing evidence of operation. This would MOST likely result in:

Answer: A major nonconformity requiring corrective action within a defined timeframe

A control that existed but lacks operational evidence is a major nonconformity that requires documented corrective action within a specified period.

Which NIST SP 800-53 control family addresses audit and accountability?

Answer: AU — Audit and Accountability

The AU (Audit and Accountability) control family in NIST SP 800-53 covers audit event logging, log content, audit review, and protection of audit information.

Why is log analysis important for incident detection?

Answer: They assist in identifying suspicious activity

Log analysis is critical for incident detection because logs record chronological events and activities across systems, applications, and networks. By reviewing these records, security analysts can identify unusual patterns, unauthorized access attempts, system errors, or other indicators of compromise. This forensic evidence helps in understanding the scope of an incident and formulating an effective response, making it a cornerstone of security operations.

An organization receives an audit finding that its change management process lacks formal rollback procedures. This finding is BEST addressed by:

Answer: Updating change management policy and procedures to include rollback steps and testing

The finding identifies a process gap; the correct remediation is to update procedures to include rollback planning and test those procedures.

What is a 'sandbox' in the context of application security?

Answer: An isolated execution environment that restricts what a program can access or do

A sandbox confines an application to a restricted environment, limiting its access to system resources and preventing it from affecting other processes.

Which type of alert indicates a true security incident?

Answer: True positive

In security monitoring, a true positive alert accurately indicates that a genuine security incident or threat has occurred. This means the detection system correctly identified a malicious activity that warrants immediate investigation and response. Recognizing true positives is crucial for prioritizing alerts and effectively allocating resources to address real security risks, preventing potential damage.

What is the purpose of a Web Application Firewall (WAF)?

Answer: To filter and monitor HTTP traffic to protect web applications from attacks

A WAF inspects HTTP/HTTPS traffic between a web application and the internet, blocking common attacks like SQL injection and XSS.

What is the function of anomaly-based detection?

Answer: It identifies unusual behavior

Anomaly-based detection systems establish a baseline of normal system or network behavior over time. They then continuously monitor for any deviations from this established baseline, flagging unusual activities as potential threats. This method is particularly effective at detecting novel or zero-day attacks that signature-based systems, which rely on known patterns, might otherwise miss.

Which tool is commonly used for network intrusion detection?

Answer: Snort

Snort is a widely recognized open-source network intrusion detection system (NIDS) that performs real-time traffic analysis and packet logging. It detects various attacks, such as buffer overflows and stealth port scans, by comparing network traffic against a defined set of rules. While firewalls and antivirus tools serve different security functions, Snort specifically excels at identifying and alerting on network intrusions.

Which term describes the process where an organization independently verifies that its own controls are operating as intended before an external audit?

Answer: Internal audit / self-assessment

Internal audits or self-assessments allow organizations to proactively identify gaps and remediate them before external auditors review the same controls.