SSCP Security Operations Questions and Answers

Question 1

A security analyst is reviewing firewall logs and notices a large number of outbound connection attempts from an internal server to various suspicious IP addresses.
This activity is unusual for this server.
Which type of security control was primarily responsible for logging this activity?

Accepted Answer

Detective

Answer

Preventive

Answer

Corrective

Answer

Deterrent

Question 2

During which phase of the incident response lifecycle would an analyst perform root cause analysis to understand how an attacker gained unauthorized access?

Accepted Answer

Post-Incident Activity (Lessons Learned)

Answer

Preparation

Answer

Containment

Answer

Eradication

Question 3

An organization is implementing a new patch management process. Which of the following is the MOST critical first step before deploying a new security patch to all production systems?

Accepted Answer

Deploy the patch to a small group of test systems.

Answer

Notify all end-users of the impending update.

Answer

Update the asset inventory to reflect the new patch version.

Answer

Create a backout plan in case the patch causes issues.

Question 4

A system administrator needs to grant a new marketing employee access to a shared folder containing campaign materials. To adhere to security best practices, which access control principle should be applied?

Accepted Answer

Least privilege

Answer

Open access

Answer

Separation of duties

Answer

Job rotation

Question 5

Which of the following activities is a key part of an organization's change management process?

Accepted Answer

Performing a security impact analysis for proposed changes.

Answer

Conducting daily backups.

Answer

Responding to a newly discovered security incident.

Answer

Onboarding a new employee and provisioning accounts.

Question 6

A security operations center (SOC) analyst is tasked with continuously monitoring the organization's network for threats. Which tool would be most effective for aggregating log data from various sources and identifying potential security events through correlation?

Accepted Answer

Security Information and Event Management (SIEM)

Answer

Network vulnerability scanner

Answer

Host-based Intrusion Detection System (HIDS)

Answer

Data Loss Prevention (DLP) system

A security analyst is reviewing firewall logs and notices a large number of outbound connection attempts from an internal server to various suspicious IP addresses.This activity is unusual for this server.Which type of security control was primarily responsible for logging this activity?

A security analyst is reviewing firewall logs and notices a large number of outbound connection attempts from an internal server to various suspicious IP addresses.
This activity is unusual for this server.
Which type of security control was primarily responsible for logging this activity?