SSCP Security Monitoring & Incident Detection 2 — Questions and Answers
Question 1: Which metric is most useful for measuring the effectiveness of a security monitoring program?
- Mean Time to Detect (MTTD) (Correct answer)
- Number of firewalls deployed
- Total bandwidth consumed by logs
- Number of security analysts on staff
Correct answer: Mean Time to Detect (MTTD)
MTTD measures how quickly threats are identified, directly reflecting the effectiveness of detection capabilities.
Question 2: What is the primary purpose of a honeypot in security monitoring?
- To speed up legitimate network traffic
- To attract and study attacker behavior (Correct answer)
- To encrypt sensitive data at rest
- To balance load across web servers
Correct answer: To attract and study attacker behavior
Honeypots are decoy systems designed to lure attackers and gather intelligence on their tactics and techniques.
Question 3: An analyst notices that a server is making DNS requests to randomly generated domain names at regular intervals. This behavior most likely indicates:
- Normal software update activity
- Domain Generation Algorithm (DGA) malware (Correct answer)
- A misconfigured DNS resolver
- IPv6 transition tunneling
Correct answer: Domain Generation Algorithm (DGA) malware
DGA malware generates random domain names to communicate with command-and-control servers, evading static blocklists.
Question 4: Which log source is most critical for detecting lateral movement within a Windows environment?
- Web server access logs
- Windows Security Event logs (Event ID 4624/4625) (Correct answer)
- DHCP lease logs
- Firewall egress logs
Correct answer: Windows Security Event logs (Event ID 4624/4625)
Windows Security Event logs record logon successes and failures (4624/4625), enabling detection of credential-based lateral movement.
Question 5: What distinguishes a true positive from a false positive in IDS alerting?
- True positives are generated by signature-based rules only
- A true positive correctly identifies malicious activity; a false positive flags benign activity as malicious (Correct answer)
- False positives occur only in anomaly-based detection
- True positives require manual analyst confirmation before being logged
Correct answer: A true positive correctly identifies malicious activity; a false positive flags benign activity as malicious
A true positive is a correctly identified threat, while a false positive is a benign event incorrectly flagged as malicious.
Question 6: Which technique allows attackers to hide malicious traffic within legitimate HTTPS sessions, making monitoring harder?
- ARP spoofing
- SSL/TLS encryption tunneling (Correct answer)
- VLAN hopping
- MAC flooding
Correct answer: SSL/TLS encryption tunneling
Attackers use SSL/TLS encryption to conceal malicious payloads within legitimate HTTPS traffic, bypassing content inspection.
Question 7: When implementing a security monitoring strategy, what does 'defense in depth' mean for logging?
- Storing all logs on a single hardened server
- Collecting logs from multiple layers including network, host, and application (Correct answer)
- Encrypting logs with multiple algorithms
- Requiring dual analyst approval for log deletion
Correct answer: Collecting logs from multiple layers including network, host, and application
Defense in depth in logging means collecting telemetry from network, host, and application layers to ensure comprehensive visibility.
SSCP Security Monitoring & Incident Detection 2
Which metric is most useful for measuring the effectiveness of a security monitoring program?