SSCP Security Monitoring & Incident Detection 2

Question 1

Which metric is most useful for measuring the effectiveness of a security monitoring program?

Accepted Answer

Mean Time to Detect (MTTD)

Answer

MTTD measures how quickly threats are identified, directly reflecting the effectiveness of detection capabilities.

Question 2

What is the primary purpose of a honeypot in security monitoring?

Accepted Answer

To attract and study attacker behavior

Answer

Honeypots are decoy systems designed to lure attackers and gather intelligence on their tactics and techniques.

Question 3

An analyst notices that a server is making DNS requests to randomly generated domain names at regular intervals. This behavior most likely indicates:

Accepted Answer

Domain Generation Algorithm (DGA) malware

Answer

DGA malware generates random domain names to communicate with command-and-control servers, evading static blocklists.

Question 4

Which log source is most critical for detecting lateral movement within a Windows environment?

Accepted Answer

Windows Security Event logs (Event ID 4624/4625)

Answer

Windows Security Event logs record logon successes and failures (4624/4625), enabling detection of credential-based lateral movement.

Question 5

What distinguishes a true positive from a false positive in IDS alerting?

Accepted Answer

A true positive correctly identifies malicious activity; a false positive flags benign activity as malicious

Answer

A true positive is a correctly identified threat, while a false positive is a benign event incorrectly flagged as malicious.

(SSCP) Security Operations and Administration Practice Test