SSCP Security Monitoring & Incident Detection 3 — Questions and Answers
Question 1: What is the role of a Security Information and Event Management (SIEM) correlation rule?
- To encrypt log data before storage
- To link related events across sources to identify attack patterns (Correct answer)
- To automatically patch vulnerable systems
- To compress logs for long-term archival
Correct answer: To link related events across sources to identify attack patterns
Correlation rules in a SIEM combine events from multiple sources to identify complex attack patterns that individual alerts would miss.
Question 2: Which type of analysis involves establishing a normal behavior baseline and alerting on deviations?
- Signature-based detection
- Anomaly-based detection (Correct answer)
- Heuristic-based scanning
- Static code analysis
Correct answer: Anomaly-based detection
Anomaly-based detection establishes baselines of normal activity and triggers alerts when behavior deviates significantly from that baseline.
Question 3: A SOC analyst receives an alert for a successful login from an account that normally works 9-to-5 but logged in at 2 AM. What type of indicator is this?
- Indicator of Compromise (IoC)
- Indicator of Attack (IoA)
- Behavioral anomaly indicator (Correct answer)
- Vulnerability indicator
Correct answer: Behavioral anomaly indicator
An unusual login time compared to established patterns is a behavioral anomaly indicator, suggesting potential account compromise or misuse.
Question 4: Which protocol is commonly used to forward logs from network devices to a centralized logging server?
- SNMP
- Syslog (Correct answer)
- RADIUS
- TACACS+
Correct answer: Syslog
Syslog is the standard protocol for forwarding log messages from network devices to a centralized log management system.
Question 5: What is 'alert fatigue' in the context of security monitoring?
- Physical exhaustion from long shifts in the SOC
- Analysts becoming desensitized to alerts due to high volumes of false positives (Correct answer)
- SIEM performance degradation from excessive rule processing
- Network bandwidth saturation caused by logging traffic
Correct answer: Analysts becoming desensitized to alerts due to high volumes of false positives
Alert fatigue occurs when analysts are overwhelmed by excessive alerts, many of them false positives, leading to missed real threats.
Question 6: Which artifact would BEST help an analyst determine if a Windows system has been compromised by a fileless malware attack?
- File system hash comparison
- Windows PowerShell script block logging and memory dumps (Correct answer)
- Antivirus scan of the C: drive
- Network packet captures of HTTP traffic
Correct answer: Windows PowerShell script block logging and memory dumps
Fileless malware operates in memory, so PowerShell script block logs and memory forensics are the most effective investigative artifacts.
Question 7: In security monitoring, what does 'threat hunting' differ from traditional monitoring?
- Threat hunting relies solely on automated SIEM alerts
- Threat hunting is a proactive search for threats not yet detected by automated tools (Correct answer)
- Threat hunting only applies to external network perimeters
- Threat hunting requires no prior hypothesis or IOC
Correct answer: Threat hunting is a proactive search for threats not yet detected by automated tools
Threat hunting is a proactive, human-led search for hidden threats that automated detection tools have not yet flagged.
SSCP Security Monitoring & Incident Detection 3
What is the role of a Security Information and Event Management (SIEM) correlation rule?