SSCP Security Monitoring & Incident Detection 3

Question 1

What is the role of a Security Information and Event Management (SIEM) correlation rule?

Accepted Answer

To link related events across sources to identify attack patterns

Answer

Correlation rules in a SIEM combine events from multiple sources to identify complex attack patterns that individual alerts would miss.

Question 2

Which type of analysis involves establishing a normal behavior baseline and alerting on deviations?

Accepted Answer

Anomaly-based detection

Answer

Anomaly-based detection establishes baselines of normal activity and triggers alerts when behavior deviates significantly from that baseline.

Question 3

A SOC analyst receives an alert for a successful login from an account that normally works 9-to-5 but logged in at 2 AM. What type of indicator is this?

Accepted Answer

Behavioral anomaly indicator

Answer

An unusual login time compared to established patterns is a behavioral anomaly indicator, suggesting potential account compromise or misuse.

Question 4

Which protocol is commonly used to forward logs from network devices to a centralized logging server?

Accepted Answer

Syslog

Answer

Syslog is the standard protocol for forwarding log messages from network devices to a centralized log management system.

Question 5

What is 'alert fatigue' in the context of security monitoring?

Accepted Answer

Analysts becoming desensitized to alerts due to high volumes of false positives

Answer

Alert fatigue occurs when analysts are overwhelmed by excessive alerts, many of them false positives, leading to missed real threats.

(SSCP) Security Operations and Administration Practice Test

(SSCP) Security Operations and Administration Practice Test

SSCP Security Monitoring & Incident Detection 3