SSCP Security Monitoring & Incident Detection 4 — Questions and Answers
Question 1: Which NetFlow data field is MOST useful for detecting data exfiltration over an extended period?
- Source port number
- Total bytes transferred per session (Correct answer)
- TTL value of packets
- VLAN tag identifier
Correct answer: Total bytes transferred per session
Tracking total bytes transferred per session or over time helps identify unusually large outbound data transfers indicative of exfiltration.
Question 2: What is the primary goal of log normalization in a SIEM?
- Reducing log storage requirements through compression
- Converting logs from disparate sources into a common format for analysis (Correct answer)
- Encrypting logs to meet compliance requirements
- Filtering out low-severity events automatically
Correct answer: Converting logs from disparate sources into a common format for analysis
Log normalization standardizes log formats from different sources, enabling consistent correlation and analysis within the SIEM.
Question 3: An IDS signature triggers on a specific byte sequence in network traffic. This is an example of which detection method?
- Anomaly-based detection
- Protocol analysis
- Signature-based detection (Correct answer)
- Behavioral heuristics
Correct answer: Signature-based detection
Signature-based detection matches traffic against known patterns or byte sequences associated with specific attacks.
Question 4: Which Windows Event ID is associated with a failed logon attempt and is critical for brute-force detection?
- 4648
- 4625 (Correct answer)
- 4776
- 4720
Correct answer: 4625
Event ID 4625 logs failed logon attempts on Windows systems and is essential for detecting brute-force and credential stuffing attacks.
Question 5: What does a high rate of ICMP echo requests to multiple hosts in rapid succession most likely indicate?
- Normal backup synchronization traffic
- A network ping sweep or reconnaissance activity (Correct answer)
- DNS resolution failure fallback behavior
- Routing protocol convergence traffic
Correct answer: A network ping sweep or reconnaissance activity
Rapid ICMP echo requests to many hosts is a classic indicator of a ping sweep used for network reconnaissance to discover live hosts.
Question 6: Which security concept ensures that monitoring tools themselves are protected from tampering by attackers who gain partial system access?
- Least privilege for monitoring agents
- Log integrity protection using cryptographic hashing or write-once storage (Correct answer)
- Network segmentation of monitored hosts
- Dual-factor authentication for analysts
Correct answer: Log integrity protection using cryptographic hashing or write-once storage
Protecting log integrity with cryptographic hashes or write-once (WORM) storage prevents attackers from covering their tracks by altering logs.
Question 7: A sudden spike in outbound traffic on port 6667 from multiple internal hosts is most likely associated with:
- Normal SMTP mail relay activity
- IRC-based botnet command-and-control communication (Correct answer)
- FTP passive mode data transfers
- NTP time synchronization floods
Correct answer: IRC-based botnet command-and-control communication
Port 6667 is the default IRC port, and unexpected outbound IRC traffic from internal hosts often signals botnet C2 communication.
SSCP Security Monitoring & Incident Detection 4
Which NetFlow data field is MOST useful for detecting data exfiltration over an extended period?