SSCP Security Monitoring & Incident Detection 4

Question 1

Which NetFlow data field is MOST useful for detecting data exfiltration over an extended period?

Accepted Answer

Total bytes transferred per session

Answer

Tracking total bytes transferred per session or over time helps identify unusually large outbound data transfers indicative of exfiltration.

Question 2

What is the primary goal of log normalization in a SIEM?

Accepted Answer

Converting logs from disparate sources into a common format for analysis

Answer

Log normalization standardizes log formats from different sources, enabling consistent correlation and analysis within the SIEM.

Question 3

An IDS signature triggers on a specific byte sequence in network traffic. This is an example of which detection method?

Accepted Answer

Signature-based detection

Answer

Signature-based detection matches traffic against known patterns or byte sequences associated with specific attacks.

Question 4

Which Windows Event ID is associated with a failed logon attempt and is critical for brute-force detection?

Accepted Answer

4625

Answer

Event ID 4625 logs failed logon attempts on Windows systems and is essential for detecting brute-force and credential stuffing attacks.

Question 5

What does a high rate of ICMP echo requests to multiple hosts in rapid succession most likely indicate?

Accepted Answer

A network ping sweep or reconnaissance activity

Answer

Rapid ICMP echo requests to many hosts is a classic indicator of a ping sweep used for network reconnaissance to discover live hosts.

(SSCP) Security Operations and Administration Practice Test