SSCP Security Monitoring & Incident Detection 5 — Questions and Answers
Question 1: Which approach BEST reduces the risk of a zero-day exploit going undetected in a monitored environment?
- Relying exclusively on up-to-date antivirus signatures
- Combining signature-based detection with behavioral and anomaly-based monitoring (Correct answer)
- Increasing firewall rule counts
- Scheduling weekly manual log reviews
Correct answer: Combining signature-based detection with behavioral and anomaly-based monitoring
Since zero-days have no known signatures, layering behavioral and anomaly-based monitoring alongside signature detection provides the best coverage.
Question 2: What is the primary function of a Network Intrusion Detection System (NIDS) placed at the network perimeter?
- Blocking all inbound traffic that matches attack signatures
- Passively monitoring and alerting on suspicious traffic without blocking (Correct answer)
- Encrypting traffic between network segments
- Assigning IP addresses to network devices
Correct answer: Passively monitoring and alerting on suspicious traffic without blocking
A NIDS passively monitors network traffic and generates alerts on suspicious patterns without actively blocking traffic, unlike an IPS.
Question 3: Which technique do attackers use to avoid detection by IDS/IPS systems through packet fragmentation?
- Session splicing (Correct answer)
- ARP poisoning
- SQL injection
- Pass-the-hash
Correct answer: Session splicing
Session splicing splits attack payloads across multiple small TCP segments, hoping the IDS fails to reassemble them for inspection.
Question 4: In the context of incident detection, what is a 'pivot' in threat hunting?
- Rotating analysts between SOC shifts
- Using one discovered IOC to find related artifacts or compromised systems (Correct answer)
- Switching from signature to anomaly detection mid-investigation
- Changing log retention policies during an active incident
Correct answer: Using one discovered IOC to find related artifacts or compromised systems
Pivoting means using a known indicator (like an IP or hash) to discover related compromises or attacker infrastructure during an investigation.
Question 5: Which SIEM feature allows analysts to search historical log data to reconstruct past attack timelines?
- Real-time streaming alerts
- Retrospective search and forensic querying (Correct answer)
- Automated threat remediation
- Log forwarding to upstream MSSP
Correct answer: Retrospective search and forensic querying
Retrospective search lets analysts query historical log archives to reconstruct timelines and understand the full scope of past incidents.
Question 6: Which indicator would BEST help an analyst identify beaconing behavior from a compromised endpoint?
- Random spike in CPU utilization
- Periodic outbound connections to the same external IP at consistent intervals (Correct answer)
- A single large file transfer to a cloud storage service
- Increased inbound SMTP connections to the mail server
Correct answer: Periodic outbound connections to the same external IP at consistent intervals
Beaconing is characterized by regular, timed outbound communications from a compromised host checking in with a C2 server.
Question 7: What is the significance of establishing a 'chain of custody' during the incident detection and evidence collection phase?
- It ensures alerts are routed to the correct analyst tier
- It preserves evidence integrity so it remains admissible for legal or disciplinary proceedings (Correct answer)
- It defines escalation paths within the SOC hierarchy
- It tracks which signatures triggered during the detection phase
Correct answer: It preserves evidence integrity so it remains admissible for legal or disciplinary proceedings
Chain of custody documents who handled evidence and how, preserving its integrity and ensuring it can be used in legal or disciplinary actions.
SSCP Security Monitoring & Incident Detection 5
Which approach BEST reduces the risk of a zero-day exploit going undetected in a monitored environment?