SSCP Security Monitoring & Incident Detection 5

Question 1

Which approach BEST reduces the risk of a zero-day exploit going undetected in a monitored environment?

Accepted Answer

Combining signature-based detection with behavioral and anomaly-based monitoring

Answer

Since zero-days have no known signatures, layering behavioral and anomaly-based monitoring alongside signature detection provides the best coverage.

Question 2

What is the primary function of a Network Intrusion Detection System (NIDS) placed at the network perimeter?

Accepted Answer

Passively monitoring and alerting on suspicious traffic without blocking

Answer

A NIDS passively monitors network traffic and generates alerts on suspicious patterns without actively blocking traffic, unlike an IPS.

Question 3

Which technique do attackers use to avoid detection by IDS/IPS systems through packet fragmentation?

Accepted Answer

Session splicing

Answer

Session splicing splits attack payloads across multiple small TCP segments, hoping the IDS fails to reassemble them for inspection.

Question 4

In the context of incident detection, what is a 'pivot' in threat hunting?

Accepted Answer

Using one discovered IOC to find related artifacts or compromised systems

Answer

Pivoting means using a known indicator (like an IP or hash) to discover related compromises or attacker infrastructure during an investigation.

Question 5

Which SIEM feature allows analysts to search historical log data to reconstruct past attack timelines?

Accepted Answer

Retrospective search and forensic querying

Answer

Retrospective search lets analysts query historical log archives to reconstruct timelines and understand the full scope of past incidents.

(SSCP) Security Operations and Administration Practice Test