Which of the following is an example of correlating security events?

Linking multiple failed logins followed by a successful login

Reviewing a single firewall log

A financial firm's security team has established user behavior baselines. A senior accountant, who typically logs in between 8:00 AM and 6:00 PM from the office, has logged in at 2:00 AM from a foreign IP address and is downloading a large volume of client records. What is the most appropriate immediate action?

Disable the user's account immediately and permanently

Flag the activity as a high-priority anomaly and begin an investigation to verify the user's identity and intent

Send an email to the user asking if they are currently logged in

Update the user's baseline to include late-night logins from foreign IPs

Information Systems Security Management Professional

Domain 4Objective 2

4.2 Establish and Maintain Threat Intelligence Program ISSMP Practice Questions (Page 1)

Part of the Security Operations domain, which accounts for 18% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–22 in this domain), expect 4–7 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

15concepts

18%of the exam

15 Concepts in This Objective

Threat intelligence sources
Threat data aggregation
Baseline analysis of network traffic
Baseline analysis of data
Baseline analysis of user behavior
Anomaly detection techniques
Anomaly analysis and investigation
Threat modeling methodologies
Threat modeling process
Attack classification
Attack categorization frameworks
Security event correlation
Correlation rules and tools
Actionable alert definition
Alert tuning and prioritization

Questions 1–5

1foundation · easy
Which threat intelligence source is most likely to provide tailored, high-confidence indicators that are exclusive to a subscribing organization and come with vendor support?
Select an answer first
2foundation · easy
Which threat modeling approach uses a tree structure to represent possible attack paths?
Select an answer first
3foundation · easy
Which tool is specifically designed to collect, correlate, and analyze security events from multiple sources?
Select an answer first
4foundation · easy
Which of the following is an example of correlating security events?
Select an answer first
5application · medium
A financial firm's security team has established user behavior baselines. A senior accountant, who typically logs in between 8:00 AM and 6:00 PM from the office, has logged in at 2:00 AM from a foreign IP address and is downloading a large volume of client records. What is the most appropriate immediate action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.

4.2 Establish and Maintain Threat Intelligence Program ISSMP Practice Questions (Page 1)

Questions 1–5

Which threat intelligence source is most likely to provide tailored, high-confidence indicators that are exclusive to a subscribing organization and come with vendor support?

Which threat modeling approach uses a tree structure to represent possible attack paths?

Which tool is specifically designed to collect, correlate, and analyze security events from multiple sources?

Which of the following is an example of correlating security events?

Keep studying — Security Operations