A company's security team is configuring their SIEM to detect a potential distributed denial-of-service (DDoS) attack. They have established a baseline showing normal inbound traffic of 100 Mbps. Which anomaly detection technique is most effective for this specific scenario?

Statistical threshold-based detection that alerts when traffic volume exceeds a defined multiple of the baseline

User behavior analytics to detect unusual login patterns

Signature-based detection matching known DDoS attack patterns

Anomaly detection using a machine learning model trained on application error logs

A security analyst is investigating an alert triggered by a user account that downloaded a large amount of data from a file server. The user is a senior executive who frequently works remotely and has a history of downloading large files. The download occurred during business hours from a recognized VPN endpoint. However, the volume is 10 times larger than the user's typical maximum. What is the most appropriate course of action?

Conduct a focused investigation to correlate the download with other events, such as the user's authentication history, the specific files accessed, and any concurrent alerts

Immediately disable the user's account to prevent further data loss

Close the alert as a false positive because the user is a senior executive with legitimate remote access

Update the user's baseline to include this new higher volume of downloads

A security team wants to configure their SIEM to detect a potential brute-force attack followed by a successful login. They have access to authentication logs. What is the most effective correlation rule to implement?

Alert on any single failed login attempt

Alert on any successful login from a new IP address

Alert when the number of failed login attempts for a single account exceeds a threshold within a short time window, followed by a successful login for that same account

Alert on all login activity and let analysts review it manually

What is the primary use of a data baseline in security monitoring?

To compare current data activity against expected patterns

To enforce data retention policies

To determine the storage capacity needed

To classify data according to sensitivity

Information Systems Security Management Professional

Domain 4Objective 2

4.2 Establish and Maintain Threat Intelligence Program ISSMP Practice Questions (Page 5)

Part of the Security Operations domain, which accounts for 18% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–22 in this domain), expect 4–7 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

15concepts

18%of the exam

15 Concepts in This Objective

Threat intelligence sources
Threat data aggregation
Baseline analysis of network traffic
Baseline analysis of data
Baseline analysis of user behavior
Anomaly detection techniques
Anomaly analysis and investigation
Threat modeling methodologies
Threat modeling process
Attack classification
Attack categorization frameworks
Security event correlation
Correlation rules and tools
Actionable alert definition
Alert tuning and prioritization

Questions 21–25

21application · medium
A company's security team is configuring their SIEM to detect a potential distributed denial-of-service (DDoS) attack. They have established a baseline showing normal inbound traffic of 100 Mbps. Which anomaly detection technique is most effective for this specific scenario?
Select an answer first
22foundation · easy
What is the first step in the threat modeling process?
Select an answer first
23expert · hard
A security analyst is investigating an alert triggered by a user account that downloaded a large amount of data from a file server. The user is a senior executive who frequently works remotely and has a history of downloading large files. The download occurred during business hours from a recognized VPN endpoint. However, the volume is 10 times larger than the user's typical maximum. What is the most appropriate course of action?
Select an answer first
24application · medium
A security team wants to configure their SIEM to detect a potential brute-force attack followed by a successful login. They have access to authentication logs. What is the most effective correlation rule to implement?
Select an answer first
25foundation · easy
What is the primary use of a data baseline in security monitoring?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.

4.2 Establish and Maintain Threat Intelligence Program ISSMP Practice Questions (Page 5)

Questions 21–25

A company's security team is configuring their SIEM to detect a potential distributed denial-of-service (DDoS) attack. They have established a baseline showing normal inbound traffic of 100 Mbps. Which anomaly detection technique is most effective for this specific scenario?

What is the first step in the threat modeling process?

A security team wants to configure their SIEM to detect a potential brute-force attack followed by a successful login. They have access to authentication logs. What is the most effective correlation rule to implement?

What is the primary use of a data baseline in security monitoring?

Keep studying — Security Operations