3.5 - Analyze Monitoring Results SSCP Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which technique is commonly used to reduce noise in security alerts?

   • AFiltering out known benign events and tuning alert thresholds
   • BSending all alerts to every team member
   • CDisabling all security monitoring
   • DIncreasing the logging verbosity of all systems
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which scenario is most indicative of an anomaly that should be investigated?

   • AA firewall blocks a known malicious IP address
   • BA user logs in from a new device at an unusual time
   • CA server experiences a scheduled maintenance reboot
   • DAn employee accesses a shared drive during business hours
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is an example of event correlation?

   • AMultiple failed logins from one IP address are followed by a successful login from the same IP
   • BA single failed login attempt is logged
   • CA firewall blocks a single packet
   • DAn antivirus program updates its signature database
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security operations center (SOC) analyst notices three separate alerts: (1) a successful VPN login for a marketing user at 3:00 AM, (2) a download of 5 GB from an internal file share by that same user at 3:15 AM, and (3) an outbound email with a 5 GB attachment from that user's mailbox at 3:30 AM. Individually, each alert is low priority. What should the analyst do?

   • AContact the user to ask if they performed these actions before taking any further steps.
   • BClose all three alerts as false positives because each one is low priority on its own.
   • CCorrelate the three events into a single timeline and escalate as a potential data exfiltration incident.
   • DEscalate only the outbound email alert because it is the final action in the sequence.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following is an example of event data analysis?

   • AConfiguring a firewall to block a specific IP
   • BReviewing firewall logs to identify a pattern of port scans
   • CInstalling a new security patch
   • DBacking up event logs to an external drive
   Reveal Solution Discussion Select an answer first