What does anomaly detection primarily rely on to identify potential security incidents?

Blocking all traffic that originates from external networks

Scanning files for malware signatures

Matching current activity against known attack signatures

Comparing current behavior against an established baseline

A security manager needs to present the trend of malware infections across the organization over the past year to the executive board. The board wants to see whether the number of infections is increasing or decreasing. Which visualization is most appropriate for this purpose?

A scatter plot showing the relationship between infections and employee count.

A bar chart showing the total number of infections for the entire year.

A line chart showing the number of malware infections per month over the past year.

A pie chart showing the percentage of infections by malware type.

A system administrator wants to establish a security baseline for a new web server. The server will be placed into production after a two-week testing period. Which data should the administrator collect to establish the baseline?

The IP addresses of all other servers in the network.

The list of all software installed on the server.

Normal CPU, memory, network traffic, and user access patterns during the testing period.

The highest possible load the server can handle during a stress test.

Which of the following is a key element of well-documented monitoring findings?

A list of all employees' personal information

Vague references to 'various issues'

Random timestamps that do not match events

Clear descriptions of what was observed and its significance

Systems Security Certified Practitioner

Domain 3Objective 5

3.5 - Analyze Monitoring Results SSCP Practice Questions (Page 3)

Part of the Risk Identification, Monitoring and Analysis domain, which accounts for 15% of the SSCP exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–2 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

13concepts

15%of the exam

Questions 11–15

11foundation · easy
What does anomaly detection primarily rely on to identify potential security incidents?
Select an answer first
12application · medium
A security manager needs to present the trend of malware infections across the organization over the past year to the executive board. The board wants to see whether the number of infections is increasing or decreasing. Which visualization is most appropriate for this purpose?
Select an answer first
13foundation · easy
Which of the following is a common method for delivering security notifications?
Select an answer first
14application · medium
A system administrator wants to establish a security baseline for a new web server. The server will be placed into production after a two-week testing period. Which data should the administrator collect to establish the baseline?
Select an answer first
15foundation · easy
Which of the following is a key element of well-documented monitoring findings?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SSCP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “SSCP” is a trademark of its owner, used for identification only.