3.5 - Analyze Monitoring Results SSCP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst wants to visualize the number of security incidents by type (e.g., malware, phishing, unauthorized access) for the current quarter. The goal is to show which incident types are most common. Which visualization is most appropriate?

   • AA pie chart showing the percentage of incidents by type.
   • BA scatter plot showing the relationship between incident type and severity.
   • CA line chart showing the number of incidents over time.
   • DA bar chart with incident types on the x-axis and the count on the y-axis.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security manager wants to create a dashboard for the executive team that shows the organization's overall security posture. The dashboard should include metrics such as the number of open critical vulnerabilities, the percentage of systems patched, and the number of security incidents in the last 30 days. The executives are not technical. What is the most important design consideration for this dashboard?

   • AFocus only on the number of security incidents and exclude other metrics.
   • BPresent the metrics using simple visualizations and clearly explain what each metric means in business terms.
   • CUse a single complex chart that combines all metrics into one view.
   • DInclude as much technical detail as possible to provide a comprehensive view.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of using visualizations in security monitoring?

   • ATo replace the need for security logs
   • BTo automatically block malicious traffic
   • CTo encrypt security data at rest
   • DTo make security data easier to understand and interpret
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst is configuring alert notifications for a SIEM. The team is receiving too many pages for low-severity events, and critical alerts are being missed. The analyst wants to ensure that the on-call responder is notified immediately for high-severity incidents but not for routine events. What should the analyst configure?

   • ADisable all notifications and have the team manually check the SIEM dashboard hourly.
   • BIncrease the severity level of all alerts to ensure they are all treated as high priority.
   • CConfigure the SIEM to send an email for every alert, regardless of severity.
   • DSet notification rules so that only high-severity alerts trigger a page to the on-call responder.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst is reviewing raw firewall logs and notices a large number of connection attempts to a single internal server from many different external IP addresses on port 3389. The attempts are spread over several hours. What should the analyst conclude from this event data?

   • AThe events are normal because firewalls routinely log connection attempts.
   • BThe server is compromised and should be immediately disconnected from the network.
   • CThe pattern is consistent with a distributed brute-force attack against the server's remote desktop service.
   • DThe events are false positives and can be safely ignored.
   Reveal Solution Discussion Select an answer first