3.5 - Analyze Monitoring Results SSCP Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the purpose of escalation procedures in incident response?

   • ATo ensure significant incidents are promptly reported to appropriate levels of management or response teams
   • BTo automatically fix all security issues
   • CTo delay reporting until the incident is fully resolved
   • DTo keep incidents secret from management
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security team wants to measure the effectiveness of a new endpoint detection and response (EDR) tool. They decide to track the mean time to detect (MTTD) and mean time to respond (MTTR) for confirmed incidents. After six months, they want to compare these metrics against the previous six months. What is the primary purpose of this comparison?

   • ATo generate a report for the security team to document the number of incidents.
   • BTo assess whether the EDR tool has improved the team's detection and response capabilities over time.
   • CTo establish a new security baseline for normal system behavior.
   • DTo identify which individual analyst is the fastest at responding to incidents.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security team tracks the number of phishing emails reported by employees each month. In January, 50 were reported; in February, 75; in March, 110. The team wants to understand if this trend indicates improved employee reporting or an increase in phishing attacks. What is the most appropriate next step?

   • AConclude that the increase is solely due to more phishing attacks.
   • BStop tracking the metric because the trend is unclear.
   • CCorrelate the reported phishing emails with other data, such as the number of phishing emails detected by the email gateway.
   • DConclude that the increase is solely due to improved employee reporting.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Why is it important to tailor security findings to the audience when communicating?

   • ATo avoid having to document findings
   • BTo hide the true nature of security incidents
   • CTo make the findings more complex for everyone
   • DBecause technical and non-technical audiences have different levels of understanding
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A SOC analyst detects a series of correlated events that strongly suggest a ransomware infection is spreading across the network. The organization's escalation procedure states that the incident commander must be notified within 30 minutes of confirming a critical incident. The analyst has confirmed the pattern. What should the analyst do?

   • ASend an email to the incident commander and wait for a reply before taking any further action.
   • BContinue monitoring to gather more evidence before escalating.
   • CImmediately escalate the confirmed critical incident to the incident commander as per the procedure.
   • DWait until the end of the shift to include all findings in a single report.
   Reveal Solution Discussion Select an answer first