3.5 - Analyze Monitoring Results SSCP Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is the primary purpose of a security notification system?

   • ATo alert relevant personnel about significant security events
   • BTo automatically patch all vulnerabilities
   • CTo replace the need for security monitoring
   • DTo store security logs for compliance
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   After completing an investigation of a malware infection, a security analyst must document the findings. The documentation will be used by the incident response team for post-incident review and by management to understand the impact. What is the most important element to include in the documentation?

   • AA list of all software versions installed on the affected systems.
   • BThe name of the employee who reported the incident.
   • CA clear, structured summary of the event timeline, actions taken, and lessons learned.
   • DThe raw log files from every system involved in the incident.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which of the following best describes a security event timeline?

   • AA chronological list of events related to a security incident
   • BA random collection of security alerts
   • CA summary of security policies
   • DA list of all employees in the security team
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   An analyst is investigating a potential account compromise. The events collected are: (1) a successful login from an unusual location at 9:00 PM, (2) a password change at 9:10 PM, (3) a login from the same unusual location at 9:15 PM, and (4) a large data download at 9:30 PM. The analyst needs to determine the sequence of events to understand the attacker's actions. What is the most critical piece of information to add to the timeline?

   • AThe size of the data download.
   • BThe IP addresses of the systems involved.
   • CThe names of the users who were logged in at the time.
   • DThe exact timestamps of each event, including timezone information.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which of the following is an example of a security metric?

   • AThe number of security incidents reported per month
   • BThe name of the security team lead
   • CThe color of the server room walls
   • DThe brand of firewall used
   Reveal Solution Discussion Select an answer first