A company is experiencing a series of targeted phishing attacks against its finance team. The attackers are using highly personalized emails that reference recent company events and internal projects. The emails bypass the email gateway's spam filter. Which combination of countermeasures would be most effective in reducing the risk from these attacks?

Increase the spam filter's sensitivity and block all external emails

Implement a DLP system to block all outgoing emails

Disable email for the finance team and use a different communication channel

Implement multi-factor authentication (MFA) and provide targeted security awareness training to the finance team

A security analyst discovers a suspicious process running on a server. The process has no corresponding executable file on disk, and its memory contains code that appears to be injected into a legitimate system process. The analyst suspects fileless malware. Which countermeasure would be most effective in detecting and preventing this type of malware?

A network firewall with application control

Endpoint Detection and Response (EDR) with behavior monitoring

A traditional signature-based antivirus scanner

A host-based intrusion prevention system (HIPS) with file integrity monitoring

What is the primary purpose of using behavior analytics in security monitoring?

To replace all other security controls

To detect anomalies and patterns that may indicate malicious activity

To enforce password complexity requirements

Systems Security Certified Practitioner

Domain 7Objective 1

7.1 - Identify and Analyze Malicious Code and Activity SSCP Practice Questions (Page 2)

Part of the Systems and Application Security domain, which accounts for 15% of the SSCP exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–2 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

7concepts

15%of the exam

Questions 6–10

6expert · medium
A company is experiencing a series of targeted phishing attacks against its finance team. The attackers are using highly personalized emails that reference recent company events and internal projects. The emails bypass the email gateway's spam filter. Which combination of countermeasures would be most effective in reducing the risk from these attacks?
Select an answer first
7expert · medium
A security analyst discovers a suspicious process running on a server. The process has no corresponding executable file on disk, and its memory contains code that appears to be injected into a legitimate system process. The analyst suspects fileless malware. Which countermeasure would be most effective in detecting and preventing this type of malware?
Select an answer first
8foundation · easy
What is the primary purpose of using behavior analytics in security monitoring?
Select an answer first
9application · medium
An employee receives a voicemail from someone claiming to be from the company's IT help desk. The caller states that the employee's account will be locked in 30 minutes unless they provide their current password and a one-time SMS code for 'verification'. The employee calls the security team. Which social engineering method is being used?
Select an answer first
10foundation · easy
A user receives a text message that claims to be from their bank, asking them to click a link to verify their account immediately or face suspension. Which social engineering method is being used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SSCP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “SSCP” is a trademark of its owner, used for identification only.

7.1 - Identify and Analyze Malicious Code and Activity SSCP Practice Questions (Page 2)

Questions 6–10

What is the primary purpose of using behavior analytics in security monitoring?

A user receives a text message that claims to be from their bank, asking them to click a link to verify their account immediately or face suspension. Which social engineering method is being used?

Keep studying — Systems and Application Security