A SIEM is generating thousands of alerts per day, most of which are false positives from routine administrative activity. The security team is overwhelmed and missing real incidents. Which tuning action is most effective?

Create suppression rules for known benign activity and adjust correlation rules to require multiple indicators.

Disable all alerts that have not fired in the last month.

Increase the log retention period to keep more data for analysis.

Upgrade the SIEM hardware to process alerts faster.

A security analyst needs to prove that a log file from a critical server has not been altered since it was collected three months ago. The log was forwarded to a central log server. Which measure best supports this proof?

Rely on the file's timestamp to confirm it has not been modified.

Copy the log file to a USB drive and keep it in the administrator's desk drawer.

Generate a cryptographic hash of the log file at collection time and store the hash in a separate, secured location.

Ensure the log file is readable only by the administrator account.

What is the primary purpose of a centralized log aggregation architecture?

To collect logs from multiple sources into a single location for analysis

To generate alerts in real time

To reduce the size of log files

Systems Security Certified Practitioner

Domain 3Objective 4

3.4 - Operate and Monitor Security Platforms (e.g., Continuous Monitoring) SSCP Practice Questions (Page 1)

Part of the Risk Identification, Monitoring and Analysis domain, which accounts for 15% of the SSCP exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–2 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

9concepts

15%of the exam

9 Concepts in This Objective

Source Systems Identification
Event Types and Classification
Log Management Policy
Log Integrity and Preservation
Log Architectures and Aggregation
Log Configuration and Tuning
SIEM Real-Time Monitoring
SIEM Analysis and Correlation
SIEM Tracking and Auditing

Questions 1–5

1application · medium
A SIEM is generating thousands of alerts per day, most of which are false positives from routine administrative activity. The security team is overwhelmed and missing real incidents. Which tuning action is most effective?
Select an answer first
2foundation · easy
Which of the following is a measure to preserve log integrity and ensure logs are available for future investigation?
Select an answer first
3application · medium
A security analyst needs to prove that a log file from a critical server has not been altered since it was collected three months ago. The log was forwarded to a central log server. Which measure best supports this proof?
Select an answer first
4foundation · easy
What is the primary purpose of a centralized log aggregation architecture?
Select an answer first
5foundation · easy
Which of the following is a key component of a log management policy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SSCP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “SSCP” is a trademark of its owner, used for identification only.

3.4 - Operate and Monitor Security Platforms (e.g., Continuous Monitoring) SSCP Practice Questions (Page 1)

Questions 1–5

A SIEM is generating thousands of alerts per day, most of which are false positives from routine administrative activity. The security team is overwhelmed and missing real incidents. Which tuning action is most effective?

Which of the following is a measure to preserve log integrity and ensure logs are available for future investigation?

A security analyst needs to prove that a log file from a critical server has not been altered since it was collected three months ago. The log was forwarded to a central log server. Which measure best supports this proof?

What is the primary purpose of a centralized log aggregation architecture?

Which of the following is a key component of a log management policy?

Keep studying — Risk Identification, Monitoring and Analysis