A security operations center (SOC) uses a SIEM to monitor a hybrid infrastructure. An analyst sees an alert for a single failed login on a domain controller. What is the most appropriate immediate action?

Ignore the alert because a single failed login is never significant.

Immediately block the user's account to prevent further attempts.

Disable the alert rule to prevent future false positives.

Investigate the alert in context, correlating it with other events from the same user or source.

What is the purpose of generating an audit trail in a SIEM?

To provide a record of security events for compliance and investigation

What is the purpose of event correlation in a SIEM?

To identify patterns and potential threats by analyzing relationships between events

To compress log files for storage

Systems Security Certified Practitioner

Domain 3Objective 4

3.4 - Operate and Monitor Security Platforms (e.g., Continuous Monitoring) SSCP Practice Questions (Page 3)

Part of the Risk Identification, Monitoring and Analysis domain, which accounts for 15% of the SSCP exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–2 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

9concepts

15%of the exam

9 Concepts in This Objective

Source Systems Identification
Event Types and Classification
Log Management Policy
Log Integrity and Preservation
Log Architectures and Aggregation
Log Configuration and Tuning
SIEM Real-Time Monitoring
SIEM Analysis and Correlation
SIEM Tracking and Auditing

Questions 11–15

11foundation · easy
An employee accidentally enters a wrong value in a financial application, causing a transaction to be recorded incorrectly. How would this event be classified?
Select an answer first
12application · medium
A security operations center (SOC) uses a SIEM to monitor a hybrid infrastructure. An analyst sees an alert for a single failed login on a domain controller. What is the most appropriate immediate action?
Select an answer first
13foundation · easy
What is the purpose of generating an audit trail in a SIEM?
Select an answer first
14foundation · easy
What is the purpose of event correlation in a SIEM?
Select an answer first
15foundation · easy
Which technique is commonly used to verify that a log file has not been altered after it was created?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SSCP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “SSCP” is a trademark of its owner, used for identification only.

3.4 - Operate and Monitor Security Platforms (e.g., Continuous Monitoring) SSCP Practice Questions (Page 3)

Questions 11–15

An employee accidentally enters a wrong value in a financial application, causing a transaction to be recorded incorrectly. How would this event be classified?

A security operations center (SOC) uses a SIEM to monitor a hybrid infrastructure. An analyst sees an alert for a single failed login on a domain controller. What is the most appropriate immediate action?

What is the purpose of generating an audit trail in a SIEM?

What is the purpose of event correlation in a SIEM?

Which technique is commonly used to verify that a log file has not been altered after it was created?

Keep studying — Risk Identification, Monitoring and Analysis