A SIEM analyst is investigating a potential data exfiltration. The SIEM shows a large outbound data transfer from a workstation to an external IP, followed by the deletion of several local files. Which correlation best supports the hypothesis of data exfiltration?

The external IP is in a different country than the company's headquarters.

The outbound transfer and the file deletions occurred within a short time window from the same workstation.

The user had not changed their password in 90 days.

The workstation had a recent software update installed.

Which of the following is an example of SIEM analysis?

Identifying a brute-force attack by correlating multiple failed login attempts

Systems Security Certified Practitioner

Domain 3Objective 4

3.4 - Operate and Monitor Security Platforms (e.g., Continuous Monitoring) SSCP Practice Questions (Page 4)

Part of the Risk Identification, Monitoring and Analysis domain, which accounts for 15% of the SSCP exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–2 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

9concepts

15%of the exam

9 Concepts in This Objective

Source Systems Identification
Event Types and Classification
Log Management Policy
Log Integrity and Preservation
Log Architectures and Aggregation
Log Configuration and Tuning
SIEM Real-Time Monitoring
SIEM Analysis and Correlation
SIEM Tracking and Auditing

Questions 16–20

16foundation · easy
Which of the following is an example of a host-based source system that generates security-relevant data?
Select an answer first
17foundation · easy
A security analyst notices that a user logs in at 3:00 AM every day, which is outside the user's normal working hours. How would this event be classified?
Select an answer first
18application · medium
A SIEM analyst is investigating a potential data exfiltration. The SIEM shows a large outbound data transfer from a workstation to an external IP, followed by the deletion of several local files. Which correlation best supports the hypothesis of data exfiltration?
Select an answer first
19foundation · easy
Which SIEM capability is used to track the sequence of events leading up to an incident?
Select an answer first
20foundation · easy
Which of the following is an example of SIEM analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SSCP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “SSCP” is a trademark of its owner, used for identification only.

3.4 - Operate and Monitor Security Platforms (e.g., Continuous Monitoring) SSCP Practice Questions (Page 4)

Questions 16–20

Which of the following is an example of a host-based source system that generates security-relevant data?

A security analyst notices that a user logs in at 3:00 AM every day, which is outside the user's normal working hours. How would this event be classified?

A SIEM analyst is investigating a potential data exfiltration. The SIEM shows a large outbound data transfer from a workstation to an external IP, followed by the deletion of several local files. Which correlation best supports the hypothesis of data exfiltration?

Which SIEM capability is used to track the sequence of events leading up to an incident?

Which of the following is an example of SIEM analysis?

Keep studying — Risk Identification, Monitoring and Analysis