A financial institution is required by regulation to retain audit logs for seven years and must be able to produce them in a legal proceeding. The security team is designing a log management policy. Which combination of controls best meets these requirements?

Keep logs on the originating servers and allow administrators to delete them after two years to save space.

Store logs in a write-once, read-many (WORM) storage system and back them up to an offsite location.

Compress logs and store them on a network share with write access for all IT staff.

Email logs to the legal department daily and store them in a shared mailbox.

Which component is essential in a log architecture that aggregates logs from multiple sources?

A central log collector or server

A SIEM analyst notices a spike in failed login attempts from a single IP address against the VPN gateway, followed by a successful login from the same IP. According to event classification, how should the analyst categorize this sequence?

An anomaly and a potential security incident requiring investigation.

A routine error that can be ignored because the login eventually succeeded.

A policy failure because the account should have been locked after multiple failures.

A compliance violation because the user did not use multi-factor authentication.

Which of the following is a technique to reduce log noise?

Filtering out routine, expected events

Systems Security Certified Practitioner

Domain 3Objective 4

3.4 - Operate and Monitor Security Platforms (e.g., Continuous Monitoring) SSCP Practice Questions (Page 5)

Part of the Risk Identification, Monitoring and Analysis domain, which accounts for 15% of the SSCP exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–2 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

9concepts

15%of the exam

9 Concepts in This Objective

Source Systems Identification
Event Types and Classification
Log Management Policy
Log Integrity and Preservation
Log Architectures and Aggregation
Log Configuration and Tuning
SIEM Real-Time Monitoring
SIEM Analysis and Correlation
SIEM Tracking and Auditing

Questions 21–25

21foundation · easy
What should a log management policy specify to ensure that only authorized personnel can view log data?
Select an answer first
22application · medium
A financial institution is required by regulation to retain audit logs for seven years and must be able to produce them in a legal proceeding. The security team is designing a log management policy. Which combination of controls best meets these requirements?
Select an answer first
23foundation · easy
Which component is essential in a log architecture that aggregates logs from multiple sources?
Select an answer first
24application · medium
A SIEM analyst notices a spike in failed login attempts from a single IP address against the VPN gateway, followed by a successful login from the same IP. According to event classification, how should the analyst categorize this sequence?
Select an answer first
25foundation · easy
Which of the following is a technique to reduce log noise?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SSCP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “SSCP” is a trademark of its owner, used for identification only.