SSCP Practice Questions: Risk Identification, Monitoring, and Analysis Domain

Correct Answer: C

Explanation: Option C is correct because authentication server logs provide detailed information on login attempts, including failed attempts, which are crucial for detecting unauthorized access. Option A and B are useful but do not directly track access attempts. Option D focuses on performance rather than security events.

Correct Answer: B

Explanation: A SIEM tool aggregates and analyzes log data from across the network, providing insights into potential security events. In this scenario, a SIEM would help correlate the spike in outbound traffic with specific events or logs, such as unauthorized data exfiltration or malware activity. While NIDS (A) can detect suspicious traffic patterns, it may not provide the correlation and analysis capabilities of a SIEM. A WAF (C) is more focused on protecting web applications from specific attacks like SQL injection, and a DLP system (D) focuses on preventing data breaches by monitoring data in use, in motion, and at rest.

Correct Answer: B

Explanation: Reviewing the firewall logs is the most effective method to identify which traffic is being blocked and verify if the rule change is causing the issue. Reverting the configuration might resolve the problem but doesn't provide insight into the cause. Disabling the firewall is risky and not recommended. Contacting the vendor is not likely to address the firewall-specific issue.

Correct Answer: B

Explanation: Implementing account lockout policies is an effective immediate response to prevent brute force attacks. Increasing password complexity (Option A) is good for long-term security but doesn't address the immediate threat. Monitoring (Option C) delays action, allowing potential attacks to continue. Changing all passwords (Option D) is disruptive and may not be necessary if the issue is a brute force attack.

Correct Answer: B

Explanation: The Security log in Windows contains records of login attempts and can provide evidence of a brute-force attack, such as multiple failed login attempts. The System log (A) records system events, the Application log (C) records application-level events, and the Setup log (D) is used for setup-related events, none of which are directly relevant to login attempts.

Correct Answer: B

Explanation: Modifying the rule to restrict traffic to known, trusted IP addresses is a balanced approach that maintains necessary connectivity while reducing the risk of data exfiltration. Removing the rule immediately might disrupt legitimate business operations. Logging traffic without taking immediate action could allow potential threats to persist. Blocking all inbound traffic does not address the outbound traffic issue.

Correct Answer: A

Explanation: Implementing an account lockout policy is an effective way to mitigate brute force attacks by preventing repeated login attempts. Changing the password (B) and enabling multi-factor authentication (C) are good security practices but do not directly stop ongoing brute force attempts. Blocking the IP address (D) might be a temporary solution but could lead to blocking legitimate traffic if the source IP is dynamic or spoofed.

Correct Answer: C

Explanation: Adjusting the sensitivity of the IPS rule (C) is the best approach to reduce false positives without compromising security. Disabling the rule (A) could expose the system to legitimate threats. Whitelisting the user's IP (B) might resolve the issue for that user but could be risky if the user’s IP changes or is spoofed. Temporarily disabling the IPS (D) is not advisable as it reduces overall security.

Correct Answer: B

Explanation: The first step is to analyze the server's outbound traffic logs to gather more information about the nature and destination of the traffic. This will help determine if the spike is due to legitimate activity or a potential security threat. Immediately shutting down the server or blocking all traffic could disrupt legitimate services and should be considered only after confirming a threat. Updating antivirus software is a good practice but not the immediate priority for this scenario.

Correct Answer: B

Explanation: Option B is correct because checking compatibility helps identify if the update is causing the issue and allows for informed decision-making. Option A could expose the system to vulnerabilities. Option C might not be related and could compromise security. Option D should only be done if the firewall is confirmed to be the cause.