🔥 40% Off Crucial Exams Memberships — This Week Only

2 days, 12 hours remaining!
Crucial Exams

ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Your company streams AWS CloudTrail and VPC Flow Logs to a cloud-hosted SIEM via Kinesis Data Firehose. Management now requires that every critical alert be assigned, updated, and closed in a way that can later be audited to verify who performed each action. Which SIEM capability MOST directly satisfies this incident-tracking requirement?

  • Dynamic log normalization templates for diverse AWS log sources

  • User and entity behavior analytics (UEBA) module to detect anomalous activity

  • Real-time correlation rules that tag events with MITRE ATT&CK techniques

  • Integrated case management or ticketing workflow that links alerts to incidents

ISC2 Systems Security Certified Practitioner (SSCP)
Risk Identification, Monitoring and Analysis
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot