hardMultiple ChoiceObjective-mapped
SSCP Practice Question: A large data center uses a three-tier…
A large data center uses a three-tier architecture with core, aggregation, and access switches. The security team detects anomalous traffic patterns: every night at 2:00 AM, a single server (IP 10.10.10.50) sends large ICMP Echo requests to multiple external IPs, followed by a flood of TCP SYN packets from those external IPs back to the server. The server is a critical database server that should not initiate outbound connections. The team suspects the server is compromised. The network team wants to contain the threat without taking the server offline immediately. Which action should they take first?
⚠ Common exam trap
Many candidates choose a more drastic action like shutting down the port or blocking all traffic, failing to recognize that a granular ACL on the switch port can surgically stop the malicious traffic while keeping the server online for its primary role.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply an access control list (ACL) on the switch port to block outbound ICMP and non-essential TCP traffic from the server.
Applying an ACL on the switch port to block outbound ICMP and non-essential TCP traffic from the server immediately stops the anomalous traffic (ICMP Echo requests and TCP SYN flood responses) without taking the critical database server offline. This containment approach preserves server availability for legitimate database operations while preventing further malicious outbound activity, aligning with the goal of containing the threat without immediate downtime.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Apply an access control list (ACL) on the switch port to block outbound ICMP and non-essential TCP traffic from the server.
Why this is correct
This restricts the server's outbound traffic without fully disconnecting it.
- ✗
Add a firewall rule to block all traffic to and from the server's IP.
Why it's wrong here
This would block all traffic, including legitimate database queries.
- ✗
Move the server to a quarantine VLAN with no route to the internet.
Why it's wrong here
Moving the server might affect other services and is less immediate than an ACL.
- ✗
Shut down the switch port to disconnect the server immediately.
Why it's wrong here
This would take the critical database server offline.
Visual reference
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.