hardMultiple Choice
SSCP Practice Question: A large data center uses a three-tier…
A large data center uses a three-tier architecture with core, aggregation, and access switches. The security team detects anomalous traffic patterns: every night at 2:00 AM, a single server (IP 10.10.10.50) sends large ICMP Echo requests to multiple external IPs, followed by a flood of TCP SYN packets from those external IPs back to the server. The server is a critical database server that should not initiate outbound connections. The team suspects the server is compromised. The network team wants to contain the threat without taking the server offline immediately. Which action should they take first?
⚠ Common exam trap
Many candidates choose a more drastic action like shutting down the port or blocking all traffic, failing to recognize that a granular ACL on the switch port can surgically stop the malicious traffic while keeping the server online for its primary role.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply an access control list (ACL) on the switch port to block outbound ICMP and non-essential TCP traffic from the server.
Applying an ACL on the switch port to block outbound ICMP and non-essential TCP traffic from the server immediately stops the anomalous traffic (ICMP Echo requests and TCP SYN flood responses) without taking the critical database server offline. This containment approach preserves server availability for legitimate database operations while preventing further malicious outbound activity, aligning with the goal of containing the threat without immediate downtime.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Apply an access control list (ACL) on the switch port to block outbound ICMP and non-essential TCP traffic from the server.
Why this is correct
An ACL on the switch port blocks the server's outbound ICMP and non-essential TCP, severing command-and-control and exfiltration paths while the host stays online. This contains the compromise immediately, satisfying the requirement to avoid taking the critical database server offline.
- ✗
Add a firewall rule to block all traffic to and from the server's IP.
Why it's wrong here
Blocking all traffic to and from the server also severs legitimate database client connections, effectively isolating a critical production system and breaching the requirement to keep it online. It tempts because a blanket firewall rule is fast and decisive, but it is correct when the server's business traffic is expendable.
- ✗
Move the server to a quarantine VLAN with no route to the internet.
Why it's wrong here
A quarantine VLAN still permits the compromised server to reach internal hosts and continue beaconing laterally; it only removes internet routing, which the stem's containment goal does not require as the first step. It tempts because quarantine is a recognised containment technique, but it is correct when internal segmentation, not external egress, is the threat vector.
- ✗
Shut down the switch port to disconnect the server immediately.
Why it's wrong here
Shutting the switch port disconnects the server entirely, which is taking it offline — precisely what the network team was asked to avoid. It tempts because port shutdown is the fastest physical containment, but it is correct only when immediate isolation outweighs the availability of a critical database server.
Visual reference
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.