SSCP Security Operations and Administration Practice Question
A security administrator is implementing a solution to detect unauthorized changes to critical system files on a server. Which of the following technologies is BEST suited for this purpose?
⚠ Common exam trap
A common mix-up: candidates confuse general monitoring tools like SIEM or IDS with specialized file integrity monitoring.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
File integrity monitoring (FIM)
File integrity monitoring is specifically designed to detect unauthorized changes to files by comparing current hashes to known good baselines. It provides alerts when critical system files are modified, making it the best choice for this requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Security information and event management (SIEM)
Why it's wrong here
A SIEM aggregates and correlates logs from various sources, but it relies on other tools to generate relevant events. Without FIM or similar, the SIEM may not detect file changes. It is a complementary tool, not the primary detection mechanism for file integrity.
- ✗
Intrusion detection system (IDS)
Why it's wrong here
An IDS monitors network or host activity for malicious patterns, but it does not specifically track file integrity. While a host-based IDS might include FIM functionality, the general IDS is not the best tool for detecting file changes. FIM is more specialized and accurate for this task.
- ✓
File integrity monitoring (FIM)
Why this is correct
File integrity monitoring (FIM) tools compute cryptographic hashes of critical files and alert when changes occur. This directly detects unauthorized modifications. FIM is designed for this purpose, providing real-time or scheduled checks. It is the best fit for detecting changes to system files.
- ✗
Data loss prevention (DLP)
Why it's wrong here
DLP focuses on preventing sensitive data from leaving the organization. It monitors data in motion, at rest, and in use, but it is not designed to detect unauthorized changes to system files. Its purpose is data exfiltration prevention, not integrity monitoring.
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.