SSCP Security Operations and Administration Practice Question
A security administrator is reviewing log files and notices that a user logged in at 3:00 AM from an IP address in a foreign country. The user's manager confirms the user is not authorized for remote access. Which type of policy has likely been violated?
⚠ Common exam trap
SSCP candidates often confuse Acceptable Use Policy (AUP) with Remote Access Policy. While AUP covers general appropriate use of systems, this specific violation involves unauthorized remote logins from a foreign IP at an odd hour, which falls under Remote Access Policy restrictions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remote access policy
The scenario describes a user logging in from an unauthorized location (foreign country) at an unusual time (3:00 AM) without remote access authorization. This directly violates the remote access policy, which defines who can connect remotely, from where, and under what conditions. The policy typically specifies allowed authentication methods (e.g., VPN with multi-factor authentication), permitted IP ranges, and time-of-day restrictions to prevent unauthorized external connections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Remote access policy
Why this is correct
A remote access policy defines who may connect remotely, from where, and under what conditions. The login from a foreign IP at 03:00 breaches the manager-confirmed restriction that this user lacks remote access authorisation, so the access control constraint in the stem is directly violated.
- ✗
Data handling policy
Why it's wrong here
A data handling policy governs classification, storage and transmission of information, not who may connect remotely; the unauthorised foreign login breached the remote access policy. Tempting because both concern access controls, but data handling addresses information protection rather than connection authorisation.
- ✗
Password policy
Why it's wrong here
A password policy governs credential complexity, rotation and lockout, not login origin or authorisation; the foreign 3:00 AM login breached the remote access policy. Tempting because compromised credentials often enable such logins, but nothing here indicates a password rule was broken.
- ✗
Acceptable use policy (AUP)
Why it's wrong here
An AUP governs acceptable employee behaviour, not remote-access authorisation; the login breached the remote access policy defining who may connect externally. Tempting because AUPs cover misuse of company systems, but they do not specify permitted connection methods or locations.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.