mediumMultiple ChoiceObjective-mapped
SSCP Practice Question: A security administrator notices that a critical…
A security administrator notices that a critical server's event log shows repeated failed login attempts from an internal IP address that normally does not generate any traffic. The administrator immediately blocks the IP at the firewall and resets the account password. However, the incident response team later determines that the attacker had already gained access to the server. What is the MOST likely reason the administrator's actions were insufficient?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The administrator did not isolate the server from the network.
The administrator's actions—blocking the IP at the firewall and resetting the password—were insufficient because the attacker had already gained access to the server. Isolating the server (e.g., disconnecting it from the network) would have severed the attacker's active connection and prevented further compromise. Option A is wrong because preserving logs is important for investigation but does not stop an ongoing breach. Option B is wrong because a malware scan is a remediation step after containment. Option D is wrong because notifying the data owner addresses notification requirements but does not directly contain the threat.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The administrator did not preserve the log evidence for forensic analysis.
Why it's wrong here
Preserving logs is important but does not stop ongoing access.
- ✗
The administrator neglected to perform a full system scan for malware.
Why it's wrong here
Scanning is part of eradication, not immediate containment.
- ✓
The administrator did not isolate the server from the network.
Why this is correct
Isolation prevents further access and contains the threat.
- ✗
The administrator failed to notify the data owner about the incident.
Why it's wrong here
Notification is important but does not stop the attack.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.