SSCP Risk Identification, Monitoring, and Analysis Practice Question
A security analyst is reviewing logs and notices multiple failed login attempts from a single IP address against an administrative account. The SIEM has not generated an alert. Which configuration change would best detect this scenario?
⚠ Common exam trap
A common mix-up: candidates confuse the roles of IDS/IPS and SIEM, mistakenly thinking signature-based or host-based IDS can natively correlate login failures from a single source, when in fact SIEM correlation rules are specifically designed for this multi-event behavioral detection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a SIEM correlation rule to alert on multiple failed logins from the same source
A SIEM correlation rule can specifically detect multiple failed login attempts from the same source IP address by aggregating and analyzing log events in real time. Unlike signature-based or host-based IDS solutions, a SIEM correlation rule can be tuned to match this exact behavioral pattern, triggering an alert when the configured threshold (e.g., 5 failures within 10 minutes) is exceeded. This directly addresses the gap where the SIEM failed to generate an alert due to the absence of such a rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable signature-based detection on the IDS
Why it's wrong here
Signature-based IDS detects known attack patterns, but failed logins may not be a signature-based detection scenario unless combined with other indicators.
- ✗
Implement a host-based IDS on the server
Why it's wrong here
A HIDS monitors system calls and file integrity; it is not the most efficient direct solution for alerting on failed logins across the network.
- ✓
Create a SIEM correlation rule to alert on multiple failed logins from the same source
Why this is correct
A SIEM correlation rule can aggregate failed login events and trigger an alert when a threshold is met, which directly addresses the scenario.
- ✗
Increase log retention to 1 year
Why it's wrong here
Log retention helps with forensics but does not proactively alert on failed login attempts.
Go deeper
Related to this question
About these practice questions
One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.