SSCP Risk Identification, Monitoring, and Analysis Practice Question
A security analyst is reviewing logs from a SIEM and notices multiple failed login attempts for a privileged account from an IP address in a foreign country, followed by a successful login after hours. Which type of security monitoring tool would be most effective at detecting this pattern as anomalous behavior based on user baseline?
⚠ Common exam trap
A common mix-up: candidates confuse anomaly detection with signature-based detection, assuming that a failed login followed by a success is a known brute-force pattern that a signature-based IDS would catch, but the question specifically asks for detection based on a user baseline, which is the core function of UBA, not signature matching.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
User Behavior Analytics (UBA)
User Behavior Analytics (UBA) is designed to establish a baseline of normal user activity and detect anomalies such as a privileged account logging in from an unusual geographic location after hours. Unlike signature or rule-based tools, UBA uses statistical modeling and machine learning to identify deviations from the user's historical patterns, making it ideal for detecting this type of credential misuse.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Signature-based IDS
Why it's wrong here
Signature-based IDS detects known attack patterns, not anomalies in user behavior.
- ✗
Network-based IPS
Why it's wrong here
NIPS focuses on network traffic and blocking threats, not user behavior.
- ✗
Host-based IDS
Why it's wrong here
HIDS monitors host-level events but does not typically analyze user behavior baselines.
- ✓
User Behavior Analytics (UBA)
Why this is correct
UBA uses baseline modeling to detect anomalous user activities.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.