SSCP Risk Identification, Monitoring, and Analysis Practice Question
A security analyst is reviewing logs from a SIEM and notices multiple failed login attempts for a privileged account from an IP address in a foreign country, followed by a successful login after hours. Which type of security monitoring tool would be most effective at detecting this pattern as anomalous behavior based on user baseline?
⚠ Common exam trap
A common mix-up: candidates confuse anomaly detection with signature-based detection, assuming that a failed login followed by a success is a known brute-force pattern that a signature-based IDS would catch, but the question specifically asks for detection based on a user baseline, which is the core function of UBA, not signature matching.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
User Behavior Analytics (UBA)
User Behavior Analytics (UBA) is designed to establish a baseline of normal user activity and detect anomalies such as a privileged account logging in from an unusual geographic location after hours. Unlike signature or rule-based tools, UBA uses statistical modeling and machine learning to identify deviations from the user's historical patterns, making it ideal for detecting this type of credential misuse.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Signature-based IDS
Why it's wrong here
Signature-based IDS matches traffic against known attack patterns, so it cannot learn a user's normal login baseline or flag deviations such as foreign-source failures preceding an after-hours success. It is tempting because signatures reliably catch documented exploits, and would be correct for detecting known malware or exploit traffic.
- ✗
Network-based IPS
Why it's wrong here
A network-based IPS inspects and blocks traffic inline against protocol and exploit signatures; it does not model per-user authentication behaviour, so it cannot flag a foreign IP's failed logins followed by an after-hours success. It is tempting because it stops attacks in real time, and would be correct for blocking known network exploits.
- ✗
Host-based IDS
Why it's wrong here
Host-based IDS inspects activity on a single endpoint's OS and file system, so it cannot correlate a foreign IP's failed logins with a later successful after-hours login across authentication logs. It is tempting because HIDS detects local anomalies, and would suit detecting suspicious process or file changes on one host.
- ✓
User Behavior Analytics (UBA)
Why this is correct
User Behaviour Analytics builds baselines of normal activity per account and flags deviations, so the foreign-IP, after-hours privileged login pattern stands out as anomalous. Signature or rule-based tools would miss this because no known attack signature matches.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.