mediumMultiple Choice
SSCP Practice Question: A security analyst notices a sudden increase in…
A security analyst notices a sudden increase in failed login attempts from a single IP address across multiple user accounts. Which risk response strategy is most appropriate to implement immediately?
⚠ Common exam trap
SSCP often tests risk response terminology, and candidates confuse mitigation (reduce likelihood/impact) with remediation (fix after an incident) or transfer (insurance), picking a disruptive but less appropriate action.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk mitigation by blocking the IP address
Blocking the offending IP address is a risk mitigation control that immediately reduces the likelihood of a brute-force or credential-stuffing attack succeeding. It directly addresses the active threat by cutting off the source, which is the fastest and most targeted response. Mitigation reduces risk impact or likelihood, which matches the scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Risk mitigation by blocking the IP address
Why this is correct
Blocking the IP address at the firewall or Microsoft Entra ID sign-in policy immediately stops the brute-force attempts, directly satisfying the stem's demand for an immediate response. This is risk mitigation: applying a control to reduce the likelihood of credential compromise while investigation continues.
- ✗
Risk remediation by changing all user passwords
Why it's wrong here
Changing passwords does not stop the source IP from continuing its attempts, and risks locking out legitimate users. It is tempting because credential compromise is a real concern, and password rotation would be correct after confirming an account was actually breached, not during an active brute-force burst from one address.
- ✗
Risk transfer
Why it's wrong here
Risk transfer shifts financial impact via insurance or contracts; it cannot block an in-progress brute-force attack against live accounts. It is tempting because transfer is a legitimate strategy for residual breach costs, and would be correct when insuring against losses after controls are already in place.
- ✗
Risk acceptance
Why it's wrong here
Acceptance documents the risk and takes no action, leaving the brute-force attempts to continue unchecked. It is tempting because acceptance is valid for low-impact risks within tolerance, and would be correct for a single occasional failed login, not a sudden multi-account spike from one IP.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.