SSCP Rule-based detection Practice Question
A security analyst notices repeated failed login attempts from a single IP address targeting a domain controller. The SIEM alerts after 10 failed attempts within 5 minutes. Which detection type is most likely used?
⚠ Common exam trap
Candidates may assume any threshold-based alert is anomaly-based, but a fixed, static threshold is a hallmark of rule-based detection. Anomaly-based detection derives thresholds from historical baselines.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rule-based detection
The alert is triggered by a static threshold (10 failed attempts in 5 minutes) with no baseline learning. This is characteristic of rule-based detection, which uses predefined conditions (e.g., 'if count > 10 then alert'). Anomaly-based detection would require establishing a baseline of normal behavior and detecting deviations from that baseline. Therefore, rule-based detection is the most likely type used.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Anomaly-based detection
Why it's wrong here
Threshold-based detection triggers on a fixed count, here 10 failures in 5 minutes, so the SIEM rule is signature- or count-based. Anomaly-based detection baselines normal behaviour and flags statistical deviation, which suits detecting novel or low-and-slow attacks rather than a simple repeated-failure pattern.
- ✗
Signature-based detection
Why it's wrong here
Signature-based detection matches known patterns such as specific attack strings, not a threshold of failed logins within a time window. It is tempting because failed logins can be signatured, but the 10-in-5-minutes rule is threshold-based anomaly detection.
- ✓
Rule-based detection
Why this is correct
A fixed threshold — ten failed attempts within five minutes from one source — is a deterministic signature. Rule-based detection matches events against predefined conditions, unlike anomaly or behavioural baselining, which flags deviations from learned norms.
- ✗
Behavior-based detection
Why it's wrong here
A fixed threshold of ten failures in five minutes is a static signature rule, not a learned baseline of normal activity, so behaviour-based detection mislabels it. Behaviour-based detection would be correct where the alert derives from deviation against a modelled profile of typical login patterns rather than a hardcoded count.
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.