SSCP Rule-based detection Practice Question
A security analyst notices repeated failed login attempts from a single IP address targeting a domain controller. The SIEM alerts after 10 failed attempts within 5 minutes. Which detection type is most likely used?
⚠ Common exam trap
Candidates may assume any threshold-based alert is anomaly-based, but a fixed, static threshold is a hallmark of rule-based detection. Anomaly-based detection derives thresholds from historical baselines.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rule-based detection
The alert is triggered by a static threshold (10 failed attempts in 5 minutes) with no baseline learning. This is characteristic of rule-based detection, which uses predefined conditions (e.g., 'if count > 10 then alert'). Anomaly-based detection would require establishing a baseline of normal behavior and detecting deviations from that baseline. Therefore, rule-based detection is the most likely type used.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Anomaly-based detection
Why it's wrong here
Anomaly-based detection is incorrect because it involves dynamic baselines learned from normal activity; the given threshold is fixed and not derived from a baseline.
- ✗
Signature-based detection
Why it's wrong here
Signature-based detection is incorrect because it matches specific known attack patterns, not simple count-based rules.
- ✓
Rule-based detection
Why this is correct
Rule-based detection is correct because it uses a predefined rule (10 failed attempts in 5 minutes) to trigger an alert without adaptation.
- ✗
Behavior-based detection
Why it's wrong here
Behavior-based detection is incorrect because it focuses on user or entity behavioral profiles, not a raw count threshold.
Go deeper
Related to this question
About these practice questions
One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.