mediumMultiple ChoiceObjective-mapped
SSCP Practice Question: A security analyst notices that a user’s account…
A security analyst notices that a user’s account has been used to access sensitive files at 3:00 AM from an IP address outside the company’s country. The analyst suspects a compromised account. Which action should be taken FIRST?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable the user account immediately
The first step in incident response is to isolate the threat. Disabling the account prevents further unauthorized access while the investigation proceeds.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Block the external IP address in the firewall
Why it's wrong here
The attacker may use a different IP; the account itself is compromised.
- ✓
Disable the user account immediately
Why this is correct
Disabling the account stops all access from any source.
- ✗
Reset the user’s password and force a logout
Why it's wrong here
This may lock out the legitimate user and does not prevent the attacker if session tokens remain valid.
- ✗
Contact the user to verify if they were working late
Why it's wrong here
Delays response and may tip off an attacker.
Go deeper
Related to this question
About these practice questions
One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.