mediumMultiple ChoiceObjective-mapped
SSCP Practice Question: A security analyst notices that an employee's…
A security analyst notices that an employee's account has been sending large amounts of data to an external IP address during non-business hours. The analyst suspects the employee's credentials have been compromised. What is the FIRST step the analyst should take according to incident response procedures?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable the employee's user account.
Disabling the employee's user account immediately stops the unauthorized activity and prevents further data exfiltration, as per incident response procedures. Option A is wrong; blocking the external IP address may not stop the attacker if they have other methods or can change IPs. Option C is wrong; informing the manager is important but not the first action, as containment is the priority. Option D is wrong; contacting law enforcement is premature before containing the incident and gathering evidence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Block the external IP address at the firewall.
Why it's wrong here
Blocking the external IP address may be a containment step, but it is not the first step because the attacker could use other methods. Disabling the account is more direct.
- ✓
Disable the employee's user account.
Why this is correct
Disabling the employee's user account stops the unauthorized access and data exfiltration immediately, aligning with incident response containment procedures.
- ✗
Contact law enforcement.
Why it's wrong here
Contacting law enforcement is a later step after the incident is confirmed and contained; it is not the first action.
- ✗
Inform the employee's manager.
Why it's wrong here
Informing the employee's manager is important for communication but does not directly stop the threat; containment should occur first.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A system administrator notices that a user's account has been locked out multiple times within an hour. The admin reviews the logs and finds repeated failed login attempts from an unusual IP address. What is the BEST immediate action to mitigate further risk?
medium- ✓ A.Disable the user account
- B.Delete the failed login log entries
- C.Implement a firewall rule to block the IP address
- D.Reset the user's password
Why A: The best immediate action is to disable the user account, as it stops any further unauthorized access while the incident is investigated. Deleting logs (B) destroys evidence, implementing a firewall rule (C) may help but does not address the compromised account, and resetting the password (D) is premature without verifying the account's integrity.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.