SSCP Risk Identification, Monitoring, and Analysis Practice Question
A security operations center uses a SIEM to monitor authentication activity. The team wants to detect a password spraying campaign in which a single source attempts a small number of common passwords against many different user accounts, staying below the per-account lockout threshold. Which correlation approach would BEST detect this activity?
⚠ Common exam trap
The trap here is applying a per-account lockout-style threshold, which spraying is explicitly designed to stay beneath, instead of correlating across many accounts from one source.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Alert when one source IP generates failed logons against many distinct accounts within a short window
Password spraying avoids per-account lockout by trying common passwords against many accounts with only a few attempts each. The distinguishing signal is one source address generating failures across a large number of distinct accounts in a short period. Correlating failed authentications by source and counting unique usernames over a time window surfaces that horizontal pattern, whereas per-account or global thresholds do not.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Alert when a user authenticates successfully from a country where the organization has no offices
Why it's wrong here
Impossible travel and geo-anomaly rules address compromised credentials used from unexpected locations, which is a different detection objective. A spraying campaign may originate from a single plausible region and may not succeed at all, so geographic rules would not reliably surface the distributed failed-authentication pattern that defines this attack.
- ✓
Alert when one source IP generates failed logons against many distinct accounts within a short window
Why this is correct
Password spraying is characterized by a single source touching numerous distinct accounts with few attempts each. Correlating failed authentication events by source address and counting unique targeted accounts over a short interval detects the horizontal pattern that per-account thresholds cannot see, which is why this approach best identifies the campaign described.
- ✗
Alert when any single account exceeds five failed logons within ten minutes
Why it's wrong here
This rule targets brute force against one account and would miss spraying entirely, because the attacker deliberately keeps each account's failure count below the lockout threshold. Password spraying succeeds precisely by distributing attempts across many accounts, so a per-account threshold rule generates no alerts during the attack and leaves the campaign undetected.
- ✗
Alert when total failed logons across the environment exceed a fixed daily count
Why it's wrong here
A global daily threshold is dominated by routine user error and produces alerts long after the activity occurred, with no attribution to a source or target set. It cannot distinguish a spraying campaign from ordinary mistyped passwords, so it fails to provide the specific, timely detection the security operations center needs.
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.