easyMultiple ChoiceObjective-mapped
SSCP Practice Question: A small financial services company has deployed a…
A small financial services company has deployed a SIEM solution collecting logs from their firewall, web server, and domain controller. They also have an IDS monitoring the network perimeter. The security analyst receives an alert from the IDS indicating a potential exploit attempt against the web server from an external IP. The analyst checks the SIEM and sees that the firewall log shows the connection was allowed, but the web server log does not show any corresponding request. The domain controller logs show no abnormal activity. The company has a policy to immediately contain any confirmed threats. What should the analyst do first based on this information?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify the web server's integrity by checking for filesystem changes or anomalous processes
The IDS alert indicates a possible exploit, but the missing web server log suggests the request may have been blocked or the IDS generated a false positive. However, the firewall allowed the connection, so it is possible the traffic reached the web server but the log entry is missing or delayed. The safest first step is to verify the web server's integrity by checking for signs of compromise (Option C). Immediately blocking the external IP (Option B) might disrupt legitimate traffic if the alert is false. Rebooting (Option A) could destroy forensic evidence. Escalating (Option D) without verification wastes time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reboot the web server to clear any potential memory-resident malware
Why it's wrong here
Rebooting may destroy volatile evidence and is not the first step in containment.
- ✗
Block the external IP at the firewall
Why it's wrong here
Blocking without verification may cause unnecessary disruption if the alert is a false positive.
- ✓
Verify the web server's integrity by checking for filesystem changes or anomalous processes
Why this is correct
The missing log entry could be an anomaly; checking the server ensures no compromise occurred.
- ✗
Escalate the alert to the incident response team
Why it's wrong here
Escalation is appropriate after initial verification; doing it first skips critical triage.
Go deeper
Related to this question
About these practice questions
One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.