mediumMultiple ChoiceObjective-mapped
SSCP Practice Question: An alert shows a successful login from an unusual…
An alert shows a successful login from an unusual geographic location. Which of the following is the BEST initial response?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable the user account
Disabling the account immediately prevents further unauthorized access while the incident is investigated. Option B is premature without confirmation of compromise. Option C may be done after disabling. Option D is too slow as the first step.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Disable the user account
Why this is correct
Immediate containment to stop ongoing unauthorized access.
- ✗
Contact the user to verify the login
Why it's wrong here
Verification is important but should be done after containment to avoid delay.
- ✗
Block the source IP address
Why it's wrong here
Blocking IP alone does not prevent continued access if credentials are reused.
- ✗
Reset the user's password
Why it's wrong here
Resetting password is appropriate but disabling is faster and more secure as a first step.
Go deeper
Related to this question
About these practice questions
One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.