hardMultiple Choice
SSCP Practice Question: An analyst detects outbound traffic from a…
An analyst detects outbound traffic from a workstation to a known malicious IP address. The workstation is a developer machine with local admin rights. Which containment action should be taken first?
⚠ Common exam trap
SSCP often tests the order of containment actions, and candidates frequently pick 'shut down the machine' or 'block the IP' because they sound decisive — but the exam expects isolation first to preserve evidence and stop lateral movement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the workstation from the network
Isolating the workstation from the network is the correct first containment step because it stops any further command-and-control communication, lateral movement, or data exfiltration while preserving volatile memory and forensic artifacts for investigation. A developer machine with local admin rights is especially dangerous — the attacker could pivot, install persistence, or harvest credentials — so cutting network connectivity immediately limits blast radius without destroying evidence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Block the malicious IP on the firewall
Why it's wrong here
Blocking one IP address leaves the compromised workstation communicating through other command-and-control channels and does not stop the active intrusion. It is tempting because it is fast and low-impact, but firewall blocking suits known indicators rather than containing an already-compromised host.
- ✓
Isolate the workstation from the network
Why this is correct
Isolation immediately severs the command-and-control channel, halting data exfiltration and preventing lateral movement while the compromised developer machine retains its state for forensic examination. Because local admin rights could enable rapid credential theft or malware propagation, network isolation satisfies the stem's requirement for the fastest, least destructive containment action.
- ✗
Shut down the workstation immediately
Why it's wrong here
May destroy volatile evidence.
- ✗
Disable the user's domain account
Why it's wrong here
Disabling the domain account does not stop malware running under local credentials or SYSTEM on a machine with local admin rights, so the outbound traffic continues. It is tempting because account lockout is a standard response, but it addresses identity, not the infected endpoint itself.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.