SSCP Security Operations and Administration Practice Question
An organization is implementing configuration management and wants to detect unauthorized changes to server configurations. Which of the following tools would be most effective for this purpose?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SIEM with change detection rules
SIEM (Security Information and Event Management) systems can collect and correlate logs from various sources. When configured with rules to detect configuration changes, such as modifications to registry keys or system files, a SIEM can generate alerts on unauthorized changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configuration management database (CMDB)
Why it's wrong here
A CMDB stores configuration information but does not actively detect changes; it is a repository, not a monitoring tool.
- ✓
SIEM with change detection rules
Why this is correct
A SIEM can aggregate logs and trigger alerts on specific configuration changes, making it effective for deviation detection.
- ✗
Vulnerability scanner
Why it's wrong here
Vulnerability scanners identify known vulnerabilities but do not continuously monitor configuration changes.
- ✗
Patch management tool
Why it's wrong here
Patch management tools deploy updates but do not typically detect configuration changes.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.