The answer is a user reporting mechanism. This is correct because detective controls for phishing are designed to identify attacks that have already bypassed preventive measures, such as a user recognizing a suspicious link or attachment in their inbox. A user reporting mechanism enables individuals to flag suspected phishing emails after receipt, allowing the security team to investigate and respond, which aligns with the definition of a detective control—discovering incidents that have already occurred rather than blocking them. On the Systems Security Certified Practitioner SSCP exam, this concept tests your ability to distinguish between preventive controls (like email filters) and detective controls (like user reporting), a common trap where candidates confuse reporting with prevention. Remember, if the control relies on human recognition after the event, it is detective. Memory tip: “Report after receipt” to recall that user reporting detects phishing that has already landed.
SSCP Risk Identification, Monitoring and Analysis Practice Question
This SSCP practice question tests your understanding of risk identification, monitoring and analysis. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An organization's risk register shows a high risk for phishing attacks. Which controls are considered detective controls for this risk?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
User reporting mechanism.
A user reporting mechanism is a detective control because it enables users to identify and report suspected phishing emails after they have been received, allowing the security team to investigate and respond. Unlike preventive controls that block attacks, detective controls discover incidents that have already occurred, such as a user recognizing a malicious link or attachment in their inbox.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Security awareness training.
Why it's wrong here
Training is a preventive/deterrent control, not detective.
✗
Email filtering.
Why it's wrong here
Email filtering is a preventive control that blocks phishing emails before they reach users.
✓
User reporting mechanism.
Why this is correct
User reporting detects phishing attacks that have reached users, enabling response.
Related concept
Read the scenario before looking for a memorised answer.
✗
Multi-factor authentication.
Why it's wrong here
MFA is a preventive control that protects accounts even if credentials are phished.
Common exam traps
Common exam trap: answer the scenario, not the keyword
ISC2 often tests the distinction between preventive and detective controls, and the trap here is that candidates confuse 'user reporting' as a reactive or corrective control rather than recognizing it as a detective control that identifies an ongoing or past incident.
Detailed technical explanation
How to think about this question
A user reporting mechanism typically integrates with a Security Information and Event Management (SIEM) system or a phishing analysis platform via APIs (e.g., Microsoft 365's built-in report message add-in or Proofpoint's suspicious mail reporting). When a user clicks 'Report Phishing,' the email is forwarded to a quarantine mailbox, headers and attachments are analyzed using sandboxing and URL reputation checks, and the incident is logged with a unique case ID for tracking. In real-world scenarios, this control is critical for detecting targeted spear-phishing that bypasses filters, as human intuition often catches subtle social engineering cues that automated systems miss.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
An employee at a financial services firm receives an email that appears to come from the IT helpdesk, asking them to reset their password via a link. The link leads to a convincing fake portal that harvests credentials. Security teams use phishing simulations and security-awareness training to reduce this attack vector. Questions like this test whether you can identify social engineering techniques and appropriate controls.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Risk Identification, Monitoring and Analysis — This question tests Risk Identification, Monitoring and Analysis — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: User reporting mechanism. — A user reporting mechanism is a detective control because it enables users to identify and report suspected phishing emails after they have been received, allowing the security team to investigate and respond. Unlike preventive controls that block attacks, detective controls discover incidents that have already occurred, such as a user recognizing a malicious link or attachment in their inbox.
What should I do if I get this SSCP question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.