SSCP Incident Response and Recovery Practice Question
During a post-incident review, the incident response team identifies that the mean time to detect (MTTD) was 14 days. Which improvement would most directly reduce MTTD?
⚠ Common exam trap
Candidates often confuse detection speed (MTTD) with prevention or recovery metrics, mistakenly thinking that improving backups (Option D) or access controls (Option A) will help detect incidents faster, when in fact they address different phases of the incident response lifecycle.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploying additional endpoint detection and response (EDR) sensors with automated alerting
Deploying additional EDR sensors with automated alerting directly reduces the time between an incident's occurrence and its detection by providing continuous monitoring and immediate notification of suspicious activities. This shortens the MTTD because automated alerts eliminate the delay inherent in manual log review or periodic checks, enabling the incident response team to react within minutes rather than days.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implementing stricter access control policies
Why it's wrong here
Stricter access control policies reduce the likelihood of unauthorised entry but generate no telemetry that surfaces an in-progress compromise, so the 14-day detection gap persists. They are tempting because access control is a core SSCP domain, and would be correct for reducing attack surface, but MTTD requires log correlation and alerting.
- ✗
Conducting more frequent tabletop exercises
Why it's wrong here
Tabletop exercises rehearse response roles and decision-making after an incident is already known, so they shorten containment and recovery rather than the interval before detection. They are tempting because exercises improve incident handling maturity, and would be right for reducing mean time to respond, but MTTD depends on monitoring and alerting coverage.
- ✓
Deploying additional endpoint detection and response (EDR) sensors with automated alerting
Why this is correct
EDR sensors with automated alerting detect malicious endpoint behaviour in near real time, collapsing the 14-day detection gap. Faster telemetry and alert generation directly shorten the time between compromise and discovery, which is precisely what MTTD measures.
- ✗
Increasing the frequency of full system backups
Why it's wrong here
Backups restore data after loss; they generate no telemetry, so detection time stays at 14 days. The tempting pull is that backups feel like incident readiness, and they are the right control for ransomware recovery or disaster recovery objectives, but MTTD falls only through logging, alerting and monitoring coverage.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.