easyMultiple ChoiceObjective-mapped
SSCP Practice Question: Refer to the exhibit
Exhibit
Jan 15 10:35:22 192.168.1.1 10.0.0.2 TCP_SYN 192.168.1.100:31456 -> 10.0.0.2:3389 Jan 15 10:35:22 192.168.1.1 10.0.0.2 TCP_SYN_ACK 10.0.0.2:3389 -> 192.168.1.100:31456 Jan 15 10:35:23 192.168.1.1 10.0.0.2 TCP_ACK 192.168.1.100:31456 -> 10.0.0.2:3389 Jan 15 10:35:24 192.168.1.1 10.0.0.2 TCP_FIN 192.168.1.100:31456 -> 10.0.0.2:3389
Refer to the exhibit. An analyst sees these logs and is concerned about a potential attack. What is the most likely scenario?
⚠ Common exam trap
The trap here is that candidates see a single connection to a common service and assume it is a brute force or scan, but the key is the 'successful' indicator—brute force attacks show failures, and scans show multiple attempts, not a single established session.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Successful RDP connection
The log shows a successful RDP connection (source IP 10.0.0.5, destination port 3389, with 'Session established' or similar success indicator). RDP is a common target for lateral movement after initial compromise, and a single successful connection from an external IP to an internal host is a strong indicator of an attacker gaining remote access, not a brute force attempt (which would show multiple failures) or a scan (which would show many ports).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Denial of service (DoS)
Why it's wrong here
A DoS would flood with SYNs without completing handshakes, leading to incomplete connections.
- ✗
SSH brute force
Why it's wrong here
SSH uses port 22, not 3389, and brute force would show multiple authentication attempts, not just a handshake.
- ✓
Successful RDP connection
Why this is correct
The full handshake and FIN indicate a normal RDP session to port 3389.
- ✗
Port scan
Why it's wrong here
A port scan typically shows multiple SYNs to different ports with incomplete handshakes.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.