The answer is deploying a Security Information and Event Management (SIEM) system with automated alerting. This is the most effective solution because a SIEM system aggregates logs from the EHR system and applies correlation rules to detect patterns indicative of unauthorized access, such as an employee viewing records outside their department or during off-hours, generating real-time alerts that allow the security team to respond promptly rather than being overwhelmed by manual log review. On the Systems Security Certified Practitioner SSCP exam, this scenario tests your understanding of log management and monitoring controls within the domain of Security Operations and Administration, specifically how SIEM addresses HIPAA compliance requirements for timely detection of unauthorized PHI access. A common trap is choosing a simple log retention tool or manual auditing process, which fails to solve the core problem of delayed detection and log volume. Memory tip: think of SIEM as your “security alarm” for logs—it doesn’t just store the footage, it screams when something looks wrong.
SSCP Security Operations and Administration Practice Question
This SSCP practice question tests your understanding of security operations and administration. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
You work for a hospital that has recently transitioned to an electronic health record (EHR) system. The system stores protected health information (PHI) and must comply with HIPAA. The hospital's security policy requires that all access to PHI be logged and that any unauthorized access be detected promptly. The IT department has implemented logging on the EHR system, but the security team is overwhelmed by the volume of logs and cannot review them in a timely manner. Additionally, there have been incidents where employees accessed patient records without a legitimate need, but these were only discovered months later during random audits. The hospital needs to improve its detection capabilities. Which of the following is the most effective solution?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a Security Information and Event Management (SIEM) system with automated alerting.
A SIEM system aggregates logs from the EHR system and applies correlation rules to detect patterns indicative of unauthorized access, such as an employee viewing records outside their department or during off-hours. It generates real-time alerts, enabling the security team to respond promptly rather than relying on manual log review. This directly addresses the problem of being overwhelmed by log volume and delayed detection.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Deploy a Security Information and Event Management (SIEM) system with automated alerting.
Why this is correct
SIEM aggregates logs, detects anomalies, and alerts in real time, improving detection.
Related concept
Read the scenario before looking for a memorised answer.
✗
Retain logs for a longer period to allow more thorough audits.
Why it's wrong here
Longer retention does not help with timely detection.
✗
Assign additional staff to manually review logs on a daily basis.
Why it's wrong here
Manual review is not scalable and still subject to delays.
✗
Increase the verbosity of logging to capture more details.
Why it's wrong here
More logs worsen the overload without automated analysis.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may think increasing log verbosity or retention improves detection, but without automated analysis, more data only worsens the signal-to-noise ratio and delays incident discovery.
Detailed technical explanation
How to think about this question
A SIEM system works by normalizing logs from diverse sources into a common format (e.g., CEF or LEEF) and applying correlation rules that can detect a sequence of events, such as a user authenticating from an unusual IP followed by accessing a high-value patient record. Real-world SIEM deployments often use machine learning-based user and entity behavior analytics (UEBA) to establish baselines and flag anomalies, such as a nurse accessing records of patients not assigned to their unit. The key is that SIEM reduces mean time to detect (MTTD) from months to minutes.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A SOC analyst notices unusual lateral movement in the network at 2 AM. The IR playbook dictates: identify and contain (isolate the affected machine), then eradicate (remove the malware), then recover (restore from backup), then document. Skipping containment before eradication risks the attacker regaining access. Questions like this test the sequence and rationale of incident response phases.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Security Operations and Administration — This question tests Security Operations and Administration — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Deploy a Security Information and Event Management (SIEM) system with automated alerting. — A SIEM system aggregates logs from the EHR system and applies correlation rules to detect patterns indicative of unauthorized access, such as an employee viewing records outside their department or during off-hours. It generates real-time alerts, enabling the security team to respond promptly rather than relying on manual log review. This directly addresses the problem of being overwhelmed by log volume and delayed detection.
What should I do if I get this SSCP question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.