hardMultiple ChoiceObjective-mapped
SSCP Practice Question: Your organization has a mixed environment of…
Your organization has a mixed environment of Windows and Linux servers. You receive an alert from the EDR that a Linux server is beaconing to a suspicious IP. The server runs a critical application that cannot be taken offline. The security team needs to investigate while maintaining availability. You have access to a jump box with network monitoring tools. Which course of action is most appropriate?
⚠ Common exam trap
It's easy for candidates to choose immediate disconnection (Option A) as a reflexive containment action, failing to recognize that the question explicitly requires maintaining availability for a critical application that cannot be taken offline.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use packet capture on the server's network segment to analyze traffic, then use EDR to isolate the process
It allows the security team to investigate the beaconing activity without disrupting the critical application's availability. Using packet capture on the server's network segment enables analysis of the outbound traffic to the suspicious IP, while EDR can isolate the specific malicious process without taking the entire server offline. This approach balances the need for containment with the requirement to maintain service continuity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Immediately disconnect the server from the network to stop beaconing
Why it's wrong here
Disconnecting would halt the critical application, violating availability.
- ✗
Block the suspicious IP at the firewall and continue monitoring
Why it's wrong here
Blocking the IP prevents further beaconing but does not remove the threat from the server.
- ✓
Use packet capture on the server's network segment to analyze traffic, then use EDR to isolate the process
Why this is correct
This allows investigation and containment without taking the server offline.
- ✗
Reimage the server from a known good backup
Why it's wrong here
Reimaging would cause significant downtime and may not be necessary if the threat can be contained.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.