SSCP Practice Test 17 — 15 Questions

Question 1

Refer to the exhibit. An organization's incident response policy defines these actions. In what sequence should these phases be applied?

Accepted Answer

Isolate, reimage, restore from backup. The correct sequence is Isolate, reimage, restore from backup because containment (isolation) must occur first to prevent the incident from spreading, followed by eradication (reimaging) to remove the threat, and finally recovery (restoring from backup) to return the system to a known good state. This aligns with the NIST SP 800-61 incident response lifecycle, where containment, eradication, and recovery are performed in that order.

Answer

Reimage, isolate, restore

Answer

Restore, isolate, reimage

Answer

Isolate, restore, reimage

Question 2

Which THREE steps are essential during the identification phase of incident response?

Accepted Answer

Monitor logs and alerts. Options A, B, and D are correct because identification involves monitoring logs and alerts (A), determining the scope and impact (B), and classifying the severity (D). Option C is part of eradication. Option E is part of communication, which may occur but is not essential to identification.

Answer

Eradicate the threat

Answer

Notify stakeholders

Question 3

A security analyst reviews a firewall log showing an internal IP attempting outbound connections to multiple external IPs on port 443. The analyst suspects command and control. Which additional data source would be MOST useful for confirmation?

Accepted Answer

DNS logs. DNS logs are the most useful additional data source because C2 traffic often uses domain generation algorithms (DGAs) or connects to known malicious domains. By correlating the outbound connections on port 443 with DNS queries, the analyst can identify suspicious domain lookups that precede the connections, revealing the C2 infrastructure. Unlike NetFlow or system logs, DNS logs directly show the domain names being resolved, which is a key indicator of C2 activity.

Answer

NetFlow data

Answer

System event logs

Answer

Antivirus logs

Question 4

After an incident, what is the primary purpose of a lessons learned meeting?

Accepted Answer

Improve future response. The primary purpose of a lessons learned meeting after an incident is to identify what worked well and what did not during the response, enabling the team to refine procedures, update playbooks, and improve future incident response effectiveness. This aligns with the continuous improvement cycle in incident management, as outlined in NIST SP 800-61 and ISO 27035, where the focus is on process enhancement rather than punitive measures.

Answer

Update security policies

Answer

Assign blame

Answer

Document findings for litigation

Question 5

A company uses a SIEM to detect anomalies. An alert indicates a user logged in from two geographically distant locations within 5 minutes. What is the most likely indication?

Accepted Answer

Credential theft and reuse. Option B is correct because such a scenario strongly suggests credential theft and reuse, where an attacker has obtained the user's credentials and is using them from a different location. Option A is less likely as insider threat would not typically require rapid geo-hopping. Option C is possible but less common. Option D would cause log inconsistencies but not typically this pattern.

Answer

Insider threat

Answer

Time synchronization issue

Answer

Misconfigured VPN

Question 6

Your organization has a mixed environment of Windows and Linux servers. You receive an alert from the EDR that a Linux server is beaconing to a suspicious IP. The server runs a critical application that cannot be taken offline. The security team needs to investigate while maintaining availability. You have access to a jump box with network monitoring tools. Which course of action is most appropriate?

Accepted Answer

Use packet capture on the server's network segment to analyze traffic, then use EDR to isolate the process. Option C is correct because it allows the security team to investigate the beaconing activity without disrupting the critical application's availability. Using packet capture on the server's network segment enables analysis of the outbound traffic to the suspicious IP, while EDR can isolate the specific malicious process without taking the entire server offline. This approach balances the need for containment with the requirement to maintain service continuity.

Answer

Immediately disconnect the server from the network to stop beaconing

Answer

Block the suspicious IP at the firewall and continue monitoring

Answer

Reimage the server from a known good backup

Question 7

What is the analyst's BEST next step?

Accepted Answer

Decode the command to analyze. Option C is correct because decoding the encoded PowerShell command will reveal the payload. Option A is premature without understanding the threat. Option B is less helpful. Option D may break legitimate functionality.

Answer

Isolate the system

Answer

Block PowerShell execution

Answer

Run a full antivirus scan

Question 8

After a ransomware attack, the recovery team restored systems from backups. However, some files remain encrypted. What is the most probable cause?

Accepted Answer

Backups were also encrypted. If backups were also encrypted, the recovery team would restore encrypted copies of the files, leaving them in an encrypted state after restoration. This occurs when the ransomware has sufficient privileges to encrypt the backup repository or when backups are stored on a mounted volume that the ransomware can access. The most probable cause is that the backup data itself was compromised, not that the restoration process failed.

Answer

The backup software was compromised

Answer

The ransomware had a delayed encryption mechanism

Answer

Restoration process skipped some file types

Question 9

A company detects ransomware on a file server. The ransomware is currently encrypting files. Which containment strategy should be implemented FIRST?

Accepted Answer

Disconnect the server from the network. Option C is correct because the immediate priority in ransomware containment is to isolate the compromised server from the network to prevent the encryption process from spreading to other systems. Disconnecting the network cable or disabling the network interface stops the ransomware from communicating with command-and-control servers and blocks lateral movement via SMB or other protocols. This containment step must occur before any remediation like antivirus scans or file restoration.

Answer

Run antivirus to remove the ransomware

Answer

Notify all users to change passwords

Answer

Restore files from backup

Question 10

To determine how malware initially infected a workstation, which artifact would be MOST useful?

Accepted Answer

Windows Event Log showing process creation. The Windows Event Log showing process creation (Event ID 4688) provides a chronological record of every executable that ran on the system, including the parent process and command-line arguments. This allows an investigator to trace the initial execution of the malware binary, identifying the exact moment and mechanism (e.g., a dropped file, a script launch, or a scheduled task) that triggered the infection. Other artifacts may indicate persistence or lateral movement, but only process creation logs directly capture the first execution event.

Answer

Prefetch files

Answer

Windows registry autorun keys

Answer

Web browser history

Question 11

A company's disaster recovery plan includes offsite tape backups. During a test, it is discovered that the tapes are stored at a location that shares the same power grid as the primary site. Which risk does this pose?

Accepted Answer

The tapes may be inaccessible during a power outage. Option A is correct because a regional power outage could affect both sites, making the tapes inaccessible. Option B is not specific to this risk. Option C is about media degradation, not power. Option D is about encryption, unrelated.

Answer

The tapes may degrade over time

Answer

The tapes are not encrypted

Answer

The recovery time may exceed the RTO

Question 12

A user reports that their computer is displaying a fake antivirus warning that demands payment. This is an example of which type of attack?

Accepted Answer

Scareware. Scareware is a type of malware that uses social engineering to trick users into believing their system is infected, then demands payment for a fake removal tool. The fake antivirus warning is a classic scareware tactic, as it creates urgency and fear to coerce payment, unlike ransomware which encrypts files and demands a ransom for decryption.

Answer

Social engineering

Answer

Ransomware

Answer

Phishing

Question 13

After an incident, the team identifies that the incident was caused by a missing security patch. Which of the following is the MOST effective way to prevent recurrence?

Accepted Answer

Implement a patch management policy. A missing security patch indicates a failure in the vulnerability management lifecycle. Implementing a patch management policy ensures that patches are systematically identified, tested, and deployed, directly addressing the root cause. This is the most effective preventive measure because it establishes a recurring process to close known vulnerabilities before they can be exploited.

Answer

Conduct phishing simulations

Answer

Increase network monitoring

Answer

Update the incident response plan

Question 14

Which TWO of the following are key components of an incident response plan (IRP) according to NIST SP 800-61?

Accepted Answer

Communication plan. NIST SP 800-61 (Computer Security Incident Handling Guide) explicitly identifies the communication plan and testing the plan as key components of an incident response plan. The communication plan ensures all stakeholders (internal teams, legal, PR, external partners) are notified and coordinated during an incident, while testing validates the plan's effectiveness through exercises like tabletop or functional drills.

Answer

Acquisition of forensic tools

Answer

Hardware inventory

Answer

Annual budget

Question 15

An alert shows a successful login from an unusual geographic location. Which of the following is the BEST initial response?

Accepted Answer

Disable the user account. Option A is correct because disabling the account immediately prevents further unauthorized access while the incident is investigated. Option B is premature without confirmation of compromise. Option C may be done after disabling. Option D is too slow as the first step.

Answer

Contact the user to verify the login

Answer

Block the source IP address

Answer

Reset the user's password

SSCP Practice Test 17 — 15 Questions

Exhibit

SSCP Practice Test 17 — 15 Questions

Exhibit