SSCP Practice Test 31 — 15 Questions

Question 1

A company's backup strategy includes weekly full backups and daily differential backups. A ransomware attack occurred on Wednesday, corrupting data. The last full backup was Sunday. Which backup set should be restored first?

Accepted Answer

Sunday full backup. The correct restoration order is to first restore the Sunday full backup, because differential backups contain all changes since the last full backup. Without the full backup as a base, the differential backups cannot be applied. After restoring the full backup, you would then apply the most recent differential backup (Wednesday) to bring the data to the point just before the attack.

Answer

Wednesday differential backup

Answer

Monday differential backup

Answer

Tuesday differential backup

Question 2

After containing a malware outbreak, the incident response team needs to ensure the malware is completely removed from all systems. Which phase of the incident response process is this?

Accepted Answer

Eradication. The eradication phase is specifically focused on removing the root cause of the incident, such as deleting malware files, registry keys, and disabling malicious services from all affected systems. After containment (which stops the spread), eradication ensures the threat is completely eliminated before recovery begins. This aligns with the NIST SP 800-61 incident response lifecycle, where eradication follows containment and precedes recovery.

Answer

Post-Incident

Answer

Detection

Answer

Recovery

Question 3

A company's IDS generated an alert for a suspicious outbound connection to a known C2 server. The incident team discovers the host has been communicating for 2 weeks. Which containment strategy is most appropriate?

Accepted Answer

Perform memory forensics before disconnecting. Performing memory forensics before disconnecting (A) is the most appropriate containment strategy because the host has been compromised for two weeks, meaning the attacker may have deployed rootkits, injected malicious code into system processes, or established persistence mechanisms that reside only in volatile memory. Disconnecting or shutting down the host immediately would destroy this volatile evidence, hindering the incident response team's ability to identify the full scope of the compromise, including the specific malware variant, C2 communication methods, and any lateral movement artifacts. Memory forensics allows the team to capture running processes, network connections, and loaded kernel modules, which are critical for understanding the attacker's tactics and preventing future incidents.

Answer

Block the C2 IP at the perimeter

Answer

Shut down the host

Answer

Disconnect the host from the network immediately

Question 4

A company's incident response plan includes a requirement to notify law enforcement within 24 hours of certain security incidents. Which regulation most likely mandates this requirement?

Accepted Answer

PCI DSS. PCI DSS Requirement 12.10.1 mandates that the incident response plan includes specific procedures to notify law enforcement within 24 hours of detecting a breach involving cardholder data. This is because PCI DSS is a contractual security standard for entities that handle payment card information, and timely law enforcement notification is critical for forensic investigation and legal compliance in payment card fraud cases.

Answer

SOX

Answer

GDPR

Answer

HIPAA

Question 5

An organization suspects a security incident. Which initial step should the incident response team take?

Accepted Answer

Protect evidence. The initial step in incident response is to protect evidence (Option B) because preserving forensic data ensures the integrity of logs, memory dumps, and disk images for later analysis. According to NIST SP 800-61, the first priority after detection is to secure volatile data (e.g., RAM, network connections) before it is lost, which is critical for determining the scope and root cause of the incident.

Answer

Contain the incident

Answer

Identify the attacker

Answer

Notify law enforcement

Question 6

A company is developing an incident response plan. Which of the following stakeholders should be included in the initial planning phase?

Accepted Answer

Business unit leaders. Business unit leaders (Option D) are essential in the initial planning phase because they define the critical assets, operational priorities, and recovery time objectives (RTOs) that shape the incident response strategy. Without their input, the plan may fail to align with business continuity requirements, leading to ineffective resource allocation during an actual incident.

Answer

External legal counsel

Answer

Internal audit

Answer

Only IT staff

Question 7

During a forensic investigation, you find that the attacker used a legitimate Windows tool to exfiltrate data. Which tool is commonly abused for this purpose?

Accepted Answer

PowerShell. PowerShell is a legitimate Windows administrative tool that attackers commonly abuse for data exfiltration because it provides native access to network protocols (e.g., HTTP, HTTPS, FTP, SMB) and can download/upload files directly from the command line without additional binaries. Its deep integration with the Windows operating system allows scripts to run in memory, bypassing traditional file-based detection mechanisms, making it a favored tool for post-exploitation data theft.

Answer

Telnet

Answer

Netcat

Answer

FTP

Question 8

Which TWO actions are part of the containment phase of incident response?

Accepted Answer

Applying temporary patches. During the containment phase of incident response, the immediate priority is to stop the incident from spreading or causing further damage. Applying temporary patches (C) can quickly close a vulnerability that is being exploited, while isolating affected systems (D) prevents lateral movement and further compromise. Both actions are short-term measures to contain the threat before eradication and recovery begin.

Answer

Restoring from backups

Answer

Analyzing root cause

Answer

Preserving evidence

Question 9

If the web server is compromised, which of the following is a likely immediate risk?

Accepted Answer

Direct compromise of the database server. When a web server is compromised, the immediate risk is direct compromise of the database server because the web server typically holds the database credentials (e.g., in a configuration file like wp-config.php or appsettings.json) and has a trusted network path to the database. An attacker can pivot from the web server to the database server using those credentials, often over port 3306 (MySQL) or 1433 (MSSQL), without needing to bypass additional authentication.

Answer

Loss of web application data

Answer

Denial of service to the web server

Answer

Compromise of user credentials

Question 10

Which TWO roles are typically part of an incident response team?

Accepted Answer

Incident Manager. The Incident Manager (C) is the central coordinator who manages the incident response process, ensures communication among stakeholders, and makes strategic decisions during an incident. The Forensic Analyst (D) is responsible for collecting, preserving, and analyzing digital evidence in a forensically sound manner, often using tools like FTK Imager or EnCase to maintain chain of custody. Both roles are essential for a structured and legally defensible incident response.

Answer

Chief Financial Officer

Answer

Network Administrator

Answer

Legal Counsel

Question 11

During incident analysis, a forensic examiner finds that the system logs were cleared using a command that writes null bytes. Which artifact is most likely preserved?

Accepted Answer

Volume shadow copies. Volume shadow copies (VSS) are snapshots of the file system at a point in time, stored separately from the active logs. Even if an attacker clears logs by writing null bytes (e.g., using `fsutil` or `wevtutil cl`), VSS may retain a previous version of the logs, making them a critical artifact for forensic recovery.

Answer

Event logs from other systems

Answer

Prefetch files

Answer

Registry keys

Question 12

An organization experiences a ransomware attack that encrypts critical data. The incident response team isolates affected systems. What is the NEXT step?

Accepted Answer

Identify the root cause. After isolating affected systems to contain the ransomware, the next step is to identify the root cause (e.g., how the ransomware entered, which vulnerability was exploited, or which user account was compromised). This aligns with the NIST SP 800-61 incident response lifecycle, where identification and analysis precede eradication and recovery. Without determining the root cause, reimaging or restoring from backup risks reinfection or missing a persistent backdoor.

Answer

Reimage systems

Answer

Notify law enforcement

Answer

Restore from backup

Question 13

During forensic analysis, which THREE pieces of evidence should be preserved in original form?

Accepted Answer

Network traffic capture. Network traffic captures (e.g., PCAP files) are raw, bit-for-bit recordings of network packets. They preserve the original timing, headers, and payloads without any transformation, which is critical for accurate forensic reconstruction and chain of custody. Any conversion or export (like CSV) would strip metadata and alter the original evidence.

Answer

Screenshots of malware dialogs

Answer

System event logs exported to CSV

Question 14

A security analyst receives an alert indicating a large number of failed login attempts from a single IP. The analyst blocks the IP. What should be done next?

Accepted Answer

Conduct a thorough investigation. Option C is correct because blocking an IP address is an immediate containment action, but it does not confirm the root cause or scope of the incident. A thorough investigation is required to determine whether the failed logins were part of a brute-force attack, credential stuffing, or a misconfigured service, and to check for indicators of compromise (IoCs) such as successful logins from the same IP or lateral movement. Without investigation, the analyst risks missing a broader breach or violating incident response procedures like those outlined in NIST SP 800-61.

Answer

Report to management

Answer

Update the firewall rules

Answer

Monitor for recurrence

Question 15

A network security team is implementing a defense-in-depth strategy. Which three layers should be included? (Choose three.)

Accepted Answer

Intrusion Detection System (IDS). An Intrusion Detection System (IDS) is a key layer in defense-in-depth because it monitors network traffic for suspicious activity and known attack signatures, providing visibility and alerting when perimeter defenses like firewalls are bypassed. It operates by analyzing packets against a rule set (e.g., Snort rules) and generating alerts, enabling a response before damage escalates. This adds a detection layer that complements preventive controls, ensuring that even if an attacker penetrates the outer defenses, the breach is identified.

Answer

Single sign-on (SSO)

Answer

Physical security controls