SSCP Incident Response and Recovery — 30 Questions

Question 1

A security analyst detects unusual outbound traffic from a server that normally communicates only with internal systems. The firewall logs show connections to an external IP address on port 443/tcp. Which incident response step should the analyst perform FIRST?

Accepted Answer

Isolate the server from the network.. The unusual outbound traffic to an external IP on port 443/tcp from a server that normally only communicates internally indicates a potential compromise, such as a command-and-control (C2) channel. The first priority in incident response is containment to prevent further data exfiltration or lateral movement, and isolating the server from the network achieves this without destroying volatile evidence. Shutting down the server or running an antivirus scan could destroy memory-resident malware or forensic artifacts, violating the order of volatility.

Answer

Run a full antivirus scan on the server.

Answer

Immediately shut down the server.

Answer

Disconnect the entire network segment.

Question 2

During a security incident, the IR team collects memory dumps from an infected workstation. The analysis reveals a process injecting code into 'svchost.exe'. Which technique is most likely being used?

Accepted Answer

DLL injection. DLL injection is the most likely technique because it involves a process loading a malicious DLL into the address space of a legitimate process like svchost.exe. This is typically achieved using Windows API calls such as CreateRemoteThread and LoadLibrary, allowing the attacker to execute code within the trusted svchost.exe context, evading detection by blending in with legitimate system processes.

Answer

Process hollowing

Answer

Reflective DLL injection

Answer

Token stealing

Question 3

A company's incident response plan includes a step to preserve evidence. Which action BEST ensures the integrity of forensic evidence?

Accepted Answer

Create a forensic image with write blocker and hash. Option D is correct because creating a forensic image with a write blocker ensures that the original data is not altered during acquisition, and hashing (e.g., SHA-256) provides a cryptographic integrity check that can later verify the image is an exact bit-for-bit copy. This preserves the chain of custody and admissibility of evidence in legal proceedings.

Answer

Turn off the system immediately

Answer

Copy files to a network share

Answer

Run a checksum on the live system

Question 4

After a ransomware attack, the recovery team must restore encrypted files from backups. The backups are stored on a separate network segment and were last verified three days ago. What should the team do FIRST?

Accepted Answer

Verify the integrity and cleanliness of the backup.. Before restoring, ensure the backup system is not compromised. Option B is correct. Option A may restore malware; Option C is premature; Option D is not a first step.

Answer

Disconnect the infected systems from the network.

Answer

Contact law enforcement.

Answer

Restore all files from the most recent backup.

Question 5

During a security incident, the IR team discovers that an attacker used a valid user account to access sensitive data. The account had multifactor authentication (MFA) enabled. Which attack technique most likely bypassed the MFA?

Accepted Answer

MFA fatigue attack. MFA fatigue attacks exploit user behavior by bombarding the victim with repeated push notifications until they inadvertently approve an authentication request. Since the attacker already has the valid credentials, they trigger the MFA prompt repeatedly, and the user eventually accepts, granting the attacker access without needing to compromise the MFA mechanism itself.

Answer

Session hijacking

Answer

Man-in-the-middle (MITM) attack

Answer

Token theft from the endpoint

Question 6

A security analyst is reviewing logs and finds multiple failed login attempts from an external IP address followed by a successful login. Which type of attack is most likely occurring?

Accepted Answer

Brute force attack. A brute force attack involves systematically trying all possible password combinations until the correct one is found. The log pattern of multiple failed attempts from a single external IP followed by a success is the classic signature of a brute force attack, as the attacker iterates through a password list or character space against the same username.

Answer

Password spraying

Answer

Credential stuffing

Answer

Social engineering

Question 7

An organization's incident response plan is tested annually. After a real incident, the team finds that the plan did not address cloud-based assets. What is the BEST action?

Accepted Answer

Update the incident response plan to include cloud scenarios. The plan should be updated to include cloud assets. Option D is correct. Option A only addresses the symptom; Option B may be unnecessary; Option C adds complexity.

Answer

Migrate all cloud assets back on-premises

Answer

Retrain the IR team on cloud incident response

Answer

Create a separate cloud incident response plan

Question 8

Which TWO actions are appropriate during the containment phase of incident response?

Accepted Answer

Isolating the affected system from the network. During the containment phase of incident response, the primary goal is to stop the incident from spreading and to limit damage. Isolating the affected system from the network (Option C) immediately prevents lateral movement of the threat and further data exfiltration. Blocking malicious IP addresses at the firewall (Option D) is another containment action that cuts off communication with known command-and-control servers or attack sources, effectively containing the network-level impact.

Answer

Restoring data from backups

Answer

Removing malware from the system

Answer

Analyzing the root cause of the incident

Question 9

Which THREE types of evidence are MOST important to collect from a compromised Linux server during forensic acquisition?

Accepted Answer

List of running processes. A is correct because capturing a list of running processes from a compromised Linux server preserves volatile evidence of active malicious processes, such as reverse shells or cryptominers, that would be lost on shutdown. This aligns with the order of volatility (RFC 3227), which prioritizes capturing volatile data like process lists before acquiring less volatile evidence like disk images.

Answer

Full disk image

Answer

Network packet captures

Question 10

Which TWO components are essential for an effective disaster recovery plan (DRP)?

Accepted Answer

Recovery Point Objective (RPO). The Recovery Point Objective (RPO) defines the maximum acceptable data loss measured in time, which directly determines the required backup frequency and data replication strategy. Without an RPO, the DRP cannot specify how much data can be lost, making it impossible to design appropriate backup and recovery mechanisms. This metric is essential because it drives the technical implementation of data protection, such as snapshot intervals or synchronous replication.

Answer

Automated failover system

Answer

Business Impact Analysis (BIA)

Answer

Redundant array of independent disks (RAID)

Question 11

A security analyst reviews the firewall log exhibit. Which type of activity is indicated?

Accepted Answer

Brute force attack against RDP service. The firewall log shows repeated failed RDP (TCP/3389) connection attempts from a single external IP to a single internal IP within a short time window. This pattern of multiple authentication failures against the same service is characteristic of a brute force attack, where an attacker systematically tries common passwords to gain unauthorized access to the RDP service.

Answer

Port scan of the internal network

Answer

Data exfiltration to an external server

Answer

Normal administrative remote access

Question 12

A security analyst sees the event log exhibit. What does this indicate?

Accepted Answer

A remote attacker attempted to log on as Administrator. The event log shows multiple failed logon attempts for the built-in Administrator account from a remote IP address (e.g., 10.0.0.5) using different passwords, which is a classic brute-force attack pattern. Event ID 4625 (Windows Security Log) with Logon Type 3 (Network logon) and a non-zero workstation name or source network address confirms the attempts originated remotely, not from the console. This indicates a remote attacker is systematically trying to guess the Administrator password.

Answer

A local user typed wrong password at the console

Answer

An attacker used a nonexistent account

Answer

The Administrator account is locked out

Question 13

You are the incident response lead for a medium-sized financial services company. The company uses a hybrid infrastructure with on-premises servers (Active Directory, file shares, and a SQL database) and cloud services (Office 365, Azure VMs). At 2:00 PM on a Tuesday, the helpdesk receives multiple calls that users cannot access the file shares. Simultaneously, the SOC alerts on unusual outbound traffic from the domain controller (DC) to an external IP on port 443. The DC is also running a scheduled antivirus scan. The file server (FS) shows no signs of compromise but is responding slowly. The backup system reports that last night's backup of the DC failed due to a 'volume shadow copy error'. The backup of the FS succeeded. You need to take immediate action. What should you do FIRST?

Accepted Answer

Isolate the domain controller from the network.. The domain controller (DC) is showing signs of active compromise: unusual outbound traffic on port 443 (likely C2 communication) and a failed backup due to a volume shadow copy error (indicating attempted destruction of forensic evidence). Isolating the DC first stops the attacker's command-and-control channel and prevents lateral movement, which is the highest priority in incident response. Running a scan or restoring other systems before containment risks allowing the attacker to spread or destroy more data.

Answer

Run a full malware scan on the domain controller.

Answer

Restore the file server from last night's backup.

Answer

Disable the domain controller's antivirus to improve performance.

Question 14

Drag and drop the steps for performing a risk assessment according to NIST SP 800-30 into the correct order.

Question 15

Match each incident response phase to its activity.

Question 16

An alert shows a successful login from an unusual geographic location. Which of the following is the BEST initial response?

Accepted Answer

Disable the user account. Option A is correct because disabling the account immediately prevents further unauthorized access while the incident is investigated. Option B is premature without confirmation of compromise. Option C may be done after disabling. Option D is too slow as the first step.

Answer

Contact the user to verify the login

Answer

Block the source IP address

Answer

Reset the user's password

Question 17

Which backup strategy is MOST suitable for a server with an RTO of 4 hours and an RPO of 15 minutes?

Accepted Answer

Full backup daily, transaction log backup every 15 minutes. A full backup daily combined with transaction log backups every 15 minutes meets the RPO of 15 minutes by allowing point-in-time recovery to within that window, and the full backup ensures the RTO of 4 hours is achievable because restoring the full backup plus the transaction logs is a well-understood process that can complete within the time limit. Transaction log backups capture every committed change, enabling granular recovery without requiring a full backup more frequently.

Answer

Full backup daily

Answer

Full backup monthly, incremental daily

Answer

Full backup weekly, differential daily

Question 18

During an incident response, a forensic analyst captures a memory dump from a compromised server. Which of the following is the MOST important step to ensure the integrity of the evidence?

Accepted Answer

Create a cryptographic hash of the memory dump before analysis. Option B is correct because creating a cryptographic hash immediately after capture provides a fingerprint to prove the evidence hasn't been altered. Option A is unsafe. Option C is unnecessary and could alter the dump. Option D is not applicable to memory captures.

Answer

Use a write blocker when capturing the memory dump

Answer

Store the memory dump on the same server for easy access

Answer

Run antivirus on the memory dump file

Question 19

A company detects ransomware on a file server. The ransomware is currently encrypting files. Which containment strategy should be implemented FIRST?

Accepted Answer

Disconnect the server from the network. Option C is correct because the immediate priority in ransomware containment is to isolate the compromised server from the network to prevent the encryption process from spreading to other systems. Disconnecting the network cable or disabling the network interface stops the ransomware from communicating with command-and-control servers and blocks lateral movement via SMB or other protocols. This containment step must occur before any remediation like antivirus scans or file restoration.

Answer

Run antivirus to remove the ransomware

Answer

Notify all users to change passwords

Answer

Restore files from backup

Question 20

A company is developing an incident response plan. Which of the following stakeholders should be included in the initial planning phase?

Accepted Answer

Business unit leaders. Business unit leaders (Option D) are essential in the initial planning phase because they define the critical assets, operational priorities, and recovery time objectives (RTOs) that shape the incident response strategy. Without their input, the plan may fail to align with business continuity requirements, leading to ineffective resource allocation during an actual incident.

Answer

External legal counsel

Answer

Internal audit

Answer

Only IT staff