SSCP Incident Response and Recovery — 10 Questions

Question 1

During the eradication phase of a malware incident, a security analyst removes malicious files and cleans registry persistence. What is the MOST critical additional step to prevent reinfection through the same vector?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Patching the vulnerability that was exploited. Patching the exploited vulnerability (Option A) is the most critical additional step because it removes the root cause of the infection. Without patching, the same attack vector (e.g., an unpatched SMB vulnerability like EternalBlue) remains open, allowing the malware to reinfect the system immediately after cleanup. Eradication is incomplete if the underlying flaw is not addressed, as the attacker can simply re-exploit the same weakness.

Answer

Running a full antivirus scan

Answer

Resetting all user passwords

Answer

Reimaging the system with a clean OS

Question 2

Which TWO metrics are commonly tracked to measure the effectiveness of the incident response process? (Select TWO)

Accepted Answer

MTTD (Mean Time to Detect). MTTD (Mean Time to Detect) measures the average time from when an incident occurs until it is detected, directly reflecting the speed of detection capabilities. MTTR (Mean Time to Respond) measures the average time from detection to containment or remediation, indicating the efficiency of the response process. Both are key performance indicators (KPIs) for incident response effectiveness as defined in NIST SP 800-61 and industry frameworks.

Answer

SLA (Service Level Agreement) compliance percentage

Answer

MTBF (Mean Time Between Failures)

Answer

Number of firewall rules

Question 3

An organization has experienced a ransomware attack. After containing the incident, the response team plans to restore systems from backups. Which step is most critical before restoring production systems?

Accepted Answer

Patch the exploited vulnerability and ensure the backup is free of malware.. Restoring from backups while the original vulnerability remains unpatched would allow the ransomware to reinfect the systems immediately. Additionally, if the backup itself contains malware (e.g., the ransomware encrypted the backup repository), restoring it would reintroduce the infection. Patching the exploited vulnerability and verifying the backup is clean ensures a safe restoration point, breaking the attack chain.

Answer

Verify the integrity of backup data by restoring to an isolated test environment.

Answer

Notify law enforcement immediately.

Answer

Disconnect all systems from the network.

Question 4

An organization's disaster recovery plan specifies an RPO of 4 hours and an RTO of 24 hours for a critical database. Which of the following best describes these metrics?

Accepted Answer

RPO means up to 4 hours of data loss; RTO means the database must be recovered within 24 hours.. RPO (Recovery Point Objective) defines the maximum acceptable data loss measured in time, meaning up to 4 hours of transactions could be lost. RTO (Recovery Time Objective) defines the maximum acceptable downtime, meaning the database must be fully operational within 24 hours after a disaster.

Answer

RPO means recovery point objective; RTO means recovery time objective.

Answer

RPO means the database can be down for up to 4 hours; RTO means up to 24 hours of data loss.

Answer

RPO means the database must be recovered within 4 hours; RTO means up to 24 hours of data loss.

Question 5

After a security incident, the response team holds a lessons learned meeting. Which TWO are primary objectives of this meeting? (Select two.)

Accepted Answer

Identify what went well and what could be improved. The primary objectives of a lessons learned meeting after a security incident are to identify what went well and what could be improved, and to update the incident response plan and runbooks based on those findings. This meeting focuses on process improvement and documentation updates to enhance future response efforts, not on operational tasks like evidence handling or system restoration.

Answer

Delete all evidence to free up storage

Answer

Assign blame for the incident

Answer

Restore affected systems to production

Question 6

During the preparation phase of the incident response lifecycle, which of the following is the MOST important component to establish?

Accepted Answer

Incident response plan. The incident response plan is the foundational document that outlines the entire process, including roles, procedures, and escalation paths. Without a formal, approved plan, other components like the communication plan, team, or tools lack the necessary structure and authority to function effectively during an incident.

Answer

Communication plan

Answer

Incident response team

Answer

Forensic analysis tools

Question 7

An analyst detects suspicious outbound traffic from a server to a known command-and-control IP address. According to NIST SP 800-61, which phase of the incident response lifecycle does this activity fall under?

Accepted Answer

Detection and Analysis. The detection of suspicious outbound traffic to a known command-and-control IP address is a clear indicator of a potential security incident. According to NIST SP 800-61, this activity falls under the 'Detection and Analysis' phase, which involves identifying and validating that an incident has occurred through monitoring, alerting, and analysis of security events.

Answer

Post-Incident Activity

Answer

Preparation

Answer

Containment, Eradication, and Recovery

Question 8

During a malware outbreak, a security analyst needs to contain the spread. The affected systems are on the same VLAN as critical servers. Which of the following containment actions should be performed FIRST to minimize impact?

Accepted Answer

Isolate the affected systems by applying VLAN quarantine or ACLs. Isolating the affected systems by applying VLAN quarantine or ACLs is the correct first action because it immediately stops the malware from spreading laterally across the same VLAN to critical servers, while preserving forensic evidence. This network-level containment is faster and less disruptive than account or system-level changes, and it prevents the outbreak from propagating before any remediation begins.

Answer

Disable user accounts associated with the infected systems

Answer

Reboot the affected systems to clear malware from memory

Answer

Restore the affected systems from backup

Question 9

An incident responder is collecting evidence from a compromised server. Which of the following is the correct order for collecting volatile data?

Accepted Answer

Memory dump, network connections, disk image. Volatile data must be collected in order of decreasing volatility: memory (RAM) is most volatile and lost on power loss, followed by network connections (ephemeral state), and finally disk image (persistent storage). This order ensures critical evidence like running processes, encryption keys, and active network sessions are captured before they disappear.

Answer

Network connections, memory dump, disk image

Answer

Disk image, network connections, memory dump

Answer

Disk image, memory dump, network connections

Question 10

During a forensic investigation, an examiner creates a bit-for-bit copy of a hard drive using a write blocker. What is the purpose of using a write blocker?

Accepted Answer

To prevent modification of the original evidence. A write blocker is a hardware or software device that intercepts and blocks any write commands from the forensic workstation to the source drive, ensuring that the original evidence remains unaltered during acquisition. This is critical for maintaining the integrity and admissibility of digital evidence in legal proceedings, as any modification could compromise the chain of custody and forensic soundness.

Answer

To encrypt the data during transfer

Answer

To speed up the imaging process

Answer

To verify the hash of the original drive