SSCP Incident Response and Recovery — 30 Questions

Question 1

During the eradication phase of a malware incident, a security analyst removes malicious files and cleans registry persistence. What is the MOST critical additional step to prevent reinfection through the same vector?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Patching the vulnerability that was exploited. Patching the exploited vulnerability (Option A) is the most critical additional step because it removes the root cause of the infection. Without patching, the same attack vector (e.g., an unpatched SMB vulnerability like EternalBlue) remains open, allowing the malware to reinfect the system immediately after cleanup. Eradication is incomplete if the underlying flaw is not addressed, as the attacker can simply re-exploit the same weakness.

Answer

Running a full antivirus scan

Answer

Resetting all user passwords

Answer

Reimaging the system with a clean OS

Question 2

Which TWO metrics are commonly tracked to measure the effectiveness of the incident response process? (Select TWO)

Accepted Answer

MTTD (Mean Time to Detect). MTTD (Mean Time to Detect) measures the average time from when an incident occurs until it is detected, directly reflecting the speed of detection capabilities. MTTR (Mean Time to Respond) measures the average time from detection to containment or remediation, indicating the efficiency of the response process. Both are key performance indicators (KPIs) for incident response effectiveness as defined in NIST SP 800-61 and industry frameworks.

Answer

SLA (Service Level Agreement) compliance percentage

Answer

MTBF (Mean Time Between Failures)

Answer

Number of firewall rules

Question 3

An organization has experienced a ransomware attack. After containing the incident, the response team plans to restore systems from backups. Which step is most critical before restoring production systems?

Accepted Answer

Patch the exploited vulnerability and ensure the backup is free of malware.. Restoring from backups while the original vulnerability remains unpatched would allow the ransomware to reinfect the systems immediately. Additionally, if the backup itself contains malware (e.g., the ransomware encrypted the backup repository), restoring it would reintroduce the infection. Patching the exploited vulnerability and verifying the backup is clean ensures a safe restoration point, breaking the attack chain.

Answer

Verify the integrity of backup data by restoring to an isolated test environment.

Answer

Notify law enforcement immediately.

Answer

Disconnect all systems from the network.

Question 4

An organization's disaster recovery plan specifies an RPO of 4 hours and an RTO of 24 hours for a critical database. Which of the following best describes these metrics?

Accepted Answer

RPO means up to 4 hours of data loss; RTO means the database must be recovered within 24 hours.. RPO (Recovery Point Objective) defines the maximum acceptable data loss measured in time, meaning up to 4 hours of transactions could be lost. RTO (Recovery Time Objective) defines the maximum acceptable downtime, meaning the database must be fully operational within 24 hours after a disaster.

Answer

RPO means recovery point objective; RTO means recovery time objective.

Answer

RPO means the database can be down for up to 4 hours; RTO means up to 24 hours of data loss.

Answer

RPO means the database must be recovered within 4 hours; RTO means up to 24 hours of data loss.

Question 5

After a security incident, the response team holds a lessons learned meeting. Which TWO are primary objectives of this meeting? (Select two.)

Accepted Answer

Identify what went well and what could be improved. The primary objectives of a lessons learned meeting after a security incident are to identify what went well and what could be improved, and to update the incident response plan and runbooks based on those findings. This meeting focuses on process improvement and documentation updates to enhance future response efforts, not on operational tasks like evidence handling or system restoration.

Answer

Delete all evidence to free up storage

Answer

Assign blame for the incident

Answer

Restore affected systems to production

Question 6

During the preparation phase of the incident response lifecycle, which of the following is the MOST important component to establish?

Accepted Answer

Incident response plan. The incident response plan is the foundational document that outlines the entire process, including roles, procedures, and escalation paths. Without a formal, approved plan, other components like the communication plan, team, or tools lack the necessary structure and authority to function effectively during an incident.

Answer

Communication plan

Answer

Incident response team

Answer

Forensic analysis tools

Question 7

An analyst detects suspicious outbound traffic from a server to a known command-and-control IP address. According to NIST SP 800-61, which phase of the incident response lifecycle does this activity fall under?

Accepted Answer

Detection and Analysis. The detection of suspicious outbound traffic to a known command-and-control IP address is a clear indicator of a potential security incident. According to NIST SP 800-61, this activity falls under the 'Detection and Analysis' phase, which involves identifying and validating that an incident has occurred through monitoring, alerting, and analysis of security events.

Answer

Post-Incident Activity

Answer

Preparation

Answer

Containment, Eradication, and Recovery

Question 8

During a malware outbreak, a security analyst needs to contain the spread. The affected systems are on the same VLAN as critical servers. Which of the following containment actions should be performed FIRST to minimize impact?

Accepted Answer

Isolate the affected systems by applying VLAN quarantine or ACLs. Isolating the affected systems by applying VLAN quarantine or ACLs is the correct first action because it immediately stops the malware from spreading laterally across the same VLAN to critical servers, while preserving forensic evidence. This network-level containment is faster and less disruptive than account or system-level changes, and it prevents the outbreak from propagating before any remediation begins.

Answer

Disable user accounts associated with the infected systems

Answer

Reboot the affected systems to clear malware from memory

Answer

Restore the affected systems from backup

Question 9

An incident responder is collecting evidence from a compromised server. Which of the following is the correct order for collecting volatile data?

Accepted Answer

Memory dump, network connections, disk image. Volatile data must be collected in order of decreasing volatility: memory (RAM) is most volatile and lost on power loss, followed by network connections (ephemeral state), and finally disk image (persistent storage). This order ensures critical evidence like running processes, encryption keys, and active network sessions are captured before they disappear.

Answer

Network connections, memory dump, disk image

Answer

Disk image, network connections, memory dump

Answer

Disk image, memory dump, network connections

Question 10

During a forensic investigation, an examiner creates a bit-for-bit copy of a hard drive using a write blocker. What is the purpose of using a write blocker?

Accepted Answer

To prevent modification of the original evidence. A write blocker is a hardware or software device that intercepts and blocks any write commands from the forensic workstation to the source drive, ensuring that the original evidence remains unaltered during acquisition. This is critical for maintaining the integrity and admissibility of digital evidence in legal proceedings, as any modification could compromise the chain of custody and forensic soundness.

Answer

To encrypt the data during transfer

Answer

To speed up the imaging process

Answer

To verify the hash of the original drive

Question 11

Which metric is used to measure the average time it takes to detect an incident?

Accepted Answer

Mean Time to Detect (MTTD). Mean Time to Detect (MTTD) is the correct metric because it specifically measures the average time elapsed between the occurrence of an incident and its detection by monitoring systems or security personnel. This metric is critical in incident response as it directly impacts the window of opportunity for attackers to cause damage before containment begins.

Answer

Recovery Point Objective (RPO)

Answer

Mean Time to Resolve (MTTR)

Answer

Recovery Time Objective (RTO)

Question 12

After a security incident, the incident response team holds a lessons learned meeting. What is the PRIMARY outcome of this meeting?

Accepted Answer

Identify improvements to the incident response process. The primary outcome of a lessons learned meeting is to identify improvements to the incident response process. This meeting focuses on analyzing what worked well and what did not, leading to actionable changes in policies, procedures, and tools to enhance future incident handling. It is a key component of the continuous improvement cycle mandated by frameworks like NIST SP 800-61.

Answer

Permanently delete all evidence related to the incident

Answer

Inform the media about the incident details

Answer

Assign blame for the incident

Question 13

After a ransomware incident, the incident response team is conducting recovery. Which THREE steps are essential to ensure a secure restoration and prevent reinfection? (Choose three.)

Accepted Answer

Perform a full system scan with updated antivirus on the restored system.. Performing a full system scan with updated antivirus on the restored system ensures that any malware remnants that may have survived the backup or been reintroduced during the restoration process are detected and removed. Ransomware often hides in shadow copies, system restore points, or backup archives, and a scan with current signatures is essential to verify the system is clean before it is placed back into production.

Answer

Restore from the most recent backup available, regardless of its integrity.

Answer

Reconnect the system to the network immediately after restoration to test functionality.

Question 14

During a post-incident review of a data breach, the incident response team is evaluating the chain of custody for forensic evidence. Which THREE practices demonstrate proper evidence handling? (Choose three.)

Accepted Answer

A write blocker was used when creating a forensic image of the disk.. A write blocker is a hardware or software device that prevents any write operations to the original evidence drive during forensic imaging. This ensures the integrity of the original evidence by blocking all commands that could modify data, such as write, erase, or format commands, while allowing read-only access for creating a bit-for-bit copy.

Answer

The original hard drive was used directly for analysis to avoid delays.

Answer

MD5 hashes were computed only after the analysis was complete.

Question 15

During which phase of the NIST SP 800-61 incident response lifecycle are incident response plan updates and lessons learned typically documented?

Accepted Answer

Post-Incident Activity. The Post-Incident Activity phase of NIST SP 800-61 is specifically designed for conducting lessons learned meetings, documenting improvements, and updating the incident response plan based on findings from the incident. This phase ensures that the organization captures feedback to refine procedures, tools, and training for future incidents.

Answer

Preparation

Answer

Containment, Eradication, and Recovery

Answer

Detection and Analysis

Question 16

An organization's security team detects a potential data breach. After confirming the incident, they classify it as P2 (high severity) and begin containment. Which action should be performed FIRST to preserve evidence for forensic analysis?

Accepted Answer

Capture a memory dump using a tool like Magnet RAM Capture. When a high-severity incident (P2) is confirmed, the first priority for forensic preservation is capturing volatile data, which includes system memory (RAM). A memory dump using a tool like Magnet RAM Capture preserves running processes, network connections, encryption keys, and malware in memory that would be lost on shutdown or disconnection. This order follows the volatility principle: capture the most volatile data first before any other action that could alter the system state.

Answer

Disconnect the system from the network

Answer

Create a forensic image of the hard drive

Answer

Run an antivirus scan to remove malware

Question 17

A security analyst receives a chain of custody form for a hard drive that was seized from a suspected insider threat. The form shows that the drive was handled by three individuals over two days. Which of the following is the PRIMARY reason for maintaining a chain of custody?

Accepted Answer

To prove that the evidence has not been tampered with and is admissible in legal proceedings. The chain of custody is a documented chronological record of evidence handling, which is essential to demonstrate that the hard drive has not been altered, damaged, or substituted since seizure. Without this unbroken record, the evidence could be challenged as inadmissible in court under rules like the Federal Rules of Evidence (FRE) 901, which require authentication. This is the primary reason because legal admissibility hinges on proving integrity and continuity of custody.

Answer

To determine the cost of the forensic investigation

Answer

To ensure the hard drive is stored in a secure location

Answer

To track the productivity of forensic analysts

Question 18

During incident response, a team needs to isolate an infected workstation that is part of a critical manufacturing network. Which containment method is MOST appropriate to minimize disruption while preventing the spread of malware?

Accepted Answer

Place the workstation into a quarantine VLAN via switch configuration. Placing the workstation into a quarantine VLAN via switch configuration is most appropriate because it logically isolates the infected host from the rest of the network at Layer 2, preventing lateral spread of malware while allowing the manufacturing network to continue operating. This method uses 802.1Q VLAN tagging and access control lists (ACLs) on the switch to restrict traffic without physically disconnecting the device, which could disrupt time-sensitive manufacturing processes. It also preserves the ability to remotely manage or forensically image the workstation if needed.

Answer

Apply a host-based firewall rule to block all inbound traffic

Answer

Physically unplug the network cable

Answer

Disable the user's Active Directory account

Question 19

After a ransomware incident, an organization decides to restore data from backups. The RPO (Recovery Point Objective) is 4 hours. What does this RPO indicate?

Accepted Answer

Backups must be taken at least every 4 hours to ensure data loss does not exceed 4 hours. The Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time. An RPO of 4 hours means the organization can tolerate losing up to 4 hours of data, so backups must be taken at least every 4 hours to ensure that in the worst case, no more than 4 hours of data is lost. This directly dictates the backup frequency, not the recovery time or downtime.

Answer

The organization can tolerate 4 hours of downtime

Answer

The system must be restored within 4 hours of the incident

Answer

The recovery process will take a maximum of 4 hours

Question 20

Which DR testing type involves running recovery systems in parallel with production systems to verify functionality without impacting live operations?

Accepted Answer

Parallel test. A parallel test is the correct DR testing type because it involves running the recovery systems concurrently with the production systems. This allows the organization to verify that the backup systems function correctly and can handle the workload without any impact on live operations, as the production environment remains untouched.

Answer

Full interruption test

Answer

Simulation test

Answer

Tabletop exercise