SSCP Incident Response and Recovery — 50 Questions

Question 1

An organization's security team detects a potential data breach. After confirming the incident, they classify it as P2 (high severity) and begin containment. Which action should be performed FIRST to preserve evidence for forensic analysis?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Capture a memory dump using a tool like Magnet RAM Capture. When a high-severity incident (P2) is confirmed, the first priority for forensic preservation is capturing volatile data, which includes system memory (RAM). A memory dump using a tool like Magnet RAM Capture preserves running processes, network connections, encryption keys, and malware in memory that would be lost on shutdown or disconnection. This order follows the volatility principle: capture the most volatile data first before any other action that could alter the system state.

Answer

Disconnect the system from the network

Answer

Create a forensic image of the hard drive

Answer

Run an antivirus scan to remove malware

Question 2

During a forensic investigation, an examiner needs to preserve volatile evidence. Which of the following lists the correct order of collection for volatile data?

Accepted Answer

RAM, network connections, running processes, hard drive image. Volatile data must be collected in order of decreasing volatility to prevent loss of critical evidence. RAM is the most volatile (lost on power-off), followed by network connections (state changes rapidly), then running processes (persist slightly longer), and finally the hard drive image (non-volatile). This order follows the RFC 3227 guidelines for evidence collection.

Answer

Hard drive image, network connections, running processes, RAM

Answer

Running processes, RAM, hard drive image, network connections

Answer

Network connections, hard drive image, RAM, running processes

Question 3

Which of the following is the FIRST step in the volatile evidence collection order when responding to an incident on a live system?

Accepted Answer

Capture a RAM dump using a tool like Magnet RAM Capture or WinPmem. The first step in volatile evidence collection is to capture the most volatile data, which is typically RAM (memory). RAM contains running processes, network connections, and encryption keys that are lost when the system is powered off. Therefore, capturing a RAM dump using tools like Magnet RAM Capture or WinPmem is the first step. Disconnecting from the network is a containment step that may be done before or after, but it can alter volatile data; running antivirus scans modifies the system; creating a forensic image of the hard drive is less volatile and done later.

Answer

Disconnect the system from the network

Answer

Run antivirus scans to identify malware

Answer

Create a forensic image of the hard drive

Question 4

During the eradication phase of incident response, which of the following actions is MOST critical to ensure the threat is completely removed from a compromised system?

Accepted Answer

Removing malicious files and cleaning registry persistence. During the eradication phase, the primary goal is to ensure that no remnants of the attacker's presence remain on the system. Option C directly addresses this by removing malicious files and cleaning registry persistence, which eliminates backdoors, scheduled tasks, and other persistence mechanisms that could allow the threat to survive a reboot or evade detection. Without this step, even after patching or credential resets, the attacker could regain access through hidden persistence points.

Answer

Reimaging the system from a verified clean image

Answer

Resetting compromised user credentials

Answer

Patching the exploited vulnerability

Question 5

An incident responder is tasked with collecting forensic evidence from a compromised Linux server. Which command would the responder use to capture the contents of volatile memory (RAM) for analysis?

Accepted Answer

lime-forensics --dump /tmp/mem.lime. LiME (Linux Memory Extractor) is specifically designed to capture volatile memory from Linux systems with minimal footprint, outputting a raw memory dump that can be analyzed with tools like Volatility. The `--dump` flag directs the acquisition to a specified file, ensuring the capture is forensically sound by avoiding writes to the compromised filesystem where possible.

Answer

cat /proc/kcore > /tmp/mem.dump

Answer

memdump -o /tmp/mem.dump

Answer

dd if=/dev/mem of=/tmp/mem.dump bs=1M

Question 6

After containing a ransomware incident, the incident response team identifies that the attacker gained initial access through a phishing email that installed a backdoor. Which of the following eradication steps is MOST critical to prevent re-infection?

Accepted Answer

Removing the backdoor executable and associated persistence mechanisms. In the eradication phase, the immediate priority is to remove the attacker's direct access and persistence mechanisms. While reimaging (Option B) also removes the backdoor, it is a more time-consuming and disruptive approach that may not be necessary for all systems. Removing the backdoor executable and persistence mechanisms (e.g., scheduled tasks, registry Run keys) directly eliminates the attacker's foothold, preventing re-infection from the same vector without the overhead of full reimaging. Password resets (Option A) and training (Option D) are important but address different phases (recovery and prevention) and do not directly remove the existing backdoor.

Answer

Resetting all user passwords

Answer

Reimaging all affected systems from a known-good backup

Answer

Conducting security awareness training for all employees

Question 7

During the detection and analysis phase, an analyst classifies an incident as P1 (critical) because it involves a breach of sensitive customer data. What is the IMMEDIATE next step the analyst should take?

Accepted Answer

Escalate the incident to the incident response manager and legal counsel. When an incident is classified as P1 (critical) due to a breach of sensitive customer data, the immediate next step is to escalate to the incident response manager and legal counsel. This ensures that legal obligations (e.g., breach notification laws, regulatory reporting) and organizational authority are engaged before any technical actions that could alter evidence or violate chain-of-custody requirements. The detection and analysis phase prioritizes notification of key stakeholders to coordinate a lawful and effective response.

Answer

Notify the affected customers of the data breach

Answer

Create a forensic image of the compromised server

Answer

Begin containment by isolating affected systems

Question 8

During a forensic investigation, a responder must collect evidence from a live Windows system. Which of the following represents the correct order for collecting volatile data?

Accepted Answer

Memory dump, network connections, process list, disk image. Volatile data must be collected in order of decreasing volatility to avoid losing critical evidence. Memory (RAM) is the most volatile, followed by network connections and process lists (which change rapidly), and finally disk images (persistent storage). This order ensures that transient data is captured before it disappears.

Answer

Disk image, memory dump, process list, network connections

Answer

Process list, memory dump, disk image, network connections

Answer

Network connections, memory dump, process list, disk image

Question 9

An incident responder is handling a malware outbreak. The malware has been identified as a fileless threat that persists via registry run keys. Which eradication step is most appropriate?

Accepted Answer

Remove the malicious registry entries and restart the systems.. Fileless malware that persists via registry run keys can be eradicated by removing the malicious registry entries and restarting the systems. This breaks the persistence mechanism without requiring full reimaging, as the malware does not write files to disk and relies on registry-based auto-start locations (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) to execute after reboot.

Answer

Disable the affected user accounts.

Answer

Reimage all affected systems.

Answer

Run an antivirus scan on the systems.

Question 10

A company is selecting a disaster recovery site for its critical applications. Which THREE characteristics differentiate a warm site from a cold site? (Select three.)

Accepted Answer

A warm site has environmental controls (power, cooling) already in place.. Option B is correct because a warm site, unlike a cold site that may be an empty shell or unpowered space, already has environmental infrastructure such as power distribution, UPS, HVAC cooling, and raised flooring operational and ready to support equipment. Option C is correct because a warm site comes with servers, storage, and network gear already installed and configured (though often powered down or minimally configured), whereas a cold site typically has no hardware in place. Option E is correct because a defining trait of a warm site is that current data must be restored from backups onto the pre-installed systems before the site can take over, since it lacks live replication. Option A is not marked correct because a warm site usually takes hours to days to become operational, not "within hours" as a distinguishing guarantee, and that timing is more characteristic of a hot site. Option D is not marked correct because live data replication is a hallmark of a hot site, not a warm site, which relies on backup restoration.

Answer

A warm site is typically ready to operate within hours.

Answer

A warm site has live data replication from the primary site.

Question 11

An organization uses a hot disaster recovery (DR) site and has a Recovery Time Objective (RTO) of 4 hours. During a DR test, the team discovers that data replication from the primary site fails. Which TWO actions should the team take to meet the RTO while ensuring data integrity? (Choose two.)

Accepted Answer

Verify the integrity of the backup before restoration using hash checks.. Option A is correct because verifying backup integrity with hash checks (e.g., SHA-256 or MD5 comparisons) confirms the backup data is uncorrupted and complete before restoration, which is essential for ensuring data integrity during DR recovery. Option D is correct because restoring the latest valid backup from the primary site to the hot DR site provides a known-good data set that can be brought online within the 4-hour RTO, since the hot site already has infrastructure and services ready. Option B is incorrect because extending the RTO violates the stated 4-hour objective rather than meeting it. Option C is incorrect because failing over without restoring data would bring up the DR site with stale or missing data, compromising data integrity. Option E is incorrect because a cold site requires hardware setup and would far exceed the 4-hour RTO.

Answer

Extend the RTO to allow time for manual data re-entry.

Answer

Failover to the hot DR site immediately without data restoration.

Answer

Switch to a cold DR site that requires hardware setup.

Question 12

A security operations center (SOC) analyst receives an alert that a user's laptop has been infected with ransomware. The analyst confirms the infection and isolates the laptop from the network. According to NIST SP 800-61, which of the following should the analyst do NEXT?

Accepted Answer

Analyze the incident to determine its scope, impact, and root cause.. NIST SP 800-61 defines the incident response lifecycle as preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity. Once an incident is confirmed and the immediate threat is contained (e.g., isolation), the analyst must analyze the incident to determine its full scope, impact, and root cause. This analysis guides the remaining response steps and ensures no other systems are affected.

Answer

Perform a containment strategy by disabling the user's account and blocking malicious IPs.

Answer

Conduct a lessons learned meeting to discuss how the infection occurred.

Answer

Eradicate the malware by reinstalling the operating system and restoring data from backup.

Question 13

A security analyst is preparing an incident response plan for a financial institution that must comply with PCI DSS. The organization wants to ensure that its incident response activities are aligned with a recognized industry framework. Which of the following frameworks should the analyst use as the PRIMARY reference for structuring the incident response lifecycle?

Accepted Answer

NIST SP 800-61 Revision 2. NIST SP 800-61 Revision 2 is the most widely recognized and detailed framework for incident response, offering a clear four-phase lifecycle that organizations can adopt to meet compliance and operational needs. Its vendor-neutral, practical guidance makes it the primary reference for structuring an incident response plan, especially in regulated environments like financial institutions subject to PCI DSS.

Answer

ISO/IEC 27035

Answer

COBIT 2019

Answer

ITIL v4 Incident Management

Question 14

An analyst is reviewing a network packet capture of an intrusion and needs to determine the source of an attack. The capture shows a TCP session with a source IP of 192.168.1.50, a destination IP of 10.0.0.5, and a destination port of 22. The analyst knows that 10.0.0.5 is an internal server. Which of the following should the analyst do FIRST to identify the true source of the attack?

Accepted Answer

Check the internal DHCP server logs to see if 192.168.1.50 was assigned to a known internal host at the time of the attack.. The source IP 192.168.1.50 is a private address, suggesting the attack may have originated from within the internal network. The first step should be to correlate this IP with a physical device using DHCP logs, which record IP assignments. This can quickly identify the internal host and allow for containment and further forensic analysis. Other methods like TTL analysis or reverse DNS are less direct and may not provide actionable attribution.

Answer

Perform a reverse DNS lookup on 192.168.1.50 to obtain the hostname associated with the IP address.

Answer

Analyze the TCP sequence numbers to determine if the session was established through a spoofed handshake.

Answer

Examine the TTL and IP identification fields in the packet headers to infer the original source operating system and potential spoofing.

Question 15

A forensic examiner is preparing to acquire a forensic image of a running Windows server. The examiner wants to ensure that the evidence is admissible in court. Which of the following should the examiner do FIRST?

Accepted Answer

Isolate the server from the network to prevent remote modification.. In digital forensics, the first step is to secure the scene and prevent evidence alteration. Isolating the server from the network stops remote interference and preserves the system state. Only after isolation should the examiner document the scene, capture volatile data, and create a forensic image. This sequence ensures that the evidence remains admissible and untainted.

Answer

Create a bit-for-bit copy of the hard drive using a write blocker.

Answer

Document the chain of custody form and take photographs of the server.

Answer

Capture the contents of volatile memory (RAM) using a forensic tool.

Question 16

A security analyst is reviewing logs and discovers that a user account with administrative privileges was used to access a sensitive file server outside of normal business hours. The account belongs to an IT administrator who is on vacation. The analyst suspects credential compromise. According to NIST SP 800-61, which of the following actions should be taken FIRST?

Accepted Answer

Initiate the incident response process by documenting the finding and notifying the appropriate stakeholders.. NIST SP 800-61 outlines that upon detection of a potential incident, the first action is to initiate the incident response process, which includes documenting the finding and notifying stakeholders. This ensures a coordinated and methodical approach. Taking immediate technical actions like disabling accounts or changing passwords can alert the attacker and destroy evidence. The process should guide subsequent steps like analysis, containment, and eradication.

Answer

Review the file server logs to determine which files were accessed during the suspicious session.

Answer

Change the password for the user account to prevent further unauthorized use.

Answer

Disable the user account immediately to prevent further unauthorized access.

Question 17

A security team is conducting a post-incident review after a ransomware attack. They are analyzing the effectiveness of their incident response plan. Which TWO of the following activities are part of the post-incident activity phase according to NIST SP 800-61? (Choose two.)

Accepted Answer

Conducting a lessons learned meeting with all relevant stakeholders.. According to NIST SP 800-61, the post-incident activity phase includes conducting a lessons learned meeting and using the data collected during the incident to improve the incident response plan and procedures. These activities ensure that the organization learns from the incident and enhances its future response. Other actions like containment, eradication, and recovery occur in earlier phases.

Answer

Isolating affected systems from the network to prevent lateral movement.

Answer

Implementing additional security controls to prevent similar incidents.

Answer

Restoring data from backups to resume normal operations.

Question 18

A security analyst is creating a disaster recovery plan for a critical application. The application has a Recovery Time Objective (RTO) of 2 hours and a Recovery Point Objective (RPO) of 15 minutes. Which of the following backup strategies would BEST meet these requirements?

Accepted Answer

Continuous data protection (CDP) with asynchronous replication to a hot site.. Continuous data protection (CDP) with asynchronous replication to a hot site provides near-zero RPO and rapid recovery, meeting both the 15-minute RPO and 2-hour RTO. CDP captures all changes, and a hot site is ready to take over almost immediately. Other options involve backup intervals or site types that cannot meet the tight objectives.

Answer

Weekly full backups with daily differential backups to a warm site.

Answer

Hourly incremental backups with daily full backups to tape.

Answer

Daily full backups with weekly offsite replication.

Question 19

An incident responder is analyzing a compromised Linux server. The responder needs to determine which user accounts were recently created or modified. Which of the following commands should the responder use to review the account creation and modification timestamps?

Accepted Answer

Review the timestamps in /etc/shadow and /etc/passwd using a tool like auditd logs or file system journal.. Linux does not store account creation timestamps in /etc/passwd or /etc/shadow. To determine when accounts were created or modified, an incident responder must rely on audit logs (e.g., auditd) or file system journaling, which record changes to these files. Commands like lastlog, stat, or ls only show login times or file modification times, not per-account changes. Thus, reviewing auditd logs or the journal is the correct approach.

Answer

ls -l /etc/passwd

Answer

stat /etc/passwd

Answer

lastlog

Question 20

During which phase of the NIST SP 800-61 incident response lifecycle are incident response plan updates and lessons learned typically documented?

Accepted Answer

Post-Incident Activity. The Post-Incident Activity phase of NIST SP 800-61 is specifically designed for conducting lessons learned meetings, documenting improvements, and updating the incident response plan based on findings from the incident. This phase ensures that the organization captures feedback to refine procedures, tools, and training for future incidents.

Answer

Preparation

Answer

Containment, Eradication, and Recovery

Answer

Detection and Analysis