SSCP Incident Response and Recovery Practice Test 2 — 15 Questions

Question 1

A security analyst is reviewing logs and discovers that a user account with administrative privileges was used to access a sensitive file server outside of normal business hours. The account belongs to an IT administrator who is on vacation. The analyst suspects credential compromise. According to NIST SP 800-61, which of the following actions should be taken FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Initiate the incident response process by documenting the finding and notifying the appropriate stakeholders.. NIST SP 800-61 outlines that upon detection of a potential incident, the first action is to initiate the incident response process, which includes documenting the finding and notifying stakeholders. This ensures a coordinated and methodical approach. Taking immediate technical actions like disabling accounts or changing passwords can alert the attacker and destroy evidence. The process should guide subsequent steps like analysis, containment, and eradication.

Answer

Review the file server logs to determine which files were accessed during the suspicious session.

Answer

Change the password for the user account to prevent further unauthorized use.

Answer

Disable the user account immediately to prevent further unauthorized access.

Question 2

A security team is conducting a post-incident review after a ransomware attack. They are analyzing the effectiveness of their incident response plan. Which TWO of the following activities are part of the post-incident activity phase according to NIST SP 800-61? (Choose two.)

Accepted Answer

Conducting a lessons learned meeting with all relevant stakeholders.. According to NIST SP 800-61, the post-incident activity phase includes conducting a lessons learned meeting and using the data collected during the incident to improve the incident response plan and procedures. These activities ensure that the organization learns from the incident and enhances its future response. Other actions like containment, eradication, and recovery occur in earlier phases.

Answer

Isolating affected systems from the network to prevent lateral movement.

Answer

Implementing additional security controls to prevent similar incidents.

Answer

Restoring data from backups to resume normal operations.

Question 3

A security analyst is creating a disaster recovery plan for a critical application. The application has a Recovery Time Objective (RTO) of 2 hours and a Recovery Point Objective (RPO) of 15 minutes. Which of the following backup strategies would BEST meet these requirements?

Accepted Answer

Continuous data protection (CDP) with asynchronous replication to a hot site.. Continuous data protection (CDP) with asynchronous replication to a hot site provides near-zero RPO and rapid recovery, meeting both the 15-minute RPO and 2-hour RTO. CDP captures all changes, and a hot site is ready to take over almost immediately. Other options involve backup intervals or site types that cannot meet the tight objectives.

Answer

Weekly full backups with daily differential backups to a warm site.

Answer

Hourly incremental backups with daily full backups to tape.

Answer

Daily full backups with weekly offsite replication.

Question 4

An incident responder is analyzing a compromised Linux server. The responder needs to determine which user accounts were recently created or modified. Which of the following commands should the responder use to review the account creation and modification timestamps?

Accepted Answer

Review the timestamps in /etc/shadow and /etc/passwd using a tool like auditd logs or file system journal.. Linux does not store account creation timestamps in /etc/passwd or /etc/shadow. To determine when accounts were created or modified, an incident responder must rely on audit logs (e.g., auditd) or file system journaling, which record changes to these files. Commands like lastlog, stat, or ls only show login times or file modification times, not per-account changes. Thus, reviewing auditd logs or the journal is the correct approach.

Answer

ls -l /etc/passwd

Answer

stat /etc/passwd

Answer

lastlog

Question 5

During which phase of the NIST SP 800-61 incident response lifecycle are incident response plan updates and lessons learned typically documented?

Accepted Answer

Post-Incident Activity. The Post-Incident Activity phase of NIST SP 800-61 is specifically designed for conducting lessons learned meetings, documenting improvements, and updating the incident response plan based on findings from the incident. This phase ensures that the organization captures feedback to refine procedures, tools, and training for future incidents.

Answer

Preparation

Answer

Containment, Eradication, and Recovery

Answer

Detection and Analysis

Question 6

A security analyst receives a chain of custody form for a hard drive that was seized from a suspected insider threat. The form shows that the drive was handled by three individuals over two days. Which of the following is the PRIMARY reason for maintaining a chain of custody?

Accepted Answer

To prove that the evidence has not been tampered with and is admissible in legal proceedings. The chain of custody is a documented chronological record of evidence handling, which is essential to demonstrate that the hard drive has not been altered, damaged, or substituted since seizure. Without this unbroken record, the evidence could be challenged as inadmissible in court under rules like the Federal Rules of Evidence (FRE) 901, which require authentication. This is the primary reason because legal admissibility hinges on proving integrity and continuity of custody.

Answer

To determine the cost of the forensic investigation

Answer

To ensure the hard drive is stored in a secure location

Answer

To track the productivity of forensic analysts

Question 7

During incident response, a team needs to isolate an infected workstation that is part of a critical manufacturing network. Which containment method is MOST appropriate to minimize disruption while preventing the spread of malware?

Accepted Answer

Place the workstation into a quarantine VLAN via switch configuration. Placing the workstation into a quarantine VLAN via switch configuration is most appropriate because it logically isolates the infected host from the rest of the network at Layer 2, preventing lateral spread of malware while allowing the manufacturing network to continue operating. This method uses 802.1Q VLAN tagging and access control lists (ACLs) on the switch to restrict traffic without physically disconnecting the device, which could disrupt time-sensitive manufacturing processes. It also preserves the ability to remotely manage or forensically image the workstation if needed.

Answer

Apply a host-based firewall rule to block all inbound traffic

Answer

Physically unplug the network cable

Answer

Disable the user's Active Directory account

Question 8

After a ransomware incident, an organization decides to restore data from backups. The RPO (Recovery Point Objective) is 4 hours. What does this RPO indicate?

Accepted Answer

Backups must be taken at least every 4 hours to ensure data loss does not exceed 4 hours. The Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time. An RPO of 4 hours means the organization can tolerate losing up to 4 hours of data, so backups must be taken at least every 4 hours to ensure that in the worst case, no more than 4 hours of data is lost. This directly dictates the backup frequency, not the recovery time or downtime.

Answer

The organization can tolerate 4 hours of downtime

Answer

The system must be restored within 4 hours of the incident

Answer

The recovery process will take a maximum of 4 hours

Question 9

Which DR testing type involves running recovery systems in parallel with production systems to verify functionality without impacting live operations?

Accepted Answer

Parallel test. A parallel test is the correct DR testing type because it involves running the recovery systems concurrently with the production systems. This allows the organization to verify that the backup systems function correctly and can handle the workload without any impact on live operations, as the production environment remains untouched.

Answer

Full interruption test

Answer

Simulation test

Answer

Tabletop exercise

Question 10

During the eradication phase of a malware incident, a security analyst removes malicious files and cleans registry persistence. What is the MOST critical additional step to prevent reinfection through the same vector?

Accepted Answer

Patching the vulnerability that was exploited. Patching the exploited vulnerability (Option A) is the most critical additional step because it removes the root cause of the infection. Without patching, the same attack vector (e.g., an unpatched SMB vulnerability like EternalBlue) remains open, allowing the malware to reinfect the system immediately after cleanup. Eradication is incomplete if the underlying flaw is not addressed, as the attacker can simply re-exploit the same weakness.

Answer

Running a full antivirus scan

Answer

Resetting all user passwords

Answer

Reimaging the system with a clean OS

Question 11

A security team is collecting evidence from a compromised server. They need to create a forensic image. Which of the following is the CORRECT procedure to ensure data integrity?

Accepted Answer

Use a write blocker to create a bit-for-bit copy, then compute MD5 hash of the original and the copy to verify they match. Forensic imaging requires a write blocker to prevent any modification to the original evidence, and a bit-for-bit copy preserves all data, including slack space and deleted files. Computing an MD5 hash of both the original and the copy verifies integrity by ensuring the hashes match, confirming no data alteration occurred during acquisition.

Answer

Take a photo of the screen and document file timestamps manually

Answer

Create a compressed image file using software without a write blocker

Answer

Boot the system and run a backup utility to copy files to an external drive

Question 12

What is the PRIMARY purpose of a lessons learned meeting after an incident?

Accepted Answer

To identify improvements in the incident response process. The primary purpose of a lessons learned meeting is to analyze the incident response process to identify what worked well and what did not, enabling the team to update procedures, playbooks, and tools to improve future responses. This aligns with the continuous improvement cycle mandated by frameworks like NIST SP 800-61, which emphasizes post-incident activity to refine detection and remediation capabilities.

Answer

To assign blame for the incident

Answer

To satisfy regulatory compliance requirements

Answer

To calculate the financial cost of the incident

Question 13

An analyst detects suspicious outbound traffic from a workstation to a known command-and-control IP. Which IoC blocking method is MOST appropriate as an immediate containment measure?

Accepted Answer

Block the IP address at the perimeter firewall. Blocking the IP address at the perimeter firewall is the most appropriate immediate containment measure because it directly cuts the outbound communication channel to the known command-and-control (C2) server. This stops data exfiltration and prevents the attacker from issuing further commands, buying time for deeper analysis. Firewall ACLs or blackhole routes can be applied in seconds without altering the endpoint, which is critical when the malware may have persistence mechanisms or anti-forensic capabilities.

Answer

Delete the malicious files from the system

Answer

Remove the malware from the workstation using EDR

Answer

Disable the user's account

Question 14

A company is developing a DR plan for a critical database. The maximum acceptable downtime is 2 hours, and the maximum data loss is 1 hour. What are the RTO and RPO?

Accepted Answer

RTO = 2 hours, RPO = 1 hour. The Recovery Time Objective (RTO) is the maximum acceptable downtime, which is 2 hours. The Recovery Point Objective (RPO) is the maximum acceptable data loss, which is 1 hour. Therefore, option A correctly identifies RTO = 2 hours and RPO = 1 hour.

Answer

RTO = 1 hour, RPO = 1 hour

Answer

RTO = 1 hour, RPO = 2 hours

Answer

RTO = 2 hours, RPO = 2 hours

Question 15

A security analyst is investigating a phishing incident that led to credential theft. Which TWO actions are appropriate during the containment phase? (Select TWO)

Accepted Answer

Reset the compromised user's password. Option A is correct because resetting the compromised user's password immediately invalidates the stolen credentials, preventing the attacker from continuing to use the phished account during containment. Option E is correct because blocking the phishing domain at the email gateway stops further phishing emails from that domain reaching other users, limiting the spread of the incident. Option B is not a containment action; updating the incident response plan is a post-incident improvement activity. Option C is also post-incident, as lessons learned meetings occur after eradication and recovery to improve future response. Option D is a recovery action, since restoring from backup is used to return systems to normal operation after the threat is contained and removed.

Answer

Update the incident response plan

Answer

Conduct a lessons learned meeting

Answer

Restore the user's machine from backup