SSCP Incident Response and Recovery Practice Test 3 — 15 Questions

Question 1

An organization is developing its incident response plan. According to NIST SP 800-61, which phase should include establishing a communication plan, acquiring necessary tools, and conducting exercises?

Accepted Answer

Preparation. According to NIST SP 800-61, the Preparation phase is where the organization establishes a communication plan, acquires necessary tools (e.g., forensic workstations, imaging software, network monitoring tools), and conducts exercises (e.g., tabletop exercises or full-scale simulations) to ensure readiness. This phase lays the foundation for all subsequent incident response activities by ensuring resources and procedures are in place before an incident occurs.

Answer

Post-Incident Activity

Answer

Detection and Analysis

Answer

Containment, Eradication, and Recovery

Question 2

A security analyst detects a workstation communicating with a known command-and-control server. The workstation is running critical applications. What should be the analyst's first step according to the NIST incident response lifecycle?

Accepted Answer

Isolate the workstation from the network while preserving volatile data.. According to the NIST incident response lifecycle, the first priority is containment. Isolating the workstation from the network stops communication with the command-and-control server while preserving volatile data (e.g., memory, running processes, network connections) for forensic analysis. Powering off would destroy this critical evidence, and running a scan or waiting for instructions delays containment and risks further compromise.

Answer

Power off the workstation immediately to stop the communication.

Answer

Run a full antivirus scan on the workstation.

Answer

Notify management and wait for instructions.

Question 3

During a forensic investigation, a responder must collect evidence from a live Windows system. Which of the following represents the correct order for collecting volatile data?

Accepted Answer

Memory dump, network connections, process list, disk image. Option B is correct because volatile data must be collected in order of decreasing volatility to avoid losing critical evidence. Memory (RAM) is the most volatile, followed by network connections and process lists (which change rapidly), and finally disk images (persistent storage). This order ensures that transient data is captured before it disappears.

Answer

Disk image, memory dump, process list, network connections

Answer

Process list, memory dump, disk image, network connections

Answer

Network connections, memory dump, process list, disk image

Question 4

An organization has experienced a ransomware attack. After containing the incident, the response team plans to restore systems from backups. Which step is most critical before restoring production systems?

Accepted Answer

Patch the exploited vulnerability and ensure the backup is free of malware.. Option C is correct because restoring from backups while the original vulnerability remains unpatched would allow the ransomware to reinfect the systems immediately. Additionally, if the backup itself contains malware (e.g., the ransomware encrypted the backup repository), restoring it would reintroduce the infection. Patching the exploited vulnerability and verifying the backup is clean ensures a safe restoration point, breaking the attack chain.

Answer

Verify the integrity of backup data by restoring to an isolated test environment.

Answer

Notify law enforcement immediately.

Answer

Disconnect all systems from the network.

Question 5

Which of the following is the primary purpose of a chain of custody form in digital forensics?

Accepted Answer

To track the possession and handling of evidence from collection to presentation. Chain of custody documents who handled the evidence, when, and why, ensuring it remains admissible in court.

Answer

To document the steps taken to contain an incident

Answer

To record the hash values of forensic images

Answer

To provide a list of approved forensic tools

Question 6

An incident responder needs to create a forensic image of a suspect hard drive. What is the correct procedure to ensure evidence integrity?

Accepted Answer

Use a write blocker, create a bit-for-bit image, and compute SHA-256 hash before and after imaging.. Option A is correct because forensic imaging requires a write blocker to prevent any modification to the original evidence, a bit-for-bit (sector-level) copy to capture all data including slack space and deleted files, and cryptographic hashing (SHA-256) both before and after imaging to verify that the image is an exact, unaltered duplicate of the source. This process ensures the integrity and admissibility of digital evidence in legal proceedings.

Answer

Boot the suspect system and use imaging software to copy data.

Answer

Remove the drive and place it in anti-static bag, then ship to lab.

Answer

Connect the drive directly to forensic workstation, copy all files, and compute MD5 hash of copy.

Question 7

A security team detects lateral movement within the network. Which containment strategy should be applied first to limit the spread of the threat?

Accepted Answer

Isolate the affected systems by disconnecting them from the network.. Isolating affected systems by disconnecting them from the network is the immediate priority because it physically or logically severs the attacker's ability to propagate laterally via SMB, RDP, or other network protocols. This containment step stops the spread without destroying forensic evidence, which would be lost if systems were reimaged or powered off prematurely.

Answer

Disable user accounts associated with compromised systems.

Answer

Block the attacker's IP addresses at the perimeter firewall.

Answer

Reimage all compromised systems immediately.

Question 8

During a post-incident review, the incident response team identifies that the mean time to detect (MTTD) was 14 days. Which improvement would most directly reduce MTTD?

Accepted Answer

Deploying additional endpoint detection and response (EDR) sensors with automated alerting. Deploying additional EDR sensors with automated alerting directly reduces the time between an incident's occurrence and its detection by providing continuous monitoring and immediate notification of suspicious activities. This shortens the MTTD because automated alerts eliminate the delay inherent in manual log review or periodic checks, enabling the incident response team to react within minutes rather than days.

Answer

Implementing stricter access control policies

Answer

Conducting more frequent tabletop exercises

Answer

Increasing the frequency of full system backups

Question 9

Which type of disaster recovery test involves running the DR systems alongside production systems to verify functionality without impacting operations?

Accepted Answer

Parallel test. A parallel test runs the disaster recovery (DR) systems in a live, non-disruptive manner alongside the production environment. This allows the organization to validate that the DR systems can process transactions and handle workloads correctly without affecting the primary production operations, making it the correct choice for verifying functionality without impact.

Answer

Tabletop exercise

Answer

Full interruption test

Answer

Simulation test

Question 10

An organization's disaster recovery plan specifies an RPO of 4 hours and an RTO of 24 hours for a critical database. Which of the following best describes these metrics?

Accepted Answer

RPO means up to 4 hours of data loss; RTO means the database must be recovered within 24 hours.. Option A is correct because RPO (Recovery Point Objective) defines the maximum acceptable data loss measured in time, meaning up to 4 hours of transactions could be lost. RTO (Recovery Time Objective) defines the maximum acceptable downtime, meaning the database must be fully operational within 24 hours after a disaster.

Answer

RPO means recovery point objective; RTO means recovery time objective.

Answer

RPO means the database can be down for up to 4 hours; RTO means up to 24 hours of data loss.

Answer

RPO means the database must be recovered within 4 hours; RTO means up to 24 hours of data loss.

Question 11

An incident responder is handling a malware outbreak. The malware has been identified as a fileless threat that persists via registry run keys. Which eradication step is most appropriate?

Accepted Answer

Remove the malicious registry entries and restart the systems.. Option C is correct because fileless malware that persists via registry run keys can be eradicated by removing the malicious registry entries and restarting the systems. This breaks the persistence mechanism without requiring full reimaging, as the malware does not write files to disk and relies on registry-based auto-start locations (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) to execute after reboot.

Answer

Disable the affected user accounts.

Answer

Reimage all affected systems.

Answer

Run an antivirus scan on the systems.

Question 12

During the detection and analysis phase, an analyst receives a user report of unusual system behavior. The analyst reviews logs and finds several failed login attempts followed by a successful login from an unusual IP address. What is the next step?

Accepted Answer

Classify the incident and determine if escalation is needed.. Option C is correct because, during the detection and analysis phase of incident response, the primary goal is to assess the validity and scope of a potential security event before taking action. The analyst has observed indicators of a possible brute-force attack (failed logins followed by a successful login from an unusual IP), which requires classification to determine if it meets the criteria for a security incident. Escalation may be needed to involve a higher-tier incident response team or to initiate formal containment procedures, as per NIST SP 800-61 guidelines.

Answer

Immediately disconnect the user's workstation from the network.

Answer

Rebuild the user's workstation from a known-good image.

Answer

Ignore the event as it may be a false positive.

Question 13

An incident responder is collecting volatile evidence from a compromised Linux server. Which TWO of the following should be collected first? (Select two.)

Accepted Answer

List of active network connections using netstat. In incident response, volatile data is data that will be lost when the system is powered off. Active network connections (captured via netstat) and the contents of RAM (captured via LiME) are the most volatile, as they change constantly and are lost immediately upon shutdown. Collecting these first preserves critical evidence of current attacker activity and in-memory artifacts like rootkits or encryption keys.

Answer

Disk image of the system drive

Answer

System log files from /var/log

Answer

Hardware configuration inventory

Question 14

A company is selecting a disaster recovery site for its critical applications. Which THREE characteristics differentiate a warm site from a cold site? (Select three.)

Accepted Answer

A warm site has environmental controls (power, cooling) already in place.. Option B is correct because a warm site is partially configured with environmental controls such as power, cooling, and network connectivity already in place. This distinguishes it from a cold site, which lacks these infrastructure components and requires significant setup time. The presence of environmental controls is a key differentiator that allows a warm site to become operational faster than a cold site, though it still requires data restoration from backups before full recovery.

Answer

A warm site is typically ready to operate within hours.

Answer

A warm site has live data replication from the primary site.

Question 15

After a security incident, the response team holds a lessons learned meeting. Which TWO are primary objectives of this meeting? (Select two.)

Accepted Answer

Identify what went well and what could be improved. The primary objectives of a lessons learned meeting after a security incident are to identify what went well and what could be improved, and to update the incident response plan and runbooks based on those findings. This meeting focuses on process improvement and documentation updates to enhance future response efforts, not on operational tasks like evidence handling or system restoration.

Answer

Delete all evidence to free up storage

Answer

Assign blame for the incident

Answer

Restore affected systems to production