SSCP Incident Response and Recovery Practice Test 3 — 15 Questions

Question 1

During the eradication phase of incident response, which of the following actions is MOST critical to ensure the threat is completely removed from a compromised system?

Accepted Answer

Removing malicious files and cleaning registry persistence. During the eradication phase, the primary goal is to ensure that no remnants of the attacker's presence remain on the system. Option C directly addresses this by removing malicious files and cleaning registry persistence, which eliminates backdoors, scheduled tasks, and other persistence mechanisms that could allow the threat to survive a reboot or evade detection. Without this step, even after patching or credential resets, the attacker could regain access through hidden persistence points.

Answer

Reimaging the system from a verified clean image

Answer

Resetting compromised user credentials

Answer

Patching the exploited vulnerability

Question 2

An organization's disaster recovery plan specifies an RTO of 4 hours and an RPO of 1 hour for its critical database. Which of the following DR site configurations BEST meets these requirements?

Accepted Answer

Warm site with hourly log shipping to a standby database. A warm site with hourly log shipping to a standby database can achieve an RPO of 1 hour (by losing at most one hour of transactions) and an RTO of 4 hours (by applying the logs and bringing the standby online within that window). The standby database is kept nearly current with minimal lag, meeting both recovery objectives without the cost of full synchronous replication.

Answer

Cold site with weekly backup tapes shipped offsite

Answer

Cloud-based cold site with daily backups

Answer

Hot site with synchronous replication

Question 3

Which of the following is the PRIMARY purpose of establishing a chain of custody when handling digital evidence?

Accepted Answer

To prove that evidence has not been altered or tampered with from collection to presentation. The primary purpose of chain of custody is to create a documented, unbroken record of every person who handled the evidence, from collection through presentation in court. This documentation is critical to demonstrate that the digital evidence has not been altered, tampered with, or corrupted, thereby preserving its integrity and admissibility. Without a proper chain of custody, the opposing party can successfully challenge the evidence as unreliable or compromised.

Answer

To determine the priority of the incident

Answer

To ensure that evidence is stored in a secure location

Answer

To identify which forensic tools were used during analysis

Question 4

An incident responder is tasked with collecting forensic evidence from a compromised Linux server. Which command would the responder use to capture the contents of volatile memory (RAM) for analysis?

Accepted Answer

lime-forensics --dump /tmp/mem.lime. LiME (Linux Memory Extractor) is specifically designed to capture volatile memory from Linux systems with minimal footprint, outputting a raw memory dump that can be analyzed with tools like Volatility. The `--dump` flag directs the acquisition to a specified file, ensuring the capture is forensically sound by avoiding writes to the compromised filesystem where possible.

Answer

cat /proc/kcore > /tmp/mem.dump

Answer

memdump -o /tmp/mem.dump

Answer

dd if=/dev/mem of=/tmp/mem.dump bs=1M

Question 5

After containing a ransomware incident, the incident response team identifies that the attacker gained initial access through a phishing email that installed a backdoor. Which of the following eradication steps is MOST critical to prevent re-infection?

Accepted Answer

Removing the backdoor executable and associated persistence mechanisms. In the eradication phase, the immediate priority is to remove the attacker's direct access and persistence mechanisms. While reimaging (Option B) also removes the backdoor, it is a more time-consuming and disruptive approach that may not be necessary for all systems. Removing the backdoor executable and persistence mechanisms (e.g., scheduled tasks, registry Run keys) directly eliminates the attacker's foothold, preventing re-infection from the same vector without the overhead of full reimaging. Password resets (Option A) and training (Option D) are important but address different phases (recovery and prevention) and do not directly remove the existing backdoor.

Answer

Resetting all user passwords

Answer

Reimaging all affected systems from a known-good backup

Answer

Conducting security awareness training for all employees

Question 6

During the detection and analysis phase, an analyst classifies an incident as P1 (critical) because it involves a breach of sensitive customer data. What is the IMMEDIATE next step the analyst should take?

Accepted Answer

Escalate the incident to the incident response manager and legal counsel. When an incident is classified as P1 (critical) due to a breach of sensitive customer data, the immediate next step is to escalate to the incident response manager and legal counsel. This ensures that legal obligations (e.g., breach notification laws, regulatory reporting) and organizational authority are engaged before any technical actions that could alter evidence or violate chain-of-custody requirements. The detection and analysis phase prioritizes notification of key stakeholders to coordinate a lawful and effective response.

Answer

Notify the affected customers of the data breach

Answer

Create a forensic image of the compromised server

Answer

Begin containment by isolating affected systems

Question 7

Which type of disaster recovery test involves running the DR systems alongside the production systems to validate functionality without impacting live operations?

Accepted Answer

Parallel test. A parallel test runs the disaster recovery systems concurrently with the production systems to verify that the DR environment can handle the workload without disrupting live operations. This approach validates data replication, application functionality, and failover readiness while keeping production untouched, making it the correct choice for non-disruptive validation.

Answer

Simulation test

Answer

Full interruption test

Answer

Tabletop exercise

Question 8

An incident responder needs to create a forensic image of a suspect hard drive. Which of the following steps is ESSENTIAL to ensure the integrity of the evidence?

Accepted Answer

Use a write blocker to prevent modification of the original drive. Using a write blocker is essential because it ensures that no data can be written to the suspect hard drive during the imaging process, preserving the original evidence in a forensically sound state. Without a write blocker, any operating system or imaging tool could inadvertently modify metadata (e.g., access timestamps) or the file system, which would compromise the integrity and admissibility of the evidence in legal proceedings.

Answer

Run an antivirus scan on the drive before imaging

Answer

Boot the suspect system to verify it is functional

Answer

Perform the imaging over the network to save time

Question 9

During a malware containment operation, the incident response team decides to isolate an infected endpoint using network access controls. However, the malware is spreading via removable media. Which additional containment measure should the team implement?

Accepted Answer

Group policy to disable USB ports or restrict autorun. The malware is spreading via removable media, so disabling USB ports or restricting autorun via Group Policy directly cuts off the propagation vector. Network access controls (NAC) isolate the endpoint from the network, but they do not prevent the malware from copying itself to USB drives or executing via autorun.inf. Group Policy can disable the storage device class (e.g., via 'Removable Storage Access' policies) or disable autorun entirely (via 'Turn off Autoplay' policy), stopping the spread at the physical media level.

Answer

Block the malware's command-and-control IP at the firewall

Answer

Disable the user's account and force a password reset

Answer

Reimage the infected system immediately

Question 10

An organization has suffered a ransomware attack that encrypted files on several file servers. The incident response team is planning recovery. Which TWO actions should be performed to verify that the restored systems are clean before returning them to production? (Select TWO)

Accepted Answer

Run a full antivirus and anti-malware scan on the restored systems. Running a full antivirus and anti-malware scan on the restored systems ensures that no remnants of the ransomware (e.g., dormant payloads, modified registry keys, or backdoor executables) remain in the restored data. Even if the backup was taken before the infection, the restore process could reintroduce malware if the backup itself was compromised or if the ransomware had persisted in the system state. A thorough scan validates that the restored environment is free of known malicious signatures and behavioral indicators.

Answer

Restore the systems from the most recent backup

Answer

Change all user passwords associated with the systems

Answer

Apply all security patches to the operating system

Question 11

A forensic investigator is collecting evidence from a compromised Windows server. According to the order of volatility, which THREE pieces of evidence should be collected FIRST? (Select THREE)

Accepted Answer

Network connections and open ports. Network connections and open ports (C) are highly volatile because they can change rapidly and are lost when the system is disconnected from the network. Capturing this data first preserves evidence of active remote connections, which is critical for identifying the attacker's point of entry and ongoing malicious activity. Tools like netstat -anob or CurrPorts can be used to collect this information before any other forensic steps.

Answer

System event logs

Answer

Hard drive image

Question 12

During the preparation phase of incident response, which TWO components are essential for an effective incident response plan? (Select TWO)

Accepted Answer

A communication plan with contact information for key stakeholders. A communication plan with contact information for key stakeholders ensures that the right people can be reached quickly during an incident, which is critical for coordination and decision-making. Option E is correct because detailed recovery procedures for each critical system provide step-by-step instructions to restore operations, minimizing downtime and ensuring consistency in response efforts.

Answer

A list of approved vendors for hardware replacement

Answer

A list of all employee passwords

Answer

Network topology diagrams

Question 13

An organization is developing its incident response plan. According to NIST SP 800-61, which phase should include establishing a communication plan, acquiring necessary tools, and conducting exercises?

Accepted Answer

Preparation. According to NIST SP 800-61, the Preparation phase is where the organization establishes a communication plan, acquires necessary tools (e.g., forensic workstations, imaging software, network monitoring tools), and conducts exercises (e.g., tabletop exercises or full-scale simulations) to ensure readiness. This phase lays the foundation for all subsequent incident response activities by ensuring resources and procedures are in place before an incident occurs.

Answer

Post-Incident Activity

Answer

Detection and Analysis

Answer

Containment, Eradication, and Recovery

Question 14

A security analyst detects a workstation communicating with a known command-and-control server. The workstation is running critical applications. What should be the analyst's first step according to the NIST incident response lifecycle?

Accepted Answer

Isolate the workstation from the network while preserving volatile data.. According to the NIST incident response lifecycle, the first priority is containment. Isolating the workstation from the network stops communication with the command-and-control server while preserving volatile data (e.g., memory, running processes, network connections) for forensic analysis. Powering off would destroy this critical evidence, and running a scan or waiting for instructions delays containment and risks further compromise.

Answer

Power off the workstation immediately to stop the communication.

Answer

Run a full antivirus scan on the workstation.

Answer

Notify management and wait for instructions.

Question 15

During a forensic investigation, a responder must collect evidence from a live Windows system. Which of the following represents the correct order for collecting volatile data?

Accepted Answer

Memory dump, network connections, process list, disk image. Volatile data must be collected in order of decreasing volatility to avoid losing critical evidence. Memory (RAM) is the most volatile, followed by network connections and process lists (which change rapidly), and finally disk images (persistent storage). This order ensures that transient data is captured before it disappears.

Answer

Disk image, memory dump, process list, network connections

Answer

Process list, memory dump, disk image, network connections

Answer

Network connections, memory dump, process list, disk image