SSCP Incident Response and Recovery Practice Test 3 — 15 Questions

Question 1

During a ransomware incident, the incident response team needs to recover encrypted servers. Which THREE steps are essential for successful recovery? (Select THREE)

Accepted Answer

Restore data from the most recent clean backup. Option A is correct because restoring from the most recent clean backup is the primary and most reliable way to recover encrypted data without trusting the attacker or paying the ransom. Option C is correct because patching the vulnerability that allowed the ransomware to enter prevents immediate re-infection once systems are restored and brought back online. Option E is correct because scanning restored systems verifies that malware has been eradicated and that no residual persistence mechanisms or reinfection vectors remain before returning them to production. Option B is not appropriate because paying the ransom does not guarantee a working decryption key, funds criminal activity, and may violate organizational or legal policy. Option D is not an essential recovery step because deleting and recreating all user accounts does not address the encrypted data or the malware itself and could cause unnecessary operational disruption.

Answer

Pay the ransom to obtain the decryption key

Answer

Delete all user accounts and recreate them

Question 2

Which TWO metrics are commonly tracked to measure the effectiveness of the incident response process? (Select TWO)

Accepted Answer

MTTD (Mean Time to Detect). MTTD (Mean Time to Detect) is correct because it directly measures how quickly an organization identifies an incident after it occurs, which is a core indicator of incident response effectiveness in the detection phase. MTTR (Mean Time to Respond) is correct because it measures how quickly the team responds to and contains or resolves an incident, reflecting the efficiency of the response process. Together, MTTD and MTTR are standard incident response metrics used to benchmark and improve detection and response capabilities. SLA compliance percentage is not specific to incident response effectiveness, as SLAs cover many service areas beyond security incidents. MTBF (Mean Time Between Failures) measures reliability of systems or components, not incident response performance. The number of firewall rules is a configuration or hygiene metric and does not measure how well incidents are detected or handled.

Answer

SLA (Service Level Agreement) compliance percentage

Answer

MTBF (Mean Time Between Failures)

Answer

Number of firewall rules

Question 3

During which phase of the NIST SP 800-61 incident response lifecycle are lessons learned meetings conducted and metrics such as MTTD and MTTR tracked?

Accepted Answer

Post-Incident Activity. The Post-Incident Activity phase (D) is where lessons learned meetings are conducted and metrics such as Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) are tracked. This phase focuses on reviewing the incident response process, identifying improvements, and documenting findings to enhance future response efforts, as defined in NIST SP 800-61 Revision 2.

Answer

Containment, Eradication, and Recovery

Answer

Preparation

Answer

Detection and Analysis

Question 4

A security analyst receives an alert from the EDR system indicating that a workstation has been communicating with a known malicious IP address. The analyst confirms the alert and notes that the user is still logged in. Which immediate containment action should the analyst take FIRST?

Accepted Answer

Isolate the workstation using the EDR agent's network isolation capability. Network isolation via the EDR agent is the fastest, least disruptive containment action that stops the active command-and-control channel while preserving volatile memory and forensic artifacts on the host. It cuts the malicious traffic immediately without tipping off the attacker through account lockouts or firewall changes that might be noticed. This aligns with the containment phase of incident response, where speed and evidence preservation are both prioritized.

Answer

Create a full forensic image of the hard drive

Answer

Disable the user's Active Directory account

Answer

Block the malicious IP address at the firewall

Question 5

An organization's disaster recovery plan specifies an RTO of 4 hours and an RPO of 1 hour for its critical database. Which of the following DR site configurations BEST meets these requirements?

Accepted Answer

Warm site with hourly log shipping to a standby database. A warm site with hourly log shipping to a standby database can achieve an RPO of 1 hour (by losing at most one hour of transactions) and an RTO of 4 hours (by applying the logs and bringing the standby online within that window). The standby database is kept nearly current with minimal lag, meeting both recovery objectives without the cost of full synchronous replication.

Answer

Cold site with weekly backup tapes shipped offsite

Answer

Cloud-based cold site with daily backups

Answer

Hot site with synchronous replication

Question 6

Which of the following is the PRIMARY purpose of establishing a chain of custody when handling digital evidence?

Accepted Answer

To prove that evidence has not been altered or tampered with from collection to presentation. The primary purpose of chain of custody is to create a documented, unbroken record of every person who handled the evidence, from collection through presentation in court. This documentation is critical to demonstrate that the digital evidence has not been altered, tampered with, or corrupted, thereby preserving its integrity and admissibility. Without a proper chain of custody, the opposing party can successfully challenge the evidence as unreliable or compromised.

Answer

To determine the priority of the incident

Answer

To ensure that evidence is stored in a secure location

Answer

To identify which forensic tools were used during analysis

Question 7

Which type of disaster recovery test involves running the DR systems alongside the production systems to validate functionality without impacting live operations?

Accepted Answer

Parallel test. A parallel test runs the disaster recovery systems concurrently with the production systems to verify that the DR environment can handle the workload without disrupting live operations. This approach validates data replication, application functionality, and failover readiness while keeping production untouched, making it the correct choice for non-disruptive validation.

Answer

Simulation test

Answer

Full interruption test

Answer

Tabletop exercise

Question 8

An incident responder needs to create a forensic image of a suspect hard drive. Which of the following steps is ESSENTIAL to ensure the integrity of the evidence?

Accepted Answer

Use a write blocker to prevent modification of the original drive. Using a write blocker is essential because it ensures that no data can be written to the suspect hard drive during the imaging process, preserving the original evidence in a forensically sound state. Without a write blocker, any operating system or imaging tool could inadvertently modify metadata (e.g., access timestamps) or the file system, which would compromise the integrity and admissibility of the evidence in legal proceedings.

Answer

Run an antivirus scan on the drive before imaging

Answer

Boot the suspect system to verify it is functional

Answer

Perform the imaging over the network to save time

Question 9

During a malware containment operation, the incident response team decides to isolate an infected endpoint using network access controls. However, the malware is spreading via removable media. Which additional containment measure should the team implement?

Accepted Answer

Group policy to disable USB ports or restrict autorun. The malware is spreading via removable media, so disabling USB ports or restricting autorun via Group Policy directly cuts off the propagation vector. Network access controls (NAC) isolate the endpoint from the network, but they do not prevent the malware from copying itself to USB drives or executing via autorun.inf. Group Policy can disable the storage device class (e.g., via 'Removable Storage Access' policies) or disable autorun entirely (via 'Turn off Autoplay' policy), stopping the spread at the physical media level.

Answer

Block the malware's command-and-control IP at the firewall

Answer

Disable the user's account and force a password reset

Answer

Reimage the infected system immediately

Question 10

An organization has suffered a ransomware attack that encrypted files on several file servers. The incident response team is planning recovery. Which TWO actions should be performed to verify that the restored systems are clean before returning them to production? (Select TWO)

Accepted Answer

Run a full antivirus and anti-malware scan on the restored systems. Option C is correct because running a full antivirus and anti-malware scan on the restored systems is a direct verification step that checks the restored data and OS for any residual malware, ransomware payloads, or infected files before the systems are trusted again. Option E is correct because monitoring the restored systems for reinfection or anomalous behavior over a period of time provides ongoing validation that no dormant persistence mechanisms, scheduled tasks, or command-and-control callbacks survived the recovery process. Option A is not a verification action; restoring from the most recent backup is a recovery step, and that backup itself may contain the ransomware or an earlier compromise. Option B does not verify system cleanliness; changing user passwords is a containment/credential-hygiene measure and does nothing to detect malware on the restored hosts. Option D is also not a verification step; applying OS security patches remediates known vulnerabilities but does not confirm that the restored systems are free of the ransomware or other malware.

Answer

Restore the systems from the most recent backup

Answer

Change all user passwords associated with the systems

Answer

Apply all security patches to the operating system

Question 11

A forensic investigator is collecting evidence from a compromised Windows server. According to the order of volatility, which THREE pieces of evidence should be collected FIRST? (Select THREE)

Accepted Answer

Network connections and open ports. According to the order of volatility, the most perishable data must be captured first because it disappears when the system is powered off or changes rapidly. Option C (Network connections and open ports) is correct because active TCP/UDP sessions, listening sockets, and ARP/routing state exist only in memory and vanish immediately on shutdown, so tools like netstat, ss, or Get-NetTCPConnection must run first. Option D (Contents of RAM (memory dump)) is correct because physical memory holds encryption keys, injected code, and uncommitted data that is irretrievably lost once power is removed, making it the highest-priority acquisition. Option E (List of running processes) is correct because the process table, PIDs, parent-child relationships, and loaded modules are volatile kernel structures that change second by second and cannot be recovered from a later disk image. Option A (System event logs) is not among the first tier because, although logs are valuable, they are typically persisted to disk (.evtx files) and survive until overwritten, so they are collected after memory-resident artifacts. Option B (Hard drive image) is not among the first tier because disk contents are the least volatile and remain intact while live memory and network state are captured beforehand.

Answer

System event logs

Answer

Hard drive image

Question 12

During the preparation phase of incident response, which TWO components are essential for an effective incident response plan? (Select TWO)

Accepted Answer

A communication plan with contact information for key stakeholders. Option C is correct because an incident response plan must include a communication plan with up-to-date contact information for key stakeholders (e.g., incident handlers, management, legal, PR, and law enforcement) so that notifications and escalations occur quickly and in the proper order during an incident. Option E is correct because detailed recovery procedures for each critical system provide the documented, tested steps (such as restoration order, RTO/RPO targets, and system-specific rebuild or failover instructions) needed to return operations to normal after containment and eradication. Option A is not essential to the plan itself, since vendor lists support logistics but are not a core IR plan component. Option B is incorrect and a security risk, as storing all employee passwords violates least privilege and credential-management best practices. Option D, while useful for scoping and containment, is supporting documentation rather than one of the two essential components emphasized here.

Answer

A list of approved vendors for hardware replacement

Answer

A list of all employee passwords

Answer

Network topology diagrams

Question 13

An organization is developing its incident response plan. According to NIST SP 800-61, which phase should include establishing a communication plan, acquiring necessary tools, and conducting exercises?

Accepted Answer

Preparation. According to NIST SP 800-61, the Preparation phase is where the organization establishes a communication plan, acquires necessary tools (e.g., forensic workstations, imaging software, network monitoring tools), and conducts exercises (e.g., tabletop exercises or full-scale simulations) to ensure readiness. This phase lays the foundation for all subsequent incident response activities by ensuring resources and procedures are in place before an incident occurs.

Answer

Post-Incident Activity

Answer

Detection and Analysis

Answer

Containment, Eradication, and Recovery

Question 14

A security analyst detects a workstation communicating with a known command-and-control server. The workstation is running critical applications. What should be the analyst's first step according to the NIST incident response lifecycle?

Accepted Answer

Isolate the workstation from the network while preserving volatile data.. According to the NIST incident response lifecycle, the first priority is containment. Isolating the workstation from the network stops communication with the command-and-control server while preserving volatile data (e.g., memory, running processes, network connections) for forensic analysis. Powering off would destroy this critical evidence, and running a scan or waiting for instructions delays containment and risks further compromise.

Answer

Power off the workstation immediately to stop the communication.

Answer

Run a full antivirus scan on the workstation.

Answer

Notify management and wait for instructions.

Question 15

An organization has experienced a ransomware attack. After containing the incident, the response team plans to restore systems from backups. Which step is most critical before restoring production systems?

Accepted Answer

Patch the exploited vulnerability and ensure the backup is free of malware.. Restoring from backups while the original vulnerability remains unpatched would allow the ransomware to reinfect the systems immediately. Additionally, if the backup itself contains malware (e.g., the ransomware encrypted the backup repository), restoring it would reintroduce the infection. Patching the exploited vulnerability and verifying the backup is clean ensures a safe restoration point, breaking the attack chain.

Answer

Verify the integrity of backup data by restoring to an isolated test environment.

Answer

Notify law enforcement immediately.

Answer

Disconnect all systems from the network.