SSCP Incident Response and Recovery Practice Test 4 — 15 Questions

Question 1

Which of the following is the primary purpose of a chain of custody form in digital forensics?

Accepted Answer

To track the possession and handling of evidence from collection to presentation. Chain of custody documents who handled the evidence, when, and why, ensuring it remains admissible in court.

Answer

To document the steps taken to contain an incident

Answer

To record the hash values of forensic images

Answer

To provide a list of approved forensic tools

Question 2

An incident responder needs to create a forensic image of a suspect hard drive. What is the correct procedure to ensure evidence integrity?

Accepted Answer

Use a write blocker, create a bit-for-bit image, and compute SHA-256 hash before and after imaging.. Forensic imaging requires a write blocker to prevent any modification to the original evidence, a bit-for-bit (sector-level) copy to capture all data including slack space and deleted files, and cryptographic hashing (SHA-256) both before and after imaging to verify that the image is an exact, unaltered duplicate of the source. This process ensures the integrity and admissibility of digital evidence in legal proceedings.

Answer

Boot the suspect system and use imaging software to copy data.

Answer

Remove the drive and place it in anti-static bag, then ship to lab.

Answer

Connect the drive directly to forensic workstation, copy all files, and compute MD5 hash of copy.

Question 3

A security team detects lateral movement within the network. Which containment strategy should be applied first to limit the spread of the threat?

Accepted Answer

Isolate the affected systems by disconnecting them from the network.. Isolating affected systems by disconnecting them from the network is the immediate priority because it physically or logically severs the attacker's ability to propagate laterally via SMB, RDP, or other network protocols. This containment step stops the spread without destroying forensic evidence, which would be lost if systems were reimaged or powered off prematurely.

Answer

Disable user accounts associated with compromised systems.

Answer

Block the attacker's IP addresses at the perimeter firewall.

Answer

Reimage all compromised systems immediately.

Question 4

During a post-incident review, the incident response team identifies that the mean time to detect (MTTD) was 14 days. Which improvement would most directly reduce MTTD?

Accepted Answer

Deploying additional endpoint detection and response (EDR) sensors with automated alerting. Deploying additional EDR sensors with automated alerting directly reduces the time between an incident's occurrence and its detection by providing continuous monitoring and immediate notification of suspicious activities. This shortens the MTTD because automated alerts eliminate the delay inherent in manual log review or periodic checks, enabling the incident response team to react within minutes rather than days.

Answer

Implementing stricter access control policies

Answer

Conducting more frequent tabletop exercises

Answer

Increasing the frequency of full system backups

Question 5

Which type of disaster recovery test involves running the DR systems alongside production systems to verify functionality without impacting operations?

Accepted Answer

Parallel test. A parallel test runs the disaster recovery (DR) systems in a live, non-disruptive manner alongside the production environment. This allows the organization to validate that the DR systems can process transactions and handle workloads correctly without affecting the primary production operations, making it the correct choice for verifying functionality without impact.

Answer

Tabletop exercise

Answer

Full interruption test

Answer

Simulation test

Question 6

An incident responder is handling a malware outbreak. The malware has been identified as a fileless threat that persists via registry run keys. Which eradication step is most appropriate?

Accepted Answer

Remove the malicious registry entries and restart the systems.. Fileless malware that persists via registry run keys can be eradicated by removing the malicious registry entries and restarting the systems. This breaks the persistence mechanism without requiring full reimaging, as the malware does not write files to disk and relies on registry-based auto-start locations (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) to execute after reboot.

Answer

Disable the affected user accounts.

Answer

Reimage all affected systems.

Answer

Run an antivirus scan on the systems.

Question 7

During the detection and analysis phase, an analyst receives a user report of unusual system behavior. The analyst reviews logs and finds several failed login attempts followed by a successful login from an unusual IP address. What is the next step?

Accepted Answer

Classify the incident and determine if escalation is needed.. During the detection and analysis phase of incident response, the primary goal is to assess the validity and scope of a potential security event before taking action. The analyst has observed indicators of a possible brute-force attack (failed logins followed by a successful login from an unusual IP), which requires classification to determine if it meets the criteria for a security incident. Escalation may be needed to involve a higher-tier incident response team or to initiate formal containment procedures, as per NIST SP 800-61 guidelines.

Answer

Immediately disconnect the user's workstation from the network.

Answer

Rebuild the user's workstation from a known-good image.

Answer

Ignore the event as it may be a false positive.

Question 8

An incident responder is collecting volatile evidence from a compromised Linux server. Which TWO of the following should be collected first? (Select two.)

Accepted Answer

List of active network connections using netstat. In incident response, volatile data is data that will be lost when the system is powered off. Active network connections (captured via netstat) and the contents of RAM (captured via LiME) are the most volatile, as they change constantly and are lost immediately upon shutdown. Collecting these first preserves critical evidence of current attacker activity and in-memory artifacts like rootkits or encryption keys.

Answer

Disk image of the system drive

Answer

System log files from /var/log

Answer

Hardware configuration inventory

Question 9

A company is selecting a disaster recovery site for its critical applications. Which THREE characteristics differentiate a warm site from a cold site? (Select three.)

Accepted Answer

A warm site has environmental controls (power, cooling) already in place.. A warm site is partially configured with environmental controls such as power, cooling, and network connectivity already in place. This distinguishes it from a cold site, which lacks these infrastructure components and requires significant setup time. The presence of environmental controls is a key differentiator that allows a warm site to become operational faster than a cold site, though it still requires data restoration from backups before full recovery.

Answer

A warm site is typically ready to operate within hours.

Answer

A warm site has live data replication from the primary site.

Question 10

A security analyst receives a user report about a workstation exhibiting unusual behavior, such as unexpected pop-ups and slow performance. The analyst first checks the antivirus logs and finds no alerts. What is the NEXT step in the detection and analysis phase?

Accepted Answer

Classify the severity of the potential incident. According to incident response best practices, after initial detection, the next step is to classify the severity of the potential incident to prioritize response efforts.

Answer

Escalate the incident to senior management

Answer

Isolate the workstation from the network immediately

Answer

Perform a forensic memory capture

Question 11

What is the primary purpose of establishing a chain of custody for digital evidence?

Accepted Answer

To maintain evidence integrity and track handling. The primary purpose of establishing a chain of custody for digital evidence is to maintain evidence integrity and track every person who handled the evidence from collection through presentation in court. This process ensures that the evidence has not been tampered with, altered, or corrupted, which is critical for admissibility under legal standards such as the Federal Rules of Evidence (FRE) Rule 901. By documenting each transfer with timestamps, signatures, and hash values (e.g., MD5 or SHA-256), the chain of custody provides a verifiable audit trail that supports the evidence's authenticity and reliability.

Answer

To reduce the size of evidence for storage

Answer

To encrypt evidence for secure transmission

Answer

To prioritize which evidence to analyze first

Question 12

An organization is restoring a critical database from a backup after a ransomware attack. Which of the following steps should be performed BEFORE restoring the data to ensure the restoration is successful and secure?

Accepted Answer

Verify the integrity of the backup and patch the exploited vulnerability. Verifying backup integrity (e.g., using checksums or restore tests) ensures the backup is not corrupted or incomplete, which is critical after a ransomware attack where backups may also be targeted. Patching the exploited vulnerability (e.g., applying a security update or disabling the vulnerable service) prevents re-infection during or after the restore, ensuring the recovery is secure. Without these steps, restoring a compromised or incomplete backup could lead to data loss or immediate re-encryption by the same ransomware.

Answer

Notify users that the system will be available in one hour

Answer

Disconnect the backup server from the network

Answer

Immediately restore the most recent backup to minimize data loss

Question 13

A company's disaster recovery plan specifies an RTO of 4 hours for its customer relationship management (CRM) system. Which of the following DR site types is MOST appropriate to meet this RTO?

Accepted Answer

Hot site. A hot site is fully configured with hardware, software, and live data replication, enabling recovery within minutes to a few hours. Since the RTO is 4 hours, a hot site can meet this requirement by allowing immediate failover without the need for extensive setup or data restoration.

Answer

Warm site

Answer

Mobile site

Answer

Cold site

Question 14

During a full interruption test of the disaster recovery plan, which of the following is the PRIMARY risk?

Accepted Answer

Extended downtime or data loss if the plan fails. Full interruption tests involve actually failing over to the DR site, which may cause extended downtime or data loss if the plan has flaws or if the DR site fails.

Answer

Vendor unavailability during the test

Answer

Employee confusion about their roles

Answer

Cost overruns due to overtime pay

Question 15

A security analyst is responding to a malware incident on a Windows server. Which TWO actions should be taken to properly collect volatile evidence?

Accepted Answer

Capture a memory dump using WinPmem. WinPmem is a dedicated memory acquisition tool that captures the contents of RAM, which contains critical volatile evidence such as running processes, open network connections, and injected code. Since volatile data is lost on power loss or reboot, capturing a memory dump before any other action preserves this evidence for forensic analysis.

Answer

Reboot the system to clear malware from memory

Answer

Delete suspicious files to prevent further infection

Answer

Perform a full disk image using a write blocker