SSCP Incident Response and Recovery Practice Test 5 — 15 Questions

Question 1

During a forensic investigation, an examiner creates a bit-for-bit copy of a hard drive using a write blocker. What is the purpose of using a write blocker?

Accepted Answer

To prevent modification of the original evidence. A write blocker is a hardware or software device that intercepts and blocks any write commands from the forensic workstation to the source drive, ensuring that the original evidence remains unaltered during acquisition. This is critical for maintaining the integrity and admissibility of digital evidence in legal proceedings, as any modification could compromise the chain of custody and forensic soundness.

Answer

To encrypt the data during transfer

Answer

To speed up the imaging process

Answer

To verify the hash of the original drive

Question 2

An organization is restoring a critical database from a backup after a ransomware attack. Which of the following steps should be performed BEFORE restoring the data to ensure the restoration is successful and secure?

Accepted Answer

Verify the integrity of the backup and patch the exploited vulnerability. Verifying backup integrity (e.g., using checksums or restore tests) ensures the backup is not corrupted or incomplete, which is critical after a ransomware attack where backups may also be targeted. Patching the exploited vulnerability (e.g., applying a security update or disabling the vulnerable service) prevents re-infection during or after the restore, ensuring the recovery is secure. Without these steps, restoring a compromised or incomplete backup could lead to data loss or immediate re-encryption by the same ransomware.

Answer

Notify users that the system will be available in one hour

Answer

Disconnect the backup server from the network

Answer

Immediately restore the most recent backup to minimize data loss

Question 3

Which metric is used to measure the average time it takes to detect an incident?

Accepted Answer

Mean Time to Detect (MTTD). Mean Time to Detect (MTTD) is the correct metric because it specifically measures the average time elapsed between the occurrence of an incident and its detection by monitoring systems or security personnel. This metric is critical in incident response as it directly impacts the window of opportunity for attackers to cause damage before containment begins.

Answer

Recovery Point Objective (RPO)

Answer

Mean Time to Resolve (MTTR)

Answer

Recovery Time Objective (RTO)

Question 4

After a security incident, the incident response team holds a lessons learned meeting. What is the PRIMARY outcome of this meeting?

Accepted Answer

Identify improvements to the incident response process. The primary outcome of a lessons learned meeting is to identify improvements to the incident response process. This meeting focuses on analyzing what worked well and what did not, leading to actionable changes in policies, procedures, and tools to enhance future incident handling. It is a key component of the continuous improvement cycle mandated by frameworks like NIST SP 800-61.

Answer

Permanently delete all evidence related to the incident

Answer

Inform the media about the incident details

Answer

Assign blame for the incident

Question 5

A company's disaster recovery plan specifies an RTO of 4 hours for its customer relationship management (CRM) system. Which of the following DR site types is MOST appropriate to meet this RTO?

Accepted Answer

Hot site. A hot site is fully configured with hardware, software, and live data replication, enabling recovery within minutes to a few hours. Since the RTO is 4 hours, a hot site can meet this requirement by allowing immediate failover without the need for extensive setup or data restoration.

Answer

Warm site

Answer

Mobile site

Answer

Cold site

Question 6

During a full interruption test of the disaster recovery plan, which of the following is the PRIMARY risk?

Accepted Answer

Extended downtime or data loss if the plan fails. A full interruption test simulates a complete disaster by actually shutting down the primary site and failing over to the recovery site. The primary risk is that if the recovery plan fails, the organization may experience extended downtime or data loss because the production environment is already down and cannot be quickly restored. This directly impacts business continuity and is the most severe consequence.

Answer

Vendor unavailability during the test

Answer

Employee confusion about their roles

Answer

Cost overruns due to overtime pay

Question 7

A security analyst is responding to a malware incident on a Windows server. Which TWO actions should be taken to properly collect volatile evidence?

Accepted Answer

Capture a memory dump using WinPmem. Option D is correct because capturing a memory dump with WinPmem preserves the contents of RAM, which is the most volatile evidence and is lost the moment the system is powered off or rebooted. Option E is correct because recording active network connections (e.g., via netstat or similar tools) documents volatile state such as established sessions, listening ports, and remote endpoints that would otherwise disappear. Options A and B are wrong because rebooting or deleting files destroys volatile evidence and alters the system state, violating order-of-volatility principles. Option C is incorrect here because a full disk image with a write blocker captures non-volatile storage, not volatile evidence such as memory or live network connections.

Answer

Reboot the system to clear malware from memory

Answer

Delete suspicious files to prevent further infection

Answer

Perform a full disk image using a write blocker

Question 8

During a post-incident review, the incident response team identifies several areas for improvement. According to NIST SP 800-61, which THREE activities are typically part of the post-incident activity phase?

Accepted Answer

Update the incident response plan based on findings. Option B is correct because NIST SP 800-61's post-incident activity phase explicitly includes using the lessons learned and review findings to update the incident response plan, policies, and procedures so future responses improve. Option D is correct because holding a lessons learned meeting (post-incident review) with all involved parties is a core recommended activity in this phase, used to identify what happened, what was done well, and what needs improvement. Option E is correct because NIST SP 800-61 calls for using incident data to develop and track metrics, such as mean time to detect (MTTD) and mean time to recover/repair (MTTR), to measure and improve the incident response capability over time. Option A is not part of the post-incident activity phase; patching is a remediation/eradication action performed during incident handling, not a blanket post-incident review activity. Option C is likewise incorrect because immediately replacing all affected hardware is a recovery/remediation decision made during the handling phase based on the specific incident, not a standard post-incident review activity.

Answer

Patch all systems in the organization as a precaution

Answer

Replace all affected hardware immediately

Question 9

A company is conducting a disaster recovery test. Which TWO types of tests involve minimal risk to production operations?

Accepted Answer

Tabletop exercise. A tabletop exercise (A) is correct because it is a discussion-based test in which stakeholders talk through disaster recovery roles, procedures, and decision points without touching or reconfiguring any production systems, so it carries essentially no operational risk. A walkthrough (D) is also correct because participants verbally trace each step of the DR plan against documentation and expected actions, again without executing failover or activating alternate sites, keeping production untouched. By contrast, a simulation test (B) can involve activating recovery mechanisms or alternate processing in a controlled but still potentially disruptive manner, and a parallel test (C) runs the recovery site alongside production, which introduces cost, data-synchronization, and configuration risks. A full interruption test (E) is the riskiest option because it actually shuts down or takes production offline to fail over completely, which is unacceptable when minimal risk is required.

Answer

Simulation test

Answer

Parallel test

Answer

Full interruption test

Question 10

During the containment phase of incident response, a security analyst identifies malware on a critical server. Which TWO actions should be taken FIRST to contain the threat and preserve evidence? (Choose two.)

Accepted Answer

Disconnect the network cable from the server.. Option C is correct because physically disconnecting the network cable from the server immediately isolates the host, preventing lateral movement, command-and-control callbacks, and data exfiltration while the incident is being contained. Option E is correct because capturing RAM with a tool like WinPmem preserves volatile evidence such as running processes, network connections, injected code, and encryption keys that would be lost on shutdown or reboot, and it should be done before any power state change. Option A is not among the first actions because a full forensic disk image is time-consuming and is typically acquired after volatile memory is preserved and the host is isolated. Option B is wrong because rebooting destroys volatile memory evidence and may allow malware to re-infect the system or trigger destructive payloads. Option D is wrong because running a full antivirus scan alters system state, can quarantine or delete files, and does not isolate the server from the network, thereby contaminating evidence and leaving the threat active.

Answer

Capture a forensic image of the hard drive.

Answer

Reboot the server to clear the malware from memory.

Answer

Run a full antivirus scan on the server.

Question 11

After a ransomware incident, the incident response team is conducting recovery. Which THREE steps are essential to ensure a secure restoration and prevent reinfection? (Choose three.)

Accepted Answer

Perform a full system scan with updated antivirus on the restored system.. Option C is correct because after restoring data or a system image, a full scan with up-to-date antivirus signatures is needed to detect any residual malware that may have been present in the backup or reintroduced during restoration, preventing reinfection. Option D is correct because ransomware and other malware often establish persistence via Run/RunOnce registry keys, services, scheduled tasks, and Startup folders; these must be identified and removed so the threat cannot re-execute after reboot. Option E is correct because the initial compromise vector—such as an unpatched SMB, RDP, or VPN vulnerability—must be remediated; otherwise the same exploit can be used again to reinfect the restored system. Option A is not appropriate because restoring from a backup without verifying its integrity risks reintroducing corrupted or already-infected data. Option B is not appropriate because reconnecting to the network immediately after restoration, before scanning, patching, and removing persistence, exposes the system to reinfection and lateral movement.

Answer

Restore from the most recent backup available, regardless of its integrity.

Answer

Reconnect the system to the network immediately after restoration to test functionality.

Question 12

During a post-incident review of a data breach, the incident response team is evaluating the chain of custody for forensic evidence. Which THREE practices demonstrate proper evidence handling? (Choose three.)

Accepted Answer

A write blocker was used when creating a forensic image of the disk.. Option B is correct because a hardware or software write blocker prevents any modification to the original disk during imaging, preserving its integrity and admissibility as evidence. Option D is correct because comparing the hash (e.g., MD5 or SHA-256) of the forensic image to the hash of the original disk proves the image is a bit-for-bit duplicate and has not been altered. Option E is correct because maintaining an unbroken chain of custody requires every handler to record their name, date, time, and purpose of access, ensuring accountability and traceability. Option A is wrong because analyzing the original drive directly risks altering metadata and destroying evidence; instead, a forensic image should be analyzed. Option C is wrong because hashes must be computed immediately upon acquisition (before analysis) to establish a baseline for integrity verification, not only afterward.

Answer

The original hard drive was used directly for analysis to avoid delays.

Answer

MD5 hashes were computed only after the analysis was complete.

Question 13

A security analyst receives an alert from the SIEM about a possible malware infection on a workstation. The analyst confirms the infection and begins containment. Which of the following actions BEST aligns with the containment phase of the NIST SP 800-61 incident response lifecycle?

Accepted Answer

Isolate the workstation from the network by disabling its switch port.. Containment aims to limit the damage and prevent further spread of the incident. Isolating the infected workstation from the network achieves this by cutting off communication, which can stop lateral movement and command-and-control traffic. Other actions like reimaging or scanning are part of later phases such as eradication or recovery, and documentation, while necessary, does not contain the threat.

Answer

Immediately reimage the workstation to remove the malware.

Answer

Run a full antivirus scan on the workstation.

Answer

Document the incident in the ticketing system.

Question 14

A financial services firm has just contained a ransomware incident on a file server. The incident response plan requires a formal post-incident activity phase. The CISO wants to know what the team should do FIRST to improve future response. Which action best aligns with NIST SP 800-61 post-incident activity?

Accepted Answer

Conduct a lessons learned meeting with all involved parties to review the incident timeline and response actions.. NIST SP 800-61 defines post-incident activity as including lessons learned to improve future response. Holding a lessons learned meeting with involved parties captures what happened, what was effective, and what needs improvement. This should occur before recovery actions or plan updates, because the team's memory is freshest and evidence is still available. The other actions are either recovery steps or communication tasks that do not directly fulfill the improvement goal.

Answer

Update the incident response plan with new detection signatures based on the ransomware variant.

Answer

Immediately reimage the server and restore data from the most recent backup.

Answer

Notify the board of directors and external regulators about the incident.

Question 15

A forensic examiner is preparing to acquire a disk image from a compromised server. The server is still running and contains critical evidence in volatile memory. According to NIST SP 800-86, which of the following should the examiner do FIRST?

Accepted Answer

Capture the contents of RAM using a memory acquisition tool.. The order of volatility in digital forensics dictates that the most perishable evidence, such as RAM and running processes, must be collected first. NIST SP 800-86 emphasizes capturing volatile memory before disk imaging or shutting down the system. This ensures that critical evidence like encryption keys, network connections, and malware artifacts are preserved for analysis.

Answer

Document the system's physical configuration and cable connections.

Answer

Create a bit-for-bit image of the hard drive.

Answer

Shut down the server to preserve the disk state.