SSCP Incident Response and Recovery — Timed 25 Questions

Question 1

During which phase of the NIST SP 800-61 incident response lifecycle are incident response plan updates and lessons learned typically documented?

Accepted Answer

Post-Incident Activity. Option D is correct because the Post-Incident Activity phase of NIST SP 800-61 is specifically designed for conducting lessons learned meetings, documenting improvements, and updating the incident response plan based on findings from the incident. This phase ensures that the organization captures feedback to refine procedures, tools, and training for future incidents.

Answer

Preparation

Answer

Containment, Eradication, and Recovery

Answer

Detection and Analysis

Question 2

An organization's security team detects a potential data breach. After confirming the incident, they classify it as P2 (high severity) and begin containment. Which action should be performed FIRST to preserve evidence for forensic analysis?

Accepted Answer

Capture a memory dump using a tool like Magnet RAM Capture. When a high-severity incident (P2) is confirmed, the first priority for forensic preservation is capturing volatile data, which includes system memory (RAM). A memory dump using a tool like Magnet RAM Capture preserves running processes, network connections, encryption keys, and malware in memory that would be lost on shutdown or disconnection. This order follows the volatility principle: capture the most volatile data first before any other action that could alter the system state.

Answer

Disconnect the system from the network

Answer

Create a forensic image of the hard drive

Answer

Run an antivirus scan to remove malware

Question 3

A security analyst receives a chain of custody form for a hard drive that was seized from a suspected insider threat. The form shows that the drive was handled by three individuals over two days. Which of the following is the PRIMARY reason for maintaining a chain of custody?

Accepted Answer

To prove that the evidence has not been tampered with and is admissible in legal proceedings. The chain of custody is a documented chronological record of evidence handling, which is essential to demonstrate that the hard drive has not been altered, damaged, or substituted since seizure. Without this unbroken record, the evidence could be challenged as inadmissible in court under rules like the Federal Rules of Evidence (FRE) 901, which require authentication. This is the primary reason because legal admissibility hinges on proving integrity and continuity of custody.

Answer

To determine the cost of the forensic investigation

Answer

To ensure the hard drive is stored in a secure location

Answer

To track the productivity of forensic analysts

Question 4

During incident response, a team needs to isolate an infected workstation that is part of a critical manufacturing network. Which containment method is MOST appropriate to minimize disruption while preventing the spread of malware?

Accepted Answer

Place the workstation into a quarantine VLAN via switch configuration. Placing the workstation into a quarantine VLAN via switch configuration is most appropriate because it logically isolates the infected host from the rest of the network at Layer 2, preventing lateral spread of malware while allowing the manufacturing network to continue operating. This method uses 802.1Q VLAN tagging and access control lists (ACLs) on the switch to restrict traffic without physically disconnecting the device, which could disrupt time-sensitive manufacturing processes. It also preserves the ability to remotely manage or forensically image the workstation if needed.

Answer

Apply a host-based firewall rule to block all inbound traffic

Answer

Physically unplug the network cable

Answer

Disable the user's Active Directory account

Question 5

After a ransomware incident, an organization decides to restore data from backups. The RPO (Recovery Point Objective) is 4 hours. What does this RPO indicate?

Accepted Answer

Backups must be taken at least every 4 hours to ensure data loss does not exceed 4 hours. The Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time. An RPO of 4 hours means the organization can tolerate losing up to 4 hours of data, so backups must be taken at least every 4 hours to ensure that in the worst case, no more than 4 hours of data is lost. This directly dictates the backup frequency, not the recovery time or downtime.

Answer

The organization can tolerate 4 hours of downtime

Answer

The system must be restored within 4 hours of the incident

Answer

The recovery process will take a maximum of 4 hours

Question 6

Which DR testing type involves running recovery systems in parallel with production systems to verify functionality without impacting live operations?

Accepted Answer

Parallel test. A parallel test is the correct DR testing type because it involves running the recovery systems concurrently with the production systems. This allows the organization to verify that the backup systems function correctly and can handle the workload without any impact on live operations, as the production environment remains untouched.

Answer

Full interruption test

Answer

Simulation test

Answer

Tabletop exercise

Question 7

During the eradication phase of a malware incident, a security analyst removes malicious files and cleans registry persistence. What is the MOST critical additional step to prevent reinfection through the same vector?

Accepted Answer

Patching the vulnerability that was exploited. Patching the exploited vulnerability (Option A) is the most critical additional step because it removes the root cause of the infection. Without patching, the same attack vector (e.g., an unpatched SMB vulnerability like EternalBlue) remains open, allowing the malware to reinfect the system immediately after cleanup. Eradication is incomplete if the underlying flaw is not addressed, as the attacker can simply re-exploit the same weakness.

Answer

Running a full antivirus scan

Answer

Resetting all user passwords

Answer

Reimaging the system with a clean OS

Question 8

A security team is collecting evidence from a compromised server. They need to create a forensic image. Which of the following is the CORRECT procedure to ensure data integrity?

Accepted Answer

Use a write blocker to create a bit-for-bit copy, then compute MD5 hash of the original and the copy to verify they match. Option A is correct because forensic imaging requires a write blocker to prevent any modification to the original evidence, and a bit-for-bit copy preserves all data, including slack space and deleted files. Computing an MD5 hash of both the original and the copy verifies integrity by ensuring the hashes match, confirming no data alteration occurred during acquisition.

Answer

Take a photo of the screen and document file timestamps manually

Answer

Create a compressed image file using software without a write blocker

Answer

Boot the system and run a backup utility to copy files to an external drive

Question 9

What is the PRIMARY purpose of a lessons learned meeting after an incident?

Accepted Answer

To identify improvements in the incident response process. The primary purpose of a lessons learned meeting is to analyze the incident response process to identify what worked well and what did not, enabling the team to update procedures, playbooks, and tools to improve future responses. This aligns with the continuous improvement cycle mandated by frameworks like NIST SP 800-61, which emphasizes post-incident activity to refine detection and remediation capabilities.

Answer

To assign blame for the incident

Answer

To satisfy regulatory compliance requirements

Answer

To calculate the financial cost of the incident

Question 10

An analyst detects suspicious outbound traffic from a workstation to a known command-and-control IP. Which IoC blocking method is MOST appropriate as an immediate containment measure?

Accepted Answer

Block the IP address at the perimeter firewall. Blocking the IP address at the perimeter firewall is the most appropriate immediate containment measure because it directly cuts the outbound communication channel to the known command-and-control (C2) server. This stops data exfiltration and prevents the attacker from issuing further commands, buying time for deeper analysis. Firewall ACLs or blackhole routes can be applied in seconds without altering the endpoint, which is critical when the malware may have persistence mechanisms or anti-forensic capabilities.

Answer

Delete the malicious files from the system

Answer

Remove the malware from the workstation using EDR

Answer

Disable the user's account

Question 11

During a forensic investigation, an examiner needs to preserve volatile evidence. Which of the following lists the correct order of collection for volatile data?

Accepted Answer

RAM, network connections, running processes, hard drive image. Option C is correct because volatile data must be collected in order of decreasing volatility to prevent loss of critical evidence. RAM is the most volatile (lost on power-off), followed by network connections (state changes rapidly), then running processes (persist slightly longer), and finally the hard drive image (non-volatile). This order follows the RFC 3227 guidelines for evidence collection.

Answer

Hard drive image, network connections, running processes, RAM

Answer

Running processes, RAM, hard drive image, network connections

Answer

Network connections, hard drive image, RAM, running processes

Question 12

A company is developing a DR plan for a critical database. The maximum acceptable downtime is 2 hours, and the maximum data loss is 1 hour. What are the RTO and RPO?

Accepted Answer

RTO = 2 hours, RPO = 1 hour. The Recovery Time Objective (RTO) is the maximum acceptable downtime, which is 2 hours. The Recovery Point Objective (RPO) is the maximum acceptable data loss, which is 1 hour. Therefore, option A correctly identifies RTO = 2 hours and RPO = 1 hour.

Answer

RTO = 1 hour, RPO = 1 hour

Answer

RTO = 1 hour, RPO = 2 hours

Answer

RTO = 2 hours, RPO = 2 hours

Question 13

A security analyst is investigating a phishing incident that led to credential theft. Which TWO actions are appropriate during the containment phase? (Select TWO)

Accepted Answer

Reset the compromised user's password. Resetting the compromised user's password (A) immediately invalidates the stolen credentials, preventing the attacker from using them for further unauthorized access. This is a critical containment step because it cuts off the attacker's authenticated session and access to resources like email, VPN, or cloud services. Blocking the phishing domain at the email gateway (E) prevents additional users from receiving the phishing email, reducing the attack surface and stopping the spread of the incident. Both actions directly limit the impact and scope of the breach during the containment phase.

Answer

Update the incident response plan

Answer

Conduct a lessons learned meeting

Answer

Restore the user's machine from backup

Question 14

During a ransomware incident, the incident response team needs to recover encrypted servers. Which THREE steps are essential for successful recovery? (Select THREE)

Accepted Answer

Restore data from the most recent clean backup. Option A is correct because restoring from the most recent clean backup is the primary recovery method for ransomware incidents. It ensures that encrypted data can be recovered without paying the ransom, provided the backup was taken before the infection and is stored offline or immutable to prevent encryption. This aligns with the 3-2-1 backup strategy (three copies, two media types, one offsite) and is a core step in the NIST SP 800-61 incident response process.

Answer

Pay the ransom to obtain the decryption key

Answer

Delete all user accounts and recreate them

Question 15

Which TWO metrics are commonly tracked to measure the effectiveness of the incident response process? (Select TWO)

Accepted Answer

MTTD (Mean Time to Detect). MTTD (Mean Time to Detect) measures the average time from when an incident occurs until it is detected, directly reflecting the speed of detection capabilities. MTTR (Mean Time to Respond) measures the average time from detection to containment or remediation, indicating the efficiency of the response process. Both are key performance indicators (KPIs) for incident response effectiveness as defined in NIST SP 800-61 and industry frameworks.

Answer

SLA (Service Level Agreement) compliance percentage

Answer

MTBF (Mean Time Between Failures)

Answer

Number of firewall rules

Question 16

During which phase of the NIST SP 800-61 incident response lifecycle are lessons learned meetings conducted and metrics such as MTTD and MTTR tracked?

Accepted Answer

Post-Incident Activity. The Post-Incident Activity phase (D) is where lessons learned meetings are conducted and metrics such as Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) are tracked. This phase focuses on reviewing the incident response process, identifying improvements, and documenting findings to enhance future response efforts, as defined in NIST SP 800-61 Revision 2.

Answer

Containment, Eradication, and Recovery

Answer

Preparation

Answer

Detection and Analysis

Question 17

Which of the following is the FIRST step in the volatile evidence collection order when responding to an incident on a live system?

Accepted Answer

Capture a RAM dump using a tool like Magnet RAM Capture or WinPmem. Volatile evidence is collected starting with the most volatile (memory) to preserve data that can be lost when the system is powered down. RAM dump must be done first.

Answer

Disconnect the system from the network

Answer

Run antivirus scans to identify malware

Answer

Create a forensic image of the hard drive

Question 18

A security analyst receives an alert from the EDR system indicating that a workstation has been communicating with a known malicious IP address. The analyst confirms the alert and notes that the user is still logged in. Which immediate containment action should the analyst take FIRST?

Accepted Answer

Isolate the workstation using the EDR agent's network isolation capability. The first priority is to contain the incident by isolating the endpoint to prevent further communication. EDR agents often have a feature to isolate the host from the network immediately.

Answer

Create a full forensic image of the hard drive

Answer

Disable the user's Active Directory account

Answer

Block the malicious IP address at the firewall

Question 19

During the eradication phase of incident response, which of the following actions is MOST critical to ensure the threat is completely removed from a compromised system?

Accepted Answer

Removing malicious files and cleaning registry persistence. During the eradication phase, the primary goal is to ensure that no remnants of the attacker's presence remain on the system. Option C directly addresses this by removing malicious files and cleaning registry persistence, which eliminates backdoors, scheduled tasks, and other persistence mechanisms that could allow the threat to survive a reboot or evade detection. Without this step, even after patching or credential resets, the attacker could regain access through hidden persistence points.

Answer

Reimaging the system from a verified clean image

Answer

Resetting compromised user credentials

Answer

Patching the exploited vulnerability

Question 20

An organization's disaster recovery plan specifies an RTO of 4 hours and an RPO of 1 hour for its critical database. Which of the following DR site configurations BEST meets these requirements?

Accepted Answer

Warm site with hourly log shipping to a standby database. Option D is correct because a warm site with hourly log shipping to a standby database can achieve an RPO of 1 hour (by losing at most one hour of transactions) and an RTO of 4 hours (by applying the logs and bringing the standby online within that window). The standby database is kept nearly current with minimal lag, meeting both recovery objectives without the cost of full synchronous replication.

Answer

Cold site with weekly backup tapes shipped offsite

Answer

Cloud-based cold site with daily backups

Answer

Hot site with synchronous replication