CCNA Sscp Incident Response Questions

A write blocker prevents any modification to the source drive, bit-for-bit imaging captures an exact replica including slack space, and SHA-256 hashes computed before and after verify the image matches the original, satisfying the evidence-integrity requirement.

Automating manual steps with existing orchestration tools can significantly reduce recovery time without major new spending. Many organizations already have configuration management or scripting platforms that can be leveraged to streamline failover and recovery. This approach directly addresses the gap between the 6-hour manual process and the 2-hour RTO. It also reduces human error and improves consistency, making it the most appropriate recommendation given the budget constraint.

Scanning the restored system with current antivirus signatures detects any residual malware or dormant payloads that survived restoration, satisfying the requirement to prevent reinfection. Because ransomware often leaves droppers or secondary implants, this verification step confirms the restored host is genuinely clean before returning it to production.

CDP captures every change and can provide an RPO of near zero, easily meeting the 15-minute requirement. Asynchronous replication to a hot site allows for rapid recovery, often within minutes, satisfying the 2-hour RTO. This combination ensures minimal data loss and quick restoration, aligning with the critical database's needs.

RTO defines the maximum tolerable downtime, so 2 hours maps directly to RTO. RPO defines the maximum tolerable data loss measured in time, so 1 hour maps to RPO. The option matches both stated constraints exactly.

Failed logins followed by a success from an unusual IP indicate probable compromise, so the analyst must classify the incident and decide whether escalation is warranted. Classification determines severity and the appropriate response path within detection and analysis.

According to NIST SP 800-86 and the order of volatility, volatile data such as RAM contents should be collected first because it is lost when the system is powered off. Capturing RAM preserves critical evidence like running processes, network connections, and encryption keys. This step must precede disk imaging to ensure that the most perishable evidence is not lost.

According to the order of volatility, memory (RAM) is more volatile than disk storage and network connections. Capturing RAM first preserves critical evidence such as running processes, network connections, encryption keys, and malware that may only exist in memory. If the system is shut down or the memory is overwritten, this evidence is lost forever. Tools like LiME or AVML allow for memory acquisition on Linux systems while minimizing impact on the running system.

One primary objective of a lessons learned meeting is to determine the root cause of the incident. By understanding what allowed the incident to occur, the team can implement corrective actions to prevent similar incidents in the future. This analysis is a core part of the post-incident activity phase in NIST SP 800-61.

RPO defines the maximum tolerable data loss measured in time, so a four-hour RPO means backups must run at least every four hours; otherwise a failure could destroy more than four hours of transactions, breaching the objective.

A hot site maintains continuously synchronised hardware, data and applications, enabling near-immediate failover well inside the four-hour RTO. Unlike warm or cold sites, which require restoration from backups or hardware provisioning, it satisfies the stem's demanding recovery time constraint for the business-critical CRM system.

The primary purpose of a lessons learned meeting is to review the incident and identify changes to processes, tools, and training that will improve future prevention and response. In this retail scenario, the unpatched web server highlights a need to strengthen patch management and vulnerability scanning, which the meeting should capture as actionable improvements.

Active network connections and their associated process IDs are volatile and can reveal command-and-control (C2) communications or data exfiltration. This information is lost when the system is shut down or the connection is terminated. Collecting it early helps identify the malware's external infrastructure and affected processes. Tools like netstat and Get-NetTCPConnection can capture this data quickly.

The RPO is 15 minutes, meaning the organization can tolerate losing at most 15 minutes of data. The backup used was 2 hours old, so up to 2 hours of data would be lost, exceeding the RPO. Even though the restore time was within the RTO, the data loss exceeds the RPO, so the test failed from a data loss perspective. This makes the statement correct.

Proper documentation during incident response serves multiple critical purposes: it creates an admissible record for legal action, demonstrates compliance with regulations and standards, and provides data for lessons learned and process improvement. Without accurate documentation, the organization may be unable to pursue legal remedies, face compliance penalties, or fail to understand the root cause. This is a fundamental requirement in NIST SP 800-61 and other incident response frameworks.

Validation is a core detection and analysis activity: responders correlate alerts, indicators, and impact to confirm whether an event is a real incident. This step prevents wasted resources on false positives and determines the appropriate response. In the ransomware scenario, validating the alert against known ransomware indicators and assessing clinical impact directly supports the decision to escalate or dismiss.

The primary purpose of a write blocker is to prevent any write commands from reaching the evidence drive during imaging. This ensures that the original evidence remains unaltered, preserving its integrity for forensic analysis and legal proceedings. Without a write blocker, the imaging tool or OS could inadvertently write to the drive, contaminating the evidence.

Network connections and open ports reside in memory and change or disappear within seconds, placing them near the top of the order of volatility. Collecting them first satisfies the stem's requirement to gather the most perishable evidence before it is lost.

NIST SP 800-61 places revising the incident response plan within post-incident activity, so lessons identified during review feed back into procedures, contact lists, and controls. This closes the improvement loop and better prepares the team for subsequent incidents.

The chain of custody form records every transfer, custodian, and handling action for evidence, creating an unbroken audit trail from seizure through analysis to courtroom presentation. This documentation lets the court verify that nothing was altered, supporting evidence admissibility.

EDR sensors with automated alerting detect malicious endpoint behaviour in near real time, collapsing the 14-day detection gap. Faster telemetry and alert generation directly shorten the time between compromise and discovery, which is precisely what MTTD measures.

A chain of custody form records the chronological history of evidence, including who collected it, when, and every transfer of possession. It ensures evidence integrity and admissibility in legal proceedings. The legal team's request for documentation of possession at every point directly matches the purpose of a chain of custody form, making it the correct answer.

Post-Incident Activity is the NIST SP 800-61 phase where the incident is reviewed after containment and recovery. Lessons learned meetings occur here, and metrics including MTTD and MTTR are tracked to improve future response. This directly satisfies the stem's requirement for the phase covering retrospective analysis and performance measurement.

A tabletop exercise poses minimal risk because participants discuss disaster recovery roles and procedures verbally, without touching production systems or activating failover. This satisfies the stem's constraint of testing readiness while avoiding any operational impact, unlike full interruption or parallel tests that consume resources or disrupt live services.

Preparation covers building incident response capability before incidents occur, including developing the communication plan, procuring tools and resources, and running exercises to validate readiness. NIST SP 800-61 places all three activities in this phase, preceding detection, containment, and post-incident work.

Chain of custody documents who collected, accessed and transferred each artefact, with timestamps and signatures. This unbroken audit trail preserves evidence integrity and admissibility, proving the data was not altered or substituted between seizure and presentation, which satisfies the requirement to track handling throughout the investigation.

A parallel test runs DR systems concurrently with production, letting recovery capabilities be validated under realistic load without disrupting live operations. Unlike full interruption, it confirms functionality while production continues serving users, satisfying the non-impact constraint.

Patching the exploited vulnerability closes the original entry vector, so the attacker cannot reinfect the host through the same flaw. Removing files and registry persistence alone leaves that vector open, allowing immediate recompromise during or after eradication.

WinPmem captures physical memory, preserving running processes, injected code and encryption keys that vanish on shutdown or reboot. This satisfies the volatile-evidence requirement, since RAM is lost first and must be acquired before any disk imaging or power-off.

The lessons learned meeting reviews what occurred, what worked and what failed, then produces actionable recommendations to strengthen the incident response plan, tools and procedures. Its primary outcome is documented process improvement, not blame or immediate remediation of the affected systems.

A parallel test runs recovery systems alongside production, processing the same transactions in parallel, so functionality is verified without disrupting live operations. This directly satisfies the stem's constraint of validating recovery capability while leaving production systems untouched.

Memory is more volatile than network connections, so it should be first.

Blocking the command-and-control IP at the perimeter firewall immediately severs the workstation's outbound channel, halting data exfiltration and further instruction. This satisfies the containment constraint by stopping active communication fast, before deeper host remediation begins.

The first step in determining if the traffic is malicious is to analyze the packets themselves. This includes examining payloads for known malware signatures, checking for unusual protocols or patterns, and looking at metadata such as packet sizes, timing, and frequency. This analysis can reveal if the traffic is encrypted command-and-control, data exfiltration, or benign. It provides the evidence needed to justify further actions.

Network isolation blocks lateral spread over the LAN but does nothing against USB-borne propagation, since removable media bypasses network access controls entirely. Disabling USB ports or restricting autorun via Group Policy closes that physical channel, satisfying the stem's requirement to contain malware spreading through removable media.

A documented chain of custody records every transfer, handler and storage condition from seizure to courtroom, creating an auditable trail that demonstrates the evidence's integrity remained intact. This directly satisfies the stem's demand for the primary purpose: proving the data was neither altered nor tampered with between collection and presentation.

The lessons learned meeting is intended to review the incident and the response to identify strengths and weaknesses, leading to improvements in the incident response plan, procedures, and training. This helps the organization better prepare for future incidents. The primary focus is on process improvement, not on assigning blame or calculating costs. NIST SP 800-61 emphasizes that the meeting should produce actionable recommendations.

Mean Time to Detect measures the average elapsed time between an incident's actual occurrence and its detection by monitoring or staff. This directly satisfies the stem's requirement for the metric quantifying detection speed, distinguishing it from response or resolution metrics.

Order of volatility dictates that memory (RAM) is more volatile than network state, disk logs, or temporary files. RAM holds running processes, open network connections, encryption keys, and malware artifacts that disappear on shutdown or reboot. Capturing RAM first preserves the most perishable evidence. Tools like LiME allow memory acquisition on Linux, making this the correct first step.

Listing active network connections with netstat captures ephemeral socket state that vanishes on reboot or service restart, preserving attacker command-and-control and lateral-movement evidence. This satisfies the stem's volatility constraint: network connections are among the first artefacts lost, so they must be collected before memory-resident data degrades further.

Reviewing what went well and what could be improved captures strengths and gaps in detection, response and coordination, which is a primary purpose of the post-incident lessons learned meeting. It feeds directly into refining processes rather than assigning blame.

Validating backup integrity confirms the data is uncorrupted and restorable, while patching the exploited vulnerability prevents immediate re-infection during restoration. Both must precede the restore to satisfy the stem's requirement that restoration be successful and secure.

LiME is a loadable kernel module designed for volatile memory acquisition on Linux. It allows the responder to dump physical memory to a file or over the network without altering the system state significantly. It is widely accepted in forensics because it preserves the integrity of the memory image and is less likely to crash the system, making the evidence more defensible in court.

A quarantine VLAN isolates the workstation at the switch port while leaving the manufacturing network's routing and production traffic intact. This contains malware spread with minimal disruption, unlike disabling the switch port or powering off, which would halt critical operations.

The RTO is not being met, so the first step is to improve the recovery process to meet the objective. Automation can significantly reduce manual steps and speed up recovery. Other options like increasing the RTO or accepting the risk might be considered later, but the initial recommendation should be to close the gap by enhancing the process. This aligns with continuous improvement in disaster recovery planning.

The lessons learned meeting should result in actionable improvements. If roles were unclear, updating the plan to define responsibilities and training personnel accordingly directly addresses the root cause. This ensures future responses are more effective and aligns with the post-incident activity phase of NIST SP 800-61, which emphasizes revising policies and procedures based on findings.

NIST SP 800-61 identifies lessons learned as a key post-incident activity. A meeting with stakeholders reviews what happened, what worked, and what needs improvement. This directly addresses the CISO's goal of improving future response by capturing insights while details are fresh. It should occur before final recovery changes obscure the timeline, making it the correct first action.

RAM contents, running processes, and active network connections are the most volatile evidence and are lost when the system is powered off or rebooted. NIST SP 800-61 recommends collecting these first during the containment phase. Capturing memory and network state preserves indicators such as injected code, encryption keys, and command-and-control sessions before any remediation disrupts them.

Using a hardware or software write blocker prevents any modification to the source disk during imaging, preserving its integrity as evidence. This directly satisfies the chain-of-custody requirement that forensic copies be bit-for-bit accurate and unaltered, ensuring the image remains admissible and defensible during the post-incident review.

Lessons learned exists to feed findings back into the incident response plan, refining procedures, tools and communication based on what actually happened. It satisfies the stem's primary-purpose constraint by targeting process improvement rather than blame, evidence preservation or immediate containment.

Isolating the workstation from the network prevents the malware from spreading to other systems, which is a primary goal of containment. Disabling the switch port effectively cuts off network communication while preserving the system state for later forensic analysis. This action directly limits the scope and impact of the incident, aligning with NIST SP 800-61 containment strategies.

VLAN quarantine or ACLs sever network reachability between the infected hosts and the critical servers sharing that VLAN, halting lateral spread without powering systems off and destroying volatile evidence. This directly satisfies the stem's requirement to minimise impact on the co-located critical servers first.

Offline or immutable backups prevent ransomware from encrypting the backup data, ensuring that a clean copy is available for restoration. This is critical because ransomware often targets connected backups. Storing backups offline or using write-once-read-many (WORM) storage ensures that even if the network is compromised, the backups remain intact and can be used to recover.

Post-Incident Activity is where the NIST SP 800-61 lifecycle captures lessons learned and revises the incident response plan. This phase explicitly covers reviewing what happened and feeding improvements back into the plan, satisfying the stem's requirement.

Correct. Eradication and patching prevent recurrence.

Hourly log shipping to a standby database delivers an RPO of roughly one hour, and a warm site can be brought online within the four-hour RTO. Hot sites exceed the requirement at unnecessary cost, while cold sites cannot meet either target.

Disconnecting the network cable immediately severs the malware's command-and-control channel and lateral movement paths, satisfying the containment requirement. Unlike powering down, it preserves volatile memory and running processes, so forensic evidence such as RAM artefacts survives for later analysis. This makes it the fastest physical isolation method for a critical server.

With antivirus logs clear, the analyst must still triage the report; classifying severity determines whether it becomes a formal incident and drives escalation and resourcing, which is the next detection-and-analysis action before containment or eradication.

A full interruption test actually shuts down production systems and invokes recovery, so if the plan proves flawed, the organisation suffers real extended downtime or data loss. This is the primary risk that distinguishes it from tabletop or simulation testing.

Isolation stops the workstation communicating with the command-and-control server, containing the compromise, while preserving volatile data such as memory and active connections for later forensic analysis. This aligns with the NIST lifecycle's containment objective before eradication.

EDR network isolation severs the workstation's connections while preserving the agent's management channel and volatile evidence, halting command-and-control traffic and potential lateral movement. This contains the confirmed compromise immediately, before the still-logged-in user or malware can cause further damage.

RPO defines the maximum tolerable data loss measured in time, so four hours means the recovery point may lose up to four hours of transactions. RTO defines the maximum acceptable downtime, so the database must be operational again within 24 hours of disruption.

Resetting the password immediately invalidates the stolen credentials, cutting off the attacker's authenticated access before they can pivot or exfiltrate further. This directly satisfies the containment phase's goal of limiting damage while the phishing incident is still active.

Isolating the infected workstation from the network is the immediate priority in the containment phase to prevent the ransomware from spreading to shared drives and other systems. Disconnecting the network stops lateral movement and further encryption of network resources, while preserving the local state for later forensic analysis. This aligns with NIST SP 800-61 guidance to limit the scope and magnitude of the incident before proceeding with eradication and recovery.

Scanning restored systems with current antivirus and anti-malware signatures detects any residual malware, backdoors or dormant payloads the ransomware may have left behind. This directly satisfies the stem's requirement to verify systems are clean before returning them to production.

Capturing volatile data like memory and logs while the systems are still running preserves critical evidence about the attacker's tools, credentials, and network connections. Isolating the servers prevents further damage without destroying evidence. This approach aligns with incident response best practices by balancing containment and forensic preservation, enabling the team to determine initial access and exfiltration methods before restoring from backups.

A write blocker intercepts write commands at the hardware or driver level, allowing the examiner to read the drive while blocking any modification. This preserves the original evidence's integrity so the bit-for-bit copy remains forensically sound and admissible.

Detecting suspicious outbound traffic to a known command-and-control IP is the identification of a potential security event, which NIST SP 800-61 places squarely within Detection and Analysis. This phase covers monitoring, triage and validating whether activity constitutes a genuine incident before containment begins.

MTTD measures the elapsed time from incident occurrence to detection, quantifying how quickly monitoring and alerting identify threats. Tracking it exposes gaps in detection capability and is a core effectiveness metric alongside containment and recovery times.

A communication plan with stakeholder contact details satisfies the coordination constraint during preparation, ensuring the right people are reachable the moment an incident is declared. Without predefined escalation paths and contacts, response stalls while responders hunt for decision-makers, delaying containment and violating the plan's requirement for clear internal and external notification procedures.

The incident response plan defines roles, escalation paths, communication channels and procedures before an incident occurs, so responders act consistently rather than improvising. This satisfies the stem's requirement for the most important preparation-phase component, underpinning every later lifecycle phase.

An incident response policy is a foundational element of the preparation phase. It establishes the authority, scope, and responsibilities for incident response, ensuring that all stakeholders understand their roles. NIST SP 800-61 specifically lists the creation of an incident response policy as a key preparation activity, as it provides the framework for the entire incident response lifecycle.

A chain of custody documents who handled the evidence, when, and for what purpose, which is essential for admissibility. Without it, opposing counsel can challenge whether the evidence was tampered with or altered. In this scenario, documenting custody for each item collected from the Linux server establishes an unbroken record that supports the evidence's integrity in legal proceedings.

Blocking command-and-control traffic via firewall rules is a containment technique that cuts off attacker communication without necessarily disconnecting all systems. NIST SP 800-61 supports using network controls to contain incidents. This approach can be more surgical than full isolation, allowing business operations to continue while preventing further malicious activity. It is a valid containment strategy.

The primary purpose of a lessons learned meeting is to identify what went well and what needs improvement, then produce actionable recommendations to enhance the incident response plan. This includes clarifying communication procedures, roles, and escalation paths. The outcome should be a documented set of changes that can be implemented and tested. This directly addresses the identified communication delays and helps prevent recurrence.