Courseiva

CCNA Sscp Incident Response Questions

50 questions · Sscp Incident Response topic · All types, answers revealed

Practice these questionsExam hubAll questions
1
MCQmedium

An incident responder needs to create a forensic image of a suspect hard drive. What is the correct procedure to ensure evidence integrity?

A.Use a write blocker, create a bit-for-bit image, and compute SHA-256 hash before and after imaging.
B.Boot the suspect system and use imaging software to copy data.
C.Remove the drive and place it in anti-static bag, then ship to lab.
D.Connect the drive directly to forensic workstation, copy all files, and compute MD5 hash of copy.
AnswerA

Correct. Write blocker prevents writes, and hash verification ensures integrity.

Why this answer

Forensic imaging requires a write blocker to prevent any modification to the original evidence, a bit-for-bit (sector-level) copy to capture all data including slack space and deleted files, and cryptographic hashing (SHA-256) both before and after imaging to verify that the image is an exact, unaltered duplicate of the source. This process ensures the integrity and admissibility of digital evidence in legal proceedings.

Exam trap

The trap here is that candidates may think booting the system or simply copying files is sufficient, but the SSCP exam emphasizes that any write activity to the original evidence breaks the chain of custody and invalidates the forensic integrity.

How to eliminate wrong answers

Option B is wrong because booting the suspect system alters the system state (e.g., writes temporary files, updates logs, changes timestamps), which modifies evidence and violates forensic best practices. Option C is wrong because simply placing the drive in an anti-static bag and shipping it does not create a forensic image; imaging must be performed to preserve the data, and the procedure omits write-blocking and hashing. Option D is wrong because connecting the drive directly without a write blocker risks accidental writes to the source, and copying files (rather than creating a bit-for-bit image) loses metadata, slack space, and deleted data; MD5 is also less collision-resistant than SHA-256 for modern forensic standards.

Practice this question →
2
MCQmedium

A company is developing a DR plan for a critical database. The maximum acceptable downtime is 2 hours, and the maximum data loss is 1 hour. What are the RTO and RPO?

A.RTO = 2 hours, RPO = 1 hour
B.RTO = 1 hour, RPO = 1 hour
C.RTO = 1 hour, RPO = 2 hours
D.RTO = 2 hours, RPO = 2 hours
AnswerA

Correct. RTO is recovery time, RPO is data loss tolerance.

Why this answer

The Recovery Time Objective (RTO) is the maximum acceptable downtime, which is 2 hours. The Recovery Point Objective (RPO) is the maximum acceptable data loss, which is 1 hour. Therefore, option A correctly identifies RTO = 2 hours and RPO = 1 hour.

Exam trap

The trap here is confusing RTO (time to recover) with RPO (data loss tolerance), leading candidates to swap the two values or assume they must be equal.

How to eliminate wrong answers

Option B is wrong because it swaps the RTO and RPO values, incorrectly setting RTO to 1 hour (the maximum data loss) and RPO to 1 hour (the maximum downtime). Option C is wrong because it inverts the definitions, setting RTO to 1 hour (data loss) and RPO to 2 hours (downtime). Option D is wrong because it sets both RTO and RPO to 2 hours, ignoring the specified 1-hour maximum data loss constraint.

Practice this question →
3
MCQmedium

During the detection and analysis phase, an analyst receives a user report of unusual system behavior. The analyst reviews logs and finds several failed login attempts followed by a successful login from an unusual IP address. What is the next step?

A.Immediately disconnect the user's workstation from the network.
B.Rebuild the user's workstation from a known-good image.
C.Classify the incident and determine if escalation is needed.
D.Ignore the event as it may be a false positive.
AnswerC

Correct. Classification and escalation are part of detection and analysis.

Why this answer

During the detection and analysis phase of incident response, the primary goal is to assess the validity and scope of a potential security event before taking action. The analyst has observed indicators of a possible brute-force attack (failed logins followed by a successful login from an unusual IP), which requires classification to determine if it meets the criteria for a security incident. Escalation may be needed to involve a higher-tier incident response team or to initiate formal containment procedures, as per NIST SP 800-61 guidelines.

Exam trap

The trap here is that candidates often confuse the detection and analysis phase with the containment phase in the SSCP incident response lifecycle, leading them to choose immediate disconnection (Option A) instead of first classifying the incident and determining the need for escalation.

How to eliminate wrong answers

Option A is wrong because immediately disconnecting the user's workstation from the network is a premature containment action that should only occur after the incident has been confirmed and classified; doing so could disrupt business operations and destroy volatile evidence (e.g., active network connections, memory contents). Option B is wrong because rebuilding the workstation from a known-good image is a recovery step that occurs after containment, eradication, and evidence preservation; skipping analysis could result in losing forensic data needed to identify the root cause and prevent recurrence. Option D is wrong because ignoring the event as a false positive is negligent; the combination of multiple failed logins followed by a successful login from an unusual IP address is a classic indicator of a successful password-guessing attack and warrants investigation, not dismissal.

Practice this question →
4
MCQhard

During a forensic investigation, an examiner needs to preserve volatile evidence. Which of the following lists the correct order of collection for volatile data?

A.Hard drive image, network connections, running processes, RAM
B.Running processes, RAM, hard drive image, network connections
C.RAM, network connections, running processes, hard drive image
D.Network connections, hard drive image, RAM, running processes
AnswerC

Correct. RAM is most volatile, then network state, then processes, then disk.

Why this answer

Volatile data must be collected in order of decreasing volatility to prevent loss of critical evidence. RAM is the most volatile (lost on power-off), followed by network connections (state changes rapidly), then running processes (persist slightly longer), and finally the hard drive image (non-volatile). This order follows the RFC 3227 guidelines for evidence collection.

Exam trap

The SSCP exam often tests the 'order of volatility' principle, and the trap here is that candidates mistakenly prioritize network connections or running processes over RAM, not realizing that RAM is the most volatile and must be captured first to preserve evidence like encryption keys or active malware payloads.

How to eliminate wrong answers

Option A is wrong because it starts with a hard drive image, which is non-volatile and should be collected last, not first, risking loss of volatile data like RAM. Option B is wrong because it places running processes before RAM, but RAM contains process data and is more volatile, so RAM must be collected first. Option D is wrong because it places network connections before RAM, but network connection state can change rapidly and is less volatile than RAM, which holds active memory contents.

Practice this question →
5
MCQmedium

During the eradication phase of incident response, which of the following actions is MOST critical to ensure the threat is completely removed from a compromised system?

A.Reimaging the system from a verified clean image
B.Resetting compromised user credentials
C.Removing malicious files and cleaning registry persistence
D.Patching the exploited vulnerability
AnswerC

Attackers often establish persistence; failing to remove it can lead to recompromise.

Why this answer

During the eradication phase, the primary goal is to ensure that no remnants of the attacker's presence remain on the system. Option C directly addresses this by removing malicious files and cleaning registry persistence, which eliminates backdoors, scheduled tasks, and other persistence mechanisms that could allow the threat to survive a reboot or evade detection. Without this step, even after patching or credential resets, the attacker could regain access through hidden persistence points.

Exam trap

A common mistake in the SSCP exam is confusing the eradication phase with the recovery phase. Candidates may select patching or reimaging because those actions seem thorough, but the key during eradication is removing all artifacts of the compromise, including persistence mechanisms, before recovering the system to production.

How to eliminate wrong answers

Option A is wrong because reimaging from a clean image is a valid recovery step, but it is not the most critical action during eradication; it is typically performed after eradication is complete to restore the system to a known good state, and it does not involve analyzing or removing the threat's artifacts. Option B is wrong because resetting compromised user credentials is a containment and recovery action that prevents further unauthorized access, but it does not remove the threat itself—malicious files and persistence mechanisms remain active. Option D is wrong because patching the exploited vulnerability is a preventive measure that closes the initial attack vector, but it does not remove existing malware or persistence; the threat may still be present and active on the system.

Practice this question →
6
MCQmedium

After a ransomware incident, an organization decides to restore data from backups. The RPO (Recovery Point Objective) is 4 hours. What does this RPO indicate?

A.Backups must be taken at least every 4 hours to ensure data loss does not exceed 4 hours
B.The organization can tolerate 4 hours of downtime
C.The system must be restored within 4 hours of the incident
D.The recovery process will take a maximum of 4 hours
AnswerA

Correct. RPO drives backup frequency to limit data loss.

Why this answer

The Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time. An RPO of 4 hours means the organization can tolerate losing up to 4 hours of data, so backups must be taken at least every 4 hours to ensure that in the worst case, no more than 4 hours of data is lost. This directly dictates the backup frequency, not the recovery time or downtime.

Exam trap

The trap here is confusing RPO (data loss tolerance) with RTO (downtime tolerance), leading candidates to select options that describe recovery time or downtime instead of backup frequency.

How to eliminate wrong answers

Option B is wrong because it describes the Recovery Time Objective (RTO), which is the maximum acceptable downtime, not the RPO. Option C is wrong because it also describes the RTO (time to restore service), not the RPO which is about data loss tolerance. Option D is wrong because it describes the actual recovery time, which is a metric of the restoration process, not the RPO's definition of acceptable data loss.

Practice this question →
7
MCQhard

A company's disaster recovery plan specifies an RTO of 4 hours for its customer relationship management (CRM) system. Which of the following DR site types is MOST appropriate to meet this RTO?

A.Warm site
B.Mobile site
C.Hot site
D.Cold site
AnswerC

Correct. A hot site is fully equipped with live data replication and can achieve failover within the 4-hour RTO.

Why this answer

A hot site is fully configured with hardware, software, and live data replication, enabling recovery within minutes to a few hours. Since the RTO is 4 hours, a hot site can meet this requirement by allowing immediate failover without the need for extensive setup or data restoration.

Exam trap

The trap here is that candidates often confuse a warm site (which has hardware but not live data) as sufficient for a 4-hour RTO, underestimating the time needed to restore and validate backups, which can easily exceed 4 hours for a CRM system with large databases.

How to eliminate wrong answers

Option A is wrong because a warm site has pre-installed hardware but may lack up-to-date data and require several hours to days to restore from backups, making it unsuitable for a 4-hour RTO. Option B is wrong because a mobile site is a portable unit that must be transported and configured on-site, typically taking days to become operational, far exceeding the 4-hour RTO. Option D is wrong because a cold site provides only physical infrastructure (power, cooling, space) with no IT equipment or data, requiring weeks to procure and install systems, which cannot meet a 4-hour RTO.

Practice this question →
8
Multi-Selecthard

A forensic investigator is collecting evidence from a compromised Windows server. According to the order of volatility, which THREE pieces of evidence should be collected FIRST? (Select THREE)

Select 3 answers
A.System event logs
B.Hard drive image
C.Network connections and open ports
D.Contents of RAM (memory dump)
E.List of running processes
AnswersC, D, E

Current network state is volatile and can change rapidly.

Why this answer

Network connections and open ports (C) are highly volatile because they can change rapidly and are lost when the system is disconnected from the network. Capturing this data first preserves evidence of active remote connections, which is critical for identifying the attacker's point of entry and ongoing malicious activity. Tools like netstat -anob or CurrPorts can be used to collect this information before any other forensic steps.

Exam trap

ISC2 SSCP often tests the misconception that event logs are volatile because they are 'system state' data, but logs are written to disk and persist; the trap is confusing 'important' with 'volatile'.

Practice this question →
9
Multi-Selecthard

During a post-incident review, the incident response team identifies several areas for improvement. According to NIST SP 800-61, which THREE activities are typically part of the post-incident activity phase?

Select 3 answers
A.Patch all systems in the organization as a precaution
B.Update the incident response plan based on findings
C.Replace all affected hardware immediately
D.Conduct a lessons learned meeting
E.Track metrics such as MTTD and MTTR
AnswersB, D, E

The plan should be updated to incorporate lessons learned.

Why this answer

NIST SP 800-61 explicitly states that the post-incident activity phase includes updating the incident response plan based on lessons learned and findings from the incident. This ensures the plan evolves to address gaps and improve future response effectiveness.

Exam trap

The trap here is confusing operational recovery actions (like patching or hardware replacement) with the analytical and improvement-focused activities that define the post-incident phase per NIST SP 800-61.

Practice this question →
10
MCQeasy

Which of the following is the primary purpose of a chain of custody form in digital forensics?

A.To track the possession and handling of evidence from collection to presentation
B.To document the steps taken to contain an incident
C.To record the hash values of forensic images
D.To provide a list of approved forensic tools
AnswerA

Correct. Chain of custody ensures evidence integrity and admissibility.

Why this answer

Chain of custody documents who handled the evidence, when, and why, ensuring it remains admissible in court.

Practice this question →
11
MCQhard

During a post-incident review, the incident response team identifies that the mean time to detect (MTTD) was 14 days. Which improvement would most directly reduce MTTD?

A.Implementing stricter access control policies
B.Conducting more frequent tabletop exercises
C.Deploying additional endpoint detection and response (EDR) sensors with automated alerting
D.Increasing the frequency of full system backups
AnswerC

Correct. Enhanced detection tools reduce MTTD.

Why this answer

Deploying additional EDR sensors with automated alerting directly reduces the time between an incident's occurrence and its detection by providing continuous monitoring and immediate notification of suspicious activities. This shortens the MTTD because automated alerts eliminate the delay inherent in manual log review or periodic checks, enabling the incident response team to react within minutes rather than days.

Exam trap

The trap here is that candidates often confuse detection speed (MTTD) with prevention or recovery metrics, mistakenly thinking that improving backups (Option D) or access controls (Option A) will help detect incidents faster, when in fact they address different phases of the incident response lifecycle.

How to eliminate wrong answers

Option A is wrong because stricter access control policies primarily reduce the likelihood of an incident (prevention) or limit the blast radius, but they do not improve detection speed; MTTD is a detection metric, not a prevention or containment metric. Option B is wrong because tabletop exercises improve team preparedness and response procedures, but they do not directly affect the speed of detecting real incidents; they focus on reaction and coordination after detection, not on reducing detection latency. Option D is wrong because increasing the frequency of full system backups improves data recovery capabilities and reduces recovery time objectives (RTO), but backups do not provide real-time visibility into ongoing malicious activity and thus have no direct impact on MTTD.

Practice this question →
12
MCQeasy

During which phase of the NIST SP 800-61 incident response lifecycle are lessons learned meetings conducted and metrics such as MTTD and MTTR tracked?

A.Containment, Eradication, and Recovery
B.Preparation
C.Detection and Analysis
D.Post-Incident Activity
AnswerD

Correct. Lessons learned and metrics tracking are key parts of post-incident activity.

Why this answer

The Post-Incident Activity phase (D) is where lessons learned meetings are conducted and metrics such as Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) are tracked. This phase focuses on reviewing the incident response process, identifying improvements, and documenting findings to enhance future response efforts, as defined in NIST SP 800-61 Revision 2.

Exam trap

ISC2 often tests the misconception that metrics like MTTD and MTTR are tracked during Detection and Analysis or Containment phases, but they are actually reviewed and analyzed only after the incident is resolved in the Post-Incident Activity phase.

How to eliminate wrong answers

Option A is wrong because Containment, Eradication, and Recovery focuses on stopping the incident, removing threats, and restoring operations, not on post-incident analysis or metric tracking. Option B is wrong because Preparation involves establishing policies, tools, and training before an incident occurs, not conducting lessons learned or tracking MTTD/MTTR after an incident. Option C is wrong because Detection and Analysis is the phase where incidents are identified and analyzed, but it does not include the retrospective review or metric collection that occurs in the Post-Incident Activity phase.

Practice this question →
13
Multi-Selectmedium

A company is conducting a disaster recovery test. Which TWO types of tests involve minimal risk to production operations?

Select 2 answers
A.Tabletop exercise
B.Simulation test
C.Parallel test
D.Walkthrough
E.Full interruption test
AnswersA, D

A discussion-based exercise with no actual system changes.

Why this answer

A tabletop exercise is a discussion-based test where key personnel walk through a disaster scenario without affecting live systems. It involves no actual failover, data replication, or production traffic, so the risk to operations is zero. This makes it a safe, low-cost method to validate plans and roles.

Exam trap

A common misconception is that 'simulation' or 'parallel' tests are low-risk because they are 'controlled,' but the key distinction is that tabletop and walkthrough involve zero execution of technical recovery steps, while any test that touches production systems carries inherent risk.

Practice this question →
14
MCQeasy

An organization is developing its incident response plan. According to NIST SP 800-61, which phase should include establishing a communication plan, acquiring necessary tools, and conducting exercises?

A.Preparation
B.Post-Incident Activity
C.Detection and Analysis
D.Containment, Eradication, and Recovery
AnswerA

Correct. Preparation includes the IR plan, team, tools, exercises, and communication plan.

Why this answer

According to NIST SP 800-61, the Preparation phase is where the organization establishes a communication plan, acquires necessary tools (e.g., forensic workstations, imaging software, network monitoring tools), and conducts exercises (e.g., tabletop exercises or full-scale simulations) to ensure readiness. This phase lays the foundation for all subsequent incident response activities by ensuring resources and procedures are in place before an incident occurs.

Exam trap

A common misconception is that Detection and Analysis includes proactive preparation activities, but NIST SP 800-61 clearly separates the proactive Preparation phase from the reactive Detection phase, which only begins after an incident is suspected.

How to eliminate wrong answers

Option B is wrong because the Post-Incident Activity phase focuses on lessons learned, evidence retention, and report generation after containment and recovery, not on proactive preparation like tool acquisition or exercises. Option C is wrong because Detection and Analysis involves identifying and validating incidents through log analysis, alerts, and threat intelligence, not establishing communication plans or acquiring tools. Option D is wrong because Containment, Eradication, and Recovery are reactive phases that execute actions to stop the incident, remove threats, and restore systems, relying on the tools and plans already set up in Preparation.

Practice this question →
15
Multi-Selecthard

A company is selecting a disaster recovery site for its critical applications. Which THREE characteristics differentiate a warm site from a cold site? (Select three.)

Select 3 answers
A.A warm site is typically ready to operate within hours.
B.A warm site has environmental controls (power, cooling) already in place.
C.A warm site has pre-installed servers and network equipment.
D.A warm site has live data replication from the primary site.
E.A warm site requires data restoration from backups before use.
AnswersB, C, E

Cold sites lack environmental controls; warm sites have them.

Why this answer

A warm site is partially configured with environmental controls such as power, cooling, and network connectivity already in place. This distinguishes it from a cold site, which lacks these infrastructure components and requires significant setup time. The presence of environmental controls is a key differentiator that allows a warm site to become operational faster than a cold site, though it still requires data restoration from backups before full recovery.

Exam trap

Candidates often confuse warm sites with hot sites, incorrectly attributing features like live data replication or rapid recovery (hours) to warm sites. In the SSCP exam, focus on the fact that warm sites have pre-installed infrastructure and environmental controls but require backup restoration before full operation.

Practice this question →
16
MCQeasy

What is the primary purpose of establishing a chain of custody for digital evidence?

A.To reduce the size of evidence for storage
B.To encrypt evidence for secure transmission
C.To maintain evidence integrity and track handling
D.To prioritize which evidence to analyze first
AnswerC

It documents who handled evidence, when, and why, ensuring it hasn't been tampered with.

Why this answer

The primary purpose of establishing a chain of custody for digital evidence is to maintain evidence integrity and track every person who handled the evidence from collection through presentation in court. This process ensures that the evidence has not been tampered with, altered, or corrupted, which is critical for admissibility under legal standards such as the Federal Rules of Evidence (FRE) Rule 901. By documenting each transfer with timestamps, signatures, and hash values (e.g., MD5 or SHA-256), the chain of custody provides a verifiable audit trail that supports the evidence's authenticity and reliability.

Exam trap

The trap here is that candidates confuse chain of custody with data preservation techniques like encryption or compression, but the exam specifically tests that its core purpose is to ensure integrity and provide an unbroken audit trail of handling, not to secure or reduce the data.

How to eliminate wrong answers

Option A is wrong because reducing the size of evidence for storage is not a purpose of chain of custody; that is typically achieved through compression algorithms like ZIP or deduplication, and it has no bearing on legal admissibility. Option B is wrong because encrypting evidence for secure transmission is a separate security measure (e.g., using AES-256 or TLS), not a function of chain of custody, which focuses on documenting handling rather than protecting confidentiality. Option D is wrong because prioritizing which evidence to analyze first is a triage decision made during incident response based on impact or volatility (e.g., memory over disk), not a goal of chain of custody, which applies equally to all evidence items.

Practice this question →
17
MCQmedium

Which type of disaster recovery test involves running the DR systems alongside the production systems to validate functionality without impacting live operations?

A.Simulation test
B.Full interruption test
C.Tabletop exercise
D.Parallel test
AnswerD

Parallel test runs DR systems side-by-side with production, verifying functionality without risk.

Why this answer

A parallel test runs the disaster recovery systems concurrently with the production systems to verify that the DR environment can handle the workload without disrupting live operations. This approach validates data replication, application functionality, and failover readiness while keeping production untouched, making it the correct choice for non-disruptive validation.

Exam trap

The trap here is that candidates often confuse 'parallel test' with 'simulation test' because both sound non-disruptive, but a simulation test is purely theoretical while a parallel test actually runs DR systems with live data.

How to eliminate wrong answers

Option A is wrong because a simulation test involves a controlled, often tabletop-style walkthrough of disaster scenarios without actually activating DR systems or processing live data. Option B is wrong because a full interruption test (also called a full-scale test) requires shutting down production systems to fail over to the DR site, which directly impacts live operations. Option C is wrong because a tabletop exercise is a discussion-based review of roles and procedures, not a technical validation of DR system functionality.

Practice this question →
18
MCQeasy

During the detection and analysis phase, an analyst classifies an incident as P1 (critical) because it involves a breach of sensitive customer data. What is the IMMEDIATE next step the analyst should take?

A.Notify the affected customers of the data breach
B.Create a forensic image of the compromised server
C.Escalate the incident to the incident response manager and legal counsel
D.Begin containment by isolating affected systems
AnswerC

P1 incidents require immediate escalation to management and legal for breach notification requirements.

Why this answer

When an incident is classified as P1 (critical) due to a breach of sensitive customer data, the immediate next step is to escalate to the incident response manager and legal counsel. This ensures that legal obligations (e.g., breach notification laws, regulatory reporting) and organizational authority are engaged before any technical actions that could alter evidence or violate chain-of-custody requirements. The detection and analysis phase prioritizes notification of key stakeholders to coordinate a lawful and effective response.

Exam trap

The trap here is that candidates often jump to containment (Option D) as the immediate technical step, but the SSCP exam emphasizes that for critical incidents involving sensitive data, escalation to management and legal must occur first to ensure legal and regulatory compliance before any technical action.

How to eliminate wrong answers

Option A is wrong because notifying affected customers prematurely, before legal counsel has assessed notification requirements (e.g., under GDPR or HIPAA), could violate data breach notification laws and expose the organization to liability. Option B is wrong because creating a forensic image is a step typically performed after escalation and authorization, and doing so without legal or managerial approval may compromise the chain of custody or violate data privacy regulations. Option D is wrong because beginning containment before escalation risks destroying volatile evidence or making unauthorized changes that could hinder forensic analysis and legal proceedings.

Practice this question →
19
Multi-Selectmedium

A security analyst is responding to a malware incident on a Windows server. Which TWO actions should be taken to properly collect volatile evidence?

Select 2 answers
A.Reboot the system to clear malware from memory
B.Delete suspicious files to prevent further infection
C.Perform a full disk image using a write blocker
D.Capture a memory dump using WinPmem
E.Record active network connections
AnswersD, E

Memory dump captures volatile data from RAM.

Why this answer

WinPmem is a dedicated memory acquisition tool that captures the contents of RAM, which contains critical volatile evidence such as running processes, open network connections, and injected code. Since volatile data is lost on power loss or reboot, capturing a memory dump before any other action preserves this evidence for forensic analysis.

Exam trap

The trap here is that candidates often confuse 'volatile evidence' with 'non-volatile evidence' and choose disk imaging (Option C) instead of memory capture, or mistakenly think rebooting (Option A) is a safe containment step.

Practice this question →
20
MCQeasy

Which DR testing type involves running recovery systems in parallel with production systems to verify functionality without impacting live operations?

A.Full interruption test
B.Simulation test
C.Parallel test
D.Tabletop exercise
AnswerC

Correct. Parallel testing runs DR systems concurrently with production.

Why this answer

A parallel test is the correct DR testing type because it involves running the recovery systems concurrently with the production systems. This allows the organization to verify that the backup systems function correctly and can handle the workload without any impact on live operations, as the production environment remains untouched.

Exam trap

ISC2 often tests the distinction between a parallel test and a simulation test, where candidates mistakenly think a simulation involves actual system execution, but in reality, a simulation test is a theoretical exercise without any live system activation.

How to eliminate wrong answers

Option A is wrong because a full interruption test (also known as a full-scale or hot start test) requires shutting down the primary production systems and failing over entirely to the recovery site, which directly impacts live operations and is not a parallel run. Option B is wrong because a simulation test involves a walk-through or role-playing scenario where team members discuss their responses to a disaster without actually activating any recovery systems or processing live data. Option D is wrong because a tabletop exercise is a discussion-based session where participants review plans and procedures in a meeting room, with no actual execution of recovery systems or parallel processing.

Practice this question →
21
MCQmedium

An analyst detects suspicious outbound traffic from a workstation to a known command-and-control IP. Which IoC blocking method is MOST appropriate as an immediate containment measure?

A.Delete the malicious files from the system
B.Remove the malware from the workstation using EDR
C.Block the IP address at the perimeter firewall
D.Disable the user's account
AnswerC

Correct. This disrupts the malicious communication channel.

Why this answer

Blocking the IP address at the perimeter firewall is the most appropriate immediate containment measure because it directly cuts the outbound communication channel to the known command-and-control (C2) server. This stops data exfiltration and prevents the attacker from issuing further commands, buying time for deeper analysis. Firewall ACLs or blackhole routes can be applied in seconds without altering the endpoint, which is critical when the malware may have persistence mechanisms or anti-forensic capabilities.

Exam trap

The trap is that candidates may focus on endpoint remediation (e.g., deleting files or removing malware) rather than immediate containment through network-level blocking, which is the priority in incident response.

How to eliminate wrong answers

Option A is wrong because deleting malicious files from the system does not stop active C2 traffic; the malware may be running in memory or have already established a persistent connection, and file deletion alone does not terminate existing network sessions. Option B is wrong because removing malware using EDR is a remediation step, not an immediate containment measure; EDR removal can take time, may trigger malware defenses, and does not instantly block the outbound C2 traffic already in progress. Option D is wrong because disabling the user's account does not affect the malware's network communication; the malware runs as a process independent of user authentication and can continue sending data over the network even with the account disabled.

Practice this question →
22
MCQhard

During a malware containment operation, the incident response team decides to isolate an infected endpoint using network access controls. However, the malware is spreading via removable media. Which additional containment measure should the team implement?

A.Block the malware's command-and-control IP at the firewall
B.Disable the user's account and force a password reset
C.Reimage the infected system immediately
D.Group policy to disable USB ports or restrict autorun
AnswerD

Disabling USB ports or autorun prevents the malware from spreading via removable media.

Why this answer

The malware is spreading via removable media, so disabling USB ports or restricting autorun via Group Policy directly cuts off the propagation vector. Network access controls (NAC) isolate the endpoint from the network, but they do not prevent the malware from copying itself to USB drives or executing via autorun.inf. Group Policy can disable the storage device class (e.g., via 'Removable Storage Access' policies) or disable autorun entirely (via 'Turn off Autoplay' policy), stopping the spread at the physical media level.

Exam trap

The exam often tests the distinction between containment and remediation, and the trap here is that candidates confuse blocking C2 traffic (Option A) with stopping local propagation, failing to recognize that removable media spread is independent of network connectivity.

How to eliminate wrong answers

Option A is wrong because blocking the C2 IP at the firewall only disrupts command-and-control communication, not the local spread via removable media; the malware can still propagate via USB drives without needing network connectivity. Option B is wrong because disabling the user's account and forcing a password reset addresses credential compromise or unauthorized access, but does not stop the malware from copying itself to removable media or autorunning on other systems. Option C is wrong because reimaging the infected system immediately is a remediation step, not a containment step; containment must first stop the spread, and reimaging should only occur after containment is achieved to avoid reinfection or data loss.

Practice this question →
23
MCQmedium

Which of the following is the PRIMARY purpose of establishing a chain of custody when handling digital evidence?

A.To determine the priority of the incident
B.To ensure that evidence is stored in a secure location
C.To prove that evidence has not been altered or tampered with from collection to presentation
D.To identify which forensic tools were used during analysis
AnswerC

Chain of custody maintains integrity and admissibility.

Why this answer

The primary purpose of chain of custody is to create a documented, unbroken record of every person who handled the evidence, from collection through presentation in court. This documentation is critical to demonstrate that the digital evidence has not been altered, tampered with, or corrupted, thereby preserving its integrity and admissibility. Without a proper chain of custody, the opposing party can successfully challenge the evidence as unreliable or compromised.

Exam trap

The trap here is that candidates often confuse the purpose of chain of custody with the purpose of secure storage (Option B), but the exam specifically tests that the primary goal is proving evidence integrity through an unbroken record of custody, not just physical security.

How to eliminate wrong answers

Option A is wrong because establishing chain of custody has nothing to do with determining incident priority; priority is based on impact, criticality, and business risk, not evidence handling. Option B is wrong because while secure storage is an important part of evidence preservation, it is only one component of the chain of custody process, not the primary purpose; the core goal is proving integrity through documentation of every transfer and access event. Option D is wrong because identifying forensic tools used during analysis is a matter of methodology documentation, not chain of custody; chain of custody focuses on who had possession and when, not which software was employed.

Practice this question →
24
Multi-Selectmedium

An incident responder is collecting volatile evidence from a compromised Linux server. Which TWO of the following should be collected first? (Select two.)

Select 2 answers
A.Disk image of the system drive
B.System log files from /var/log
C.Hardware configuration inventory
D.List of active network connections using netstat
E.Contents of RAM using LiME
AnswersD, E

Network connections are volatile and should be captured early.

Why this answer

In incident response, volatile data is data that will be lost when the system is powered off. Active network connections (captured via netstat) and the contents of RAM (captured via LiME) are the most volatile, as they change constantly and are lost immediately upon shutdown. Collecting these first preserves critical evidence of current attacker activity and in-memory artifacts like rootkits or encryption keys.

Exam trap

In the SSCP exam, the order of volatility is a key concept for incident response. The trap is that candidates mistakenly prioritize disk-based artifacts (logs, images) over truly volatile data like RAM and network connections, which are lost on power-off.

Practice this question →
25
MCQmedium

An organization's security team detects a potential data breach. After confirming the incident, they classify it as P2 (high severity) and begin containment. Which action should be performed FIRST to preserve evidence for forensic analysis?

A.Disconnect the system from the network
B.Capture a memory dump using a tool like Magnet RAM Capture
C.Create a forensic image of the hard drive
D.Run an antivirus scan to remove malware
AnswerB

Correct. Memory contains volatile evidence that is lost when power is removed.

Why this answer

When a high-severity incident (P2) is confirmed, the first priority for forensic preservation is capturing volatile data, which includes system memory (RAM). A memory dump using a tool like Magnet RAM Capture preserves running processes, network connections, encryption keys, and malware in memory that would be lost on shutdown or disconnection. This order follows the volatility principle: capture the most volatile data first before any other action that could alter the system state.

Exam trap

The trap here is that candidates often choose 'Disconnect the system from the network' first, thinking containment is the immediate priority, but the SSCP exam emphasizes that evidence preservation (starting with volatile data) must precede containment actions to avoid destroying forensic artifacts.

How to eliminate wrong answers

Option A is wrong because disconnecting from the network first would cause loss of volatile network connections, active sessions, and memory-resident artifacts; it also may trigger anti-forensic mechanisms in malware. Option C is wrong because creating a forensic image of the hard drive is a non-volatile step that should occur after memory capture, as disk imaging can overwrite slack space or alter timestamps if done prematurely. Option D is wrong because running an antivirus scan modifies the system state (e.g., quarantining or deleting files) and destroys evidence; scanning is a remediation step, not a preservation step.

Practice this question →
26
MCQhard

An organization is restoring a critical database from a backup after a ransomware attack. Which of the following steps should be performed BEFORE restoring the data to ensure the restoration is successful and secure?

A.Notify users that the system will be available in one hour
B.Disconnect the backup server from the network
C.Immediately restore the most recent backup to minimize data loss
D.Verify the integrity of the backup and patch the exploited vulnerability
AnswerD

This ensures the backup is clean and the system is hardened before restoration.

Why this answer

Verifying backup integrity (e.g., using checksums or restore tests) ensures the backup is not corrupted or incomplete, which is critical after a ransomware attack where backups may also be targeted. Patching the exploited vulnerability (e.g., applying a security update or disabling the vulnerable service) prevents re-infection during or after the restore, ensuring the recovery is secure. Without these steps, restoring a compromised or incomplete backup could lead to data loss or immediate re-encryption by the same ransomware.

Exam trap

The trap here is that candidates assume restoring the most recent backup is always the priority, but the SSCP exam emphasizes that verifying backup integrity and securing the environment against re-infection are mandatory prerequisites for a successful and secure recovery.

How to eliminate wrong answers

Option A is wrong because notifying users of a one-hour availability before verifying the backup or patching the vulnerability is premature and unrealistic; restoration time depends on backup size and integrity checks, and users should only be notified after a successful restore and testing. Option B is wrong because disconnecting the backup server from the network is a good practice during recovery to prevent ransomware spread, but it is not the step that ensures restoration success and security—it is a containment measure that should be done before or during the restore, not the critical prerequisite for a successful restore. Option C is wrong because immediately restoring the most recent backup without verifying its integrity risks restoring a corrupted or encrypted backup (common in ransomware attacks where backups are also encrypted), and without patching the vulnerability, the system will be immediately re-infected.

Practice this question →
27
MCQmedium

During incident response, a team needs to isolate an infected workstation that is part of a critical manufacturing network. Which containment method is MOST appropriate to minimize disruption while preventing the spread of malware?

A.Place the workstation into a quarantine VLAN via switch configuration
B.Apply a host-based firewall rule to block all inbound traffic
C.Physically unplug the network cable
D.Disable the user's Active Directory account
AnswerA

Correct. VLAN quarantine isolates the device while allowing limited access for forensics.

Why this answer

Placing the workstation into a quarantine VLAN via switch configuration is most appropriate because it logically isolates the infected host from the rest of the network at Layer 2, preventing lateral spread of malware while allowing the manufacturing network to continue operating. This method uses 802.1Q VLAN tagging and access control lists (ACLs) on the switch to restrict traffic without physically disconnecting the device, which could disrupt time-sensitive manufacturing processes. It also preserves the ability to remotely manage or forensically image the workstation if needed.

Exam trap

The trap here is that candidates often choose 'physically unplug the network cable' because it seems like the most definitive containment, but they overlook the requirement to minimize disruption in a critical manufacturing network where sudden disconnection can halt production or cause safety hazards.

How to eliminate wrong answers

Option B is wrong because applying a host-based firewall rule to block all inbound traffic does not prevent the infected workstation from initiating outbound connections to spread malware to other systems, and it relies on the compromised host's own software, which may be disabled or bypassed by the malware. Option C is wrong because physically unplugging the network cable completely removes the workstation from the network, which can cause immediate disruption to critical manufacturing processes that depend on that workstation for real-time control or monitoring. Option D is wrong because disabling the user's Active Directory account only prevents authentication and access to domain resources, but does not stop the workstation from communicating with other devices on the same subnet or from spreading malware via non-authenticated protocols like ARP or NetBIOS.

Practice this question →
28
MCQhard

After containing a ransomware incident, the incident response team identifies that the attacker gained initial access through a phishing email that installed a backdoor. Which of the following eradication steps is MOST critical to prevent re-infection?

A.Resetting all user passwords
B.Reimaging all affected systems from a known-good backup
C.Removing the backdoor executable and associated persistence mechanisms
D.Conducting security awareness training for all employees
AnswerC

Directly removing the backdoor prevents it from being used again. Combined with patching, this is critical.

Why this answer

In the eradication phase, the immediate priority is to remove the attacker's direct access and persistence mechanisms. While reimaging (Option B) also removes the backdoor, it is a more time-consuming and disruptive approach that may not be necessary for all systems. Removing the backdoor executable and persistence mechanisms (e.g., scheduled tasks, registry Run keys) directly eliminates the attacker's foothold, preventing re-infection from the same vector without the overhead of full reimaging.

Password resets (Option A) and training (Option D) are important but address different phases (recovery and prevention) and do not directly remove the existing backdoor.

Exam trap

The trap here is that candidates often confuse eradication with recovery or prevention, choosing reimaging (Option B) or training (Option D) instead of recognizing that removing the attacker's specific foothold is the immediate technical priority to stop re-infection.

How to eliminate wrong answers

Option A is wrong because resetting user passwords addresses credential compromise but does not remove the backdoor or its persistence; the attacker can still re-enter via the backdoor without needing a password. Option B is wrong because reimaging from a known-good backup is a valid recovery step, but it is not the most critical eradication step—it is a more drastic measure that may not be necessary if the backdoor can be surgically removed, and it does not address the root cause of the initial compromise (the phishing vector). Option D is wrong because security awareness training is a preventive measure that reduces future risk but does not eradicate the existing backdoor or persistence mechanisms already present on affected systems.

Practice this question →
29
Multi-Selectmedium

An organization uses a hot disaster recovery (DR) site and has a Recovery Time Objective (RTO) of 4 hours. During a DR test, the team discovers that data replication from the primary site fails. Which TWO actions should the team take to meet the RTO while ensuring data integrity? (Choose two.)

Select 2 answers
A.Verify the integrity of the backup before restoration using hash checks.
B.Extend the RTO to allow time for manual data re-entry.
C.Failover to the hot DR site immediately without data restoration.
D.Restore the latest valid backup from the primary site to the DR site.
E.Switch to a cold DR site that requires hardware setup.
AnswersA, D

Ensuring backup integrity prevents restoring corrupted or infected data.

Why this answer

Verifying the integrity of the backup using hash checks (e.g., SHA-256 or MD5) ensures that the data has not been corrupted during storage or transfer, which is critical before restoration to maintain data integrity. Option D is correct because restoring the latest valid backup from the primary site to the DR site provides a known-good data set, allowing the organization to meet the 4-hour RTO by having a consistent state to failover to, even if replication has failed.

Exam trap

A common misconception is that failing over to a hot site immediately is sufficient, but the trap here is that without verifying and restoring a valid backup, the DR site may contain corrupted or incomplete data, breaking data integrity requirements.

Practice this question →
30
MCQeasy

Which of the following is the FIRST step in the volatile evidence collection order when responding to an incident on a live system?

A.Capture a RAM dump using a tool like Magnet RAM Capture or WinPmem
B.Disconnect the system from the network
C.Run antivirus scans to identify malware
D.Create a forensic image of the hard drive
AnswerA

Memory is the most volatile; capturing it first preserves running processes, network connections, and encryption keys.

Why this answer

Volatile evidence is collected starting with the most volatile (memory) to preserve data that can be lost when the system is powered down. RAM dump must be done first.

Practice this question →
31
MCQeasy

What is the PRIMARY purpose of a lessons learned meeting after an incident?

A.To assign blame for the incident
B.To satisfy regulatory compliance requirements
C.To calculate the financial cost of the incident
D.To identify improvements in the incident response process
AnswerD

Correct. It helps refine the IR plan and procedures.

Why this answer

The primary purpose of a lessons learned meeting is to analyze the incident response process to identify what worked well and what did not, enabling the team to update procedures, playbooks, and tools to improve future responses. This aligns with the continuous improvement cycle mandated by frameworks like NIST SP 800-61, which emphasizes post-incident activity to refine detection and remediation capabilities.

Exam trap

The trap here is that candidates confuse the primary goal of process improvement with secondary outcomes like cost calculation or compliance, but the SSCP exam emphasizes that the core purpose is to enhance the incident response plan's effectiveness, not to assign blame or tally expenses.

How to eliminate wrong answers

Option A is wrong because lessons learned meetings are explicitly non-punitive and focus on process improvement, not assigning blame, which would discourage open reporting and hinder future incident handling. Option B is wrong while regulatory compliance may require documentation of post-incident reviews, the primary purpose is not compliance but operational improvement; compliance is a secondary benefit. Option C is wrong because calculating financial cost is typically part of a separate damage assessment or forensic accounting, not the core objective of a lessons learned meeting, which centers on process effectiveness.

Practice this question →
32
MCQhard

During a forensic investigation, a responder must collect evidence from a live Windows system. Which of the following represents the correct order for collecting volatile data?

A.Disk image, memory dump, process list, network connections
B.Memory dump, network connections, process list, disk image
C.Process list, memory dump, disk image, network connections
D.Network connections, memory dump, process list, disk image
AnswerB

Correct. Memory is the most volatile data.

Why this answer

Volatile data must be collected in order of decreasing volatility to avoid losing critical evidence. Memory (RAM) is the most volatile, followed by network connections and process lists (which change rapidly), and finally disk images (persistent storage). This order ensures that transient data is captured before it disappears.

Exam trap

The trap here is that candidates often think disk imaging is the most critical step and should be done first, but the SSCP exam tests the principle that volatile data (memory) must be captured before any non-volatile collection to prevent evidence loss.

How to eliminate wrong answers

Option A is wrong because it starts with a disk image, which is non-volatile, and places memory dump after it, risking loss of volatile data like running processes and network connections. Option C is wrong because it places process list before memory dump, but process list data resides in memory and can change if the system is altered during memory capture; memory must be collected first. Option D is wrong because it starts with network connections, which are more volatile than memory dump; memory should be captured before network state to avoid changes from system activity.

Practice this question →
33
MCQeasy

During which phase of the NIST SP 800-61 incident response lifecycle are incident response plan updates and lessons learned typically documented?

A.Preparation
B.Containment, Eradication, and Recovery
C.Detection and Analysis
D.Post-Incident Activity
AnswerD

Correct. This phase is dedicated to learning from the incident and improving future response.

Why this answer

The Post-Incident Activity phase of NIST SP 800-61 is specifically designed for conducting lessons learned meetings, documenting improvements, and updating the incident response plan based on findings from the incident. This phase ensures that the organization captures feedback to refine procedures, tools, and training for future incidents.

Exam trap

The trap here is that candidates confuse the Post-Incident Activity phase with the Preparation phase, mistakenly thinking that plan updates occur before incidents, but NIST SP 800-61 explicitly places lessons learned and plan updates after the incident is resolved.

How to eliminate wrong answers

Option A is wrong because the Preparation phase focuses on establishing policies, tools, and training before an incident occurs, not on documenting updates after an incident. Option B is wrong because Containment, Eradication, and Recovery phases are operational steps to stop the incident, remove threats, and restore systems, not for retrospective documentation. Option C is wrong because Detection and Analysis involves identifying and analyzing potential incidents, not capturing lessons learned or updating plans.

Practice this question →
34
MCQmedium

An organization's disaster recovery plan specifies an RTO of 4 hours and an RPO of 1 hour for its critical database. Which of the following DR site configurations BEST meets these requirements?

A.Cold site with weekly backup tapes shipped offsite
B.Cloud-based cold site with daily backups
C.Hot site with synchronous replication
D.Warm site with hourly log shipping to a standby database
AnswerD

Hourly log shipping achieves RPO of 1 hour; warm site provides hardware ready for activation within hours, meeting RTO.

Why this answer

A warm site with hourly log shipping to a standby database can achieve an RPO of 1 hour (by losing at most one hour of transactions) and an RTO of 4 hours (by applying the logs and bringing the standby online within that window). The standby database is kept nearly current with minimal lag, meeting both recovery objectives without the cost of full synchronous replication.

Exam trap

The trap here is that candidates often choose a hot site (Option C) because it provides the best protection, but the question asks for the configuration that BEST meets the specified RTO/RPO, not the most robust or expensive option, making the warm site the most cost-effective and appropriate choice.

How to eliminate wrong answers

Option A is wrong because a cold site requires hardware setup and restoration from weekly backup tapes, which cannot meet a 4-hour RTO (setup alone often takes days) and the weekly backups exceed the 1-hour RPO (potential data loss of up to a week). Option B is wrong because a cloud-based cold site still requires provisioning resources and restoring from daily backups, which cannot achieve a 4-hour RTO (provisioning and restoration take longer) and the daily backups exceed the 1-hour RPO (potential data loss of up to 24 hours). Option C is wrong because a hot site with synchronous replication provides near-zero RPO and very low RTO (minutes), which over-delivers on the requirements and is unnecessarily expensive; the question asks for the configuration that BEST meets the stated RTO/RPO, not exceeds them with higher cost.

Practice this question →
35
Multi-Selecteasy

During the containment phase of incident response, a security analyst identifies malware on a critical server. Which TWO actions should be taken FIRST to contain the threat and preserve evidence? (Choose two.)

Select 2 answers
A.Capture a forensic image of the hard drive.
B.Reboot the server to clear the malware from memory.
C.Disconnect the network cable from the server.
D.Run a full antivirus scan on the server.
E.Capture the contents of RAM using a tool like WinPmem.
AnswersC, E

This prevents the malware from communicating with command-and-control servers and spreading to other systems.

Why this answer

The immediate priority is to isolate the affected server from the network to prevent lateral movement and to capture volatile evidence (RAM) before it is lost. Disconnecting the network cable stops network-level spread, and capturing RAM preserves critical volatile data for forensic analysis.

Practice this question →
36
MCQmedium

A security analyst receives a user report about a workstation exhibiting unusual behavior, such as unexpected pop-ups and slow performance. The analyst first checks the antivirus logs and finds no alerts. What is the NEXT step in the detection and analysis phase?

A.Escalate the incident to senior management
B.Isolate the workstation from the network immediately
C.Perform a forensic memory capture
D.Classify the severity of the potential incident
AnswerD

Severity classification helps determine the appropriate response priority.

Why this answer

According to incident response best practices, after initial detection, the next step is to classify the severity of the potential incident to prioritize response efforts.

Practice this question →
37
MCQmedium

During a full interruption test of the disaster recovery plan, which of the following is the PRIMARY risk?

A.Vendor unavailability during the test
B.Employee confusion about their roles
C.Extended downtime or data loss if the plan fails
D.Cost overruns due to overtime pay
AnswerC

The realistic nature of the test can lead to actual outages if not carefully managed.

Why this answer

Full interruption tests involve actually failing over to the DR site, which may cause extended downtime or data loss if the plan has flaws or if the DR site fails.

Practice this question →
38
MCQhard

An incident responder is tasked with collecting forensic evidence from a compromised Linux server. Which command would the responder use to capture the contents of volatile memory (RAM) for analysis?

A.lime-forensics --dump /tmp/mem.lime
B.cat /proc/kcore > /tmp/mem.dump
C.memdump -o /tmp/mem.dump
D.dd if=/dev/mem of=/tmp/mem.dump bs=1M
AnswerA

LiME is the correct tool for Linux memory acquisition, outputting a .lime file.

Why this answer

LiME (Linux Memory Extractor) is specifically designed to capture volatile memory from Linux systems with minimal footprint, outputting a raw memory dump that can be analyzed with tools like Volatility. The `--dump` flag directs the acquisition to a specified file, ensuring the capture is forensically sound by avoiding writes to the compromised filesystem where possible.

Exam trap

The trap here is that candidates often assume `dd if=/dev/mem` is a valid method for full RAM capture on Linux, but modern kernels restrict access to `/dev/mem` to only the first megabyte, making it useless for forensic memory acquisition. Tools like LiME or fmem are required for proper memory dumping.

How to eliminate wrong answers

Option B is wrong because `/proc/kcore` is a pseudo-file representing the kernel's view of memory, but it is not a complete or forensically reliable capture of physical RAM; it may omit certain memory regions and can change during read, leading to an inconsistent snapshot. Option C is wrong because `memdump` is not a standard Linux command; it is a tool from the `memdump` package that captures memory from `/dev/mem`, but it is less reliable than LiME for volatile memory acquisition and may not handle modern kernel protections. Option D is wrong because `dd if=/dev/mem` attempts to read physical memory via the `/dev/mem` device, which on modern Linux kernels is restricted to the first 1 MB of RAM by default (due to the `CONFIG_STRICT_DEVMEM` kernel option), making it incapable of capturing the full RAM contents.

Practice this question →
39
MCQmedium

A security analyst detects a workstation communicating with a known command-and-control server. The workstation is running critical applications. What should be the analyst's first step according to the NIST incident response lifecycle?

A.Power off the workstation immediately to stop the communication.
B.Isolate the workstation from the network while preserving volatile data.
C.Run a full antivirus scan on the workstation.
D.Notify management and wait for instructions.
AnswerB

Correct. Network isolation stops communication while preserving evidence.

Why this answer

According to the NIST incident response lifecycle, the first priority is containment. Isolating the workstation from the network stops communication with the command-and-control server while preserving volatile data (e.g., memory, running processes, network connections) for forensic analysis. Powering off would destroy this critical evidence, and running a scan or waiting for instructions delays containment and risks further compromise.

Exam trap

A common misconception in incident response is that immediate power-off is the safest containment action, but the trap is that it destroys volatile evidence required for forensic analysis, as emphasized in the NIST incident response lifecycle and SSCP exam objectives.

How to eliminate wrong answers

Option A is wrong because powering off the workstation destroys volatile data (e.g., RAM contents, active network connections, process lists) that are essential for forensic analysis and identifying the scope of the compromise. Option C is wrong because running a full antivirus scan on a live, compromised system can alter evidence, trigger destructive malware behaviors, and does not immediately stop the command-and-control communication. Option D is wrong because notifying management and waiting for instructions violates the NIST principle of immediate containment; delaying action allows the attacker to continue exfiltration or lateral movement.

Practice this question →
40
MCQmedium

A security analyst receives an alert from the EDR system indicating that a workstation has been communicating with a known malicious IP address. The analyst confirms the alert and notes that the user is still logged in. Which immediate containment action should the analyst take FIRST?

A.Isolate the workstation using the EDR agent's network isolation capability
B.Create a full forensic image of the hard drive
C.Disable the user's Active Directory account
D.Block the malicious IP address at the firewall
AnswerA

Isolating the endpoint stops all network traffic, preventing data exfiltration or lateral movement.

Why this answer

The first priority is to contain the incident by isolating the endpoint to prevent further communication. EDR agents often have a feature to isolate the host from the network immediately.

Practice this question →
41
Multi-Selectmedium

A security analyst is investigating a phishing incident that led to credential theft. Which TWO actions are appropriate during the containment phase? (Select TWO)

Select 2 answers
A.Reset the compromised user's password
B.Update the incident response plan
C.Conduct a lessons learned meeting
D.Restore the user's machine from backup
E.Block the phishing domain at the email gateway
AnswersA, E

Correct. Prevents further unauthorized access with stolen credentials.

Why this answer

Resetting the compromised user's password (A) immediately invalidates the stolen credentials, preventing the attacker from using them for further unauthorized access. This is a critical containment step because it cuts off the attacker's authenticated session and access to resources like email, VPN, or cloud services. Blocking the phishing domain at the email gateway (E) prevents additional users from receiving the phishing email, reducing the attack surface and stopping the spread of the incident.

Both actions directly limit the impact and scope of the breach during the containment phase.

Exam trap

In the SSCP exam, candidates often confuse the containment phase with recovery or other phases. A common mistake is selecting actions like restoring from backup (recovery) or conducting lessons learned (post-incident), instead of immediate containment steps such as password resets or blocking malicious infrastructure.

Practice this question →
42
Multi-Selectmedium

An organization has suffered a ransomware attack that encrypted files on several file servers. The incident response team is planning recovery. Which TWO actions should be performed to verify that the restored systems are clean before returning them to production? (Select TWO)

Select 2 answers
A.Restore the systems from the most recent backup
B.Change all user passwords associated with the systems
C.Run a full antivirus and anti-malware scan on the restored systems
D.Apply all security patches to the operating system
E.Monitor the systems for any signs of reinfection or anomalous behavior for a period of time
AnswersC, E

Scanning ensures no malware remains in the restored data.

Why this answer

Running a full antivirus and anti-malware scan on the restored systems ensures that no remnants of the ransomware (e.g., dormant payloads, modified registry keys, or backdoor executables) remain in the restored data. Even if the backup was taken before the infection, the restore process could reintroduce malware if the backup itself was compromised or if the ransomware had persisted in the system state. A thorough scan validates that the restored environment is free of known malicious signatures and behavioral indicators.

Exam trap

The trap here is that candidates often assume restoring from a clean backup (Option A) is sufficient to guarantee a clean system, but the SSCP exam emphasizes that backups must be verified as malware-free and that additional validation steps (scanning and monitoring) are required before returning systems to production.

Practice this question →
43
Multi-Selectmedium

During the preparation phase of incident response, which TWO components are essential for an effective incident response plan? (Select TWO)

Select 2 answers
A.A list of approved vendors for hardware replacement
B.A list of all employee passwords
C.A communication plan with contact information for key stakeholders
D.Network topology diagrams
E.Detailed recovery procedures for each critical system
AnswersC, E

Essential for alerting and escalating incidents.

Why this answer

A communication plan with contact information for key stakeholders ensures that the right people can be reached quickly during an incident, which is critical for coordination and decision-making. Option E is correct because detailed recovery procedures for each critical system provide step-by-step instructions to restore operations, minimizing downtime and ensuring consistency in response efforts.

Exam trap

The trap here is that candidates may confuse operational logistics (like vendor lists or network diagrams) with the core structural components of an incident response plan, which must prioritize communication and recovery to enable a coordinated and effective response.

Practice this question →
44
MCQhard

An incident responder is handling a malware outbreak. The malware has been identified as a fileless threat that persists via registry run keys. Which eradication step is most appropriate?

A.Disable the affected user accounts.
B.Reimage all affected systems.
C.Remove the malicious registry entries and restart the systems.
D.Run an antivirus scan on the systems.
AnswerC

Correct. Removing persistence mechanisms is key to eradication.

Why this answer

Fileless malware that persists via registry run keys can be eradicated by removing the malicious registry entries and restarting the systems. This breaks the persistence mechanism without requiring full reimaging, as the malware does not write files to disk and relies on registry-based auto-start locations (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) to execute after reboot.

Exam trap

The trap here is that candidates often choose reimaging (Option B) as a 'safe' default, failing to recognize that fileless malware with only registry persistence can be fully remediated by removing the registry entry and rebooting, without the operational cost of reimaging.

How to eliminate wrong answers

Option A is wrong because disabling affected user accounts does not remove the registry run key entries; the malware would still execute under other user contexts or system accounts, and it does not address the persistence mechanism. Option B is wrong because reimaging all affected systems is an overly aggressive and unnecessary step for fileless malware that only persists via registry keys; it wastes resources and downtime when a targeted registry cleanup and reboot suffices. Option D is wrong because running an antivirus scan is ineffective against fileless malware that has no file on disk to detect; traditional signature-based AV scans often miss registry-resident threats, and the scan does not remove the registry persistence entry.

Practice this question →
45
MCQmedium

An incident responder needs to create a forensic image of a suspect hard drive. Which of the following steps is ESSENTIAL to ensure the integrity of the evidence?

A.Run an antivirus scan on the drive before imaging
B.Use a write blocker to prevent modification of the original drive
C.Boot the suspect system to verify it is functional
D.Perform the imaging over the network to save time
AnswerB

A write blocker ensures read-only access, preserving the integrity of the original evidence.

Why this answer

Using a write blocker is essential because it ensures that no data can be written to the suspect hard drive during the imaging process, preserving the original evidence in a forensically sound state. Without a write blocker, any operating system or imaging tool could inadvertently modify metadata (e.g., access timestamps) or the file system, which would compromise the integrity and admissibility of the evidence in legal proceedings.

Exam trap

A common trap in SSCP is the misconception that booting the system or running software-based checks is acceptable. However, any interaction with the original drive that could alter its state—even a read-only mount without a write blocker—can change metadata and break the chain of custody.

How to eliminate wrong answers

Option A is wrong because running an antivirus scan on the drive before imaging could modify the drive's contents (e.g., by quarantining or deleting files), which violates forensic integrity principles. Option C is wrong because booting the suspect system can alter the system state, including writing to the drive (e.g., log files, temporary files), and may trigger anti-forensic mechanisms. Option D is wrong because performing imaging over the network introduces risks of data corruption, packet loss, or interception, and does not inherently prevent writes to the original drive; a write blocker is still required for forensic soundness.

Practice this question →
46
MCQeasy

Which type of disaster recovery test involves running the DR systems alongside production systems to verify functionality without impacting operations?

A.Tabletop exercise
B.Full interruption test
C.Parallel test
D.Simulation test
AnswerC

Correct. Parallel test runs DR and production systems simultaneously.

Why this answer

A parallel test runs the disaster recovery (DR) systems in a live, non-disruptive manner alongside the production environment. This allows the organization to validate that the DR systems can process transactions and handle workloads correctly without affecting the primary production operations, making it the correct choice for verifying functionality without impact.

Exam trap

The trap here is that candidates often confuse a parallel test with a simulation test, thinking both are 'non-disruptive,' but a simulation test does not run DR systems alongside production and typically uses synthetic data, whereas a parallel test uses real production data and systems in a concurrent, non-interfering manner.

How to eliminate wrong answers

Option A is wrong because a tabletop exercise is a discussion-based walkthrough of roles and procedures, not an actual technical test of DR systems running alongside production. Option B is wrong because a full interruption test (also called a full-scale or hot start test) involves shutting down production systems and failing over to the DR site, which directly impacts operations. Option D is wrong because a simulation test mimics a disaster scenario in a controlled environment but does not run DR systems concurrently with production systems; it often uses isolated test beds.

Practice this question →
47
MCQhard

A security analyst receives a chain of custody form for a hard drive that was seized from a suspected insider threat. The form shows that the drive was handled by three individuals over two days. Which of the following is the PRIMARY reason for maintaining a chain of custody?

A.To prove that the evidence has not been tampered with and is admissible in legal proceedings
B.To determine the cost of the forensic investigation
C.To ensure the hard drive is stored in a secure location
D.To track the productivity of forensic analysts
AnswerA

Correct. Chain of custody provides a documented history to show evidence integrity.

Why this answer

The chain of custody is a documented chronological record of evidence handling, which is essential to demonstrate that the hard drive has not been altered, damaged, or substituted since seizure. Without this unbroken record, the evidence could be challenged as inadmissible in court under rules like the Federal Rules of Evidence (FRE) 901, which require authentication. This is the primary reason because legal admissibility hinges on proving integrity and continuity of custody.

Exam trap

(ISC)² often tests the distinction between the legal necessity of chain of custody (admissibility) versus operational tasks like storage or cost tracking, leading candidates to confuse a supporting activity (secure storage) with the primary purpose.

How to eliminate wrong answers

Option B is wrong because determining the cost of the forensic investigation is an administrative or budgeting concern, not the primary legal purpose of chain of custody. Option C is wrong because while secure storage is a component of proper evidence handling, the chain of custody specifically documents who had access and when, not just the storage location itself. Option D is wrong because tracking analyst productivity is a management metric unrelated to the forensic integrity and legal admissibility requirements that chain of custody is designed to satisfy.

Practice this question →
48
MCQmedium

A security team detects lateral movement within the network. Which containment strategy should be applied first to limit the spread of the threat?

A.Disable user accounts associated with compromised systems.
B.Isolate the affected systems by disconnecting them from the network.
C.Block the attacker's IP addresses at the perimeter firewall.
D.Reimage all compromised systems immediately.
AnswerB

Correct. Network isolation prevents the attacker from moving to other systems.

Why this answer

Isolating affected systems by disconnecting them from the network is the immediate priority because it physically or logically severs the attacker's ability to propagate laterally via SMB, RDP, or other network protocols. This containment step stops the spread without destroying forensic evidence, which would be lost if systems were reimaged or powered off prematurely.

Exam trap

ISC2 often tests the misconception that blocking external IPs or disabling accounts is sufficient for containment, when in fact internal lateral movement requires immediate network-level isolation of the compromised host.

How to eliminate wrong answers

Option A is wrong because disabling user accounts does not stop an attacker who has already established remote access via a service account, kernel-level backdoor, or cached credentials; the compromised system remains on the network and can still be used for lateral movement. Option C is wrong because blocking IP addresses at the perimeter firewall is ineffective against internal lateral movement, which occurs on the LAN and does not traverse the perimeter; the attacker can also easily change IP addresses or use internal routing to bypass the block. Option D is wrong because reimaging destroys volatile evidence (e.g., memory dumps, active network connections) and takes too long, allowing the attacker to continue spreading while the system is being rebuilt; containment must precede eradication.

Practice this question →
49
Multi-Selecthard

During a ransomware incident, the incident response team needs to recover encrypted servers. Which THREE steps are essential for successful recovery? (Select THREE)

Select 3 answers
A.Restore data from the most recent clean backup
B.Pay the ransom to obtain the decryption key
C.Patch the vulnerability that allowed the ransomware to enter
D.Delete all user accounts and recreate them
E.Scan restored systems to ensure eradication of malware
AnswersA, C, E

Correct. Provides a known-good state.

Why this answer

Restoring from the most recent clean backup is the primary recovery method for ransomware incidents. It ensures that encrypted data can be recovered without paying the ransom, provided the backup was taken before the infection and is stored offline or immutable to prevent encryption. This aligns with the 3-2-1 backup strategy (three copies, two media types, one offsite) and is a core step in the NIST SP 800-61 incident response process.

Exam trap

The SSCP exam often tests the misconception that paying the ransom is a valid recovery step, but it emphasizes that payment should never be recommended due to lack of guarantee and ethical concerns.

Practice this question →
50
MCQmedium

A security team is collecting evidence from a compromised server. They need to create a forensic image. Which of the following is the CORRECT procedure to ensure data integrity?

A.Use a write blocker to create a bit-for-bit copy, then compute MD5 hash of the original and the copy to verify they match
B.Take a photo of the screen and document file timestamps manually
C.Create a compressed image file using software without a write blocker
D.Boot the system and run a backup utility to copy files to an external drive
AnswerA

Correct. This preserves integrity and verifies that the copy is exact.

Why this answer

Forensic imaging requires a write blocker to prevent any modification to the original evidence, and a bit-for-bit copy preserves all data, including slack space and deleted files. Computing an MD5 hash of both the original and the copy verifies integrity by ensuring the hashes match, confirming no data alteration occurred during acquisition.

Exam trap

The trap here is that candidates may think a simple backup or file copy is sufficient for forensic evidence, but the SSCP exam emphasizes that only a write-blocked bit-for-bit copy with hash verification ensures data integrity and admissibility.

How to eliminate wrong answers

Option B is wrong because taking a photo and manually documenting timestamps does not create a forensic image; it only captures superficial information and fails to preserve the full data for analysis. Option C is wrong because creating a compressed image without a write blocker risks altering the original drive's data due to write operations, compromising evidence integrity. Option D is wrong because booting the system and running a backup utility modifies the system state (e.g., writes to swap, logs, or file access times) and does not produce a bit-for-bit copy, violating forensic best practices.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Sscp Incident Response questions.

Start 20-question session