How should I use these Incident Response and Recovery practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Incident Response and Recovery questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Incident Response and Recovery domain.

SSCP · topic practice

Incident Response and Recovery practice questions

Practise Systems Security Certified Practitioner SSCP Incident Response and Recovery practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Incident Response and Recovery

Practice 10 questions Browse domain →

What the exam tests

What to know about Incident Response and Recovery

Incident Response and Recovery questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Incident Response and Recovery exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Incident Response and Recovery questions

20 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Read the full Incident Response and Recovery explanation →

During the eradication phase of a malware incident, a security analyst removes malicious files and cleans registry persistence. What is the MOST critical additional step to prevent reinfection through the same vector?

Trap 1: Running a full antivirus scan

Antivirus scan may not detect all root causes; patching is critical.

Trap 2: Resetting all user passwords

Password reset is important but does not address the technical vulnerability.

Trap 3: Reimaging the system with a clean OS

Reimaging is effective but may not be necessary if eradication is thorough; patching is key.

Study all Incident Response and Recovery common traps →

A
Patching the vulnerability that was exploited
Correct. Without patching, the same vulnerability can be exploited again.
B
Running a full antivirus scan
Why wrong: Antivirus scan may not detect all root causes; patching is critical.
C
Resetting all user passwords
Why wrong: Password reset is important but does not address the technical vulnerability.
D
Reimaging the system with a clean OS
Why wrong: Reimaging is effective but may not be necessary if eradication is thorough; patching is key.

Incident Response and Recovery practice questions

What to know about Incident Response and Recovery

Common Incident Response and Recovery exam traps

Incident Response and Recovery questions

During the eradication phase of a malware incident, a security analyst removes malicious files and cleans registry persistence. What is the MOST critical additional step to prevent reinfection through the same vector?

Which TWO metrics are commonly tracked to measure the effectiveness of the incident response process? (Select TWO)

An organization has experienced a ransomware attack. After containing the incident, the response team plans to restore systems from backups. Which step is most critical before restoring production systems?

An organization's disaster recovery plan specifies an RPO of 4 hours and an RTO of 24 hours for a critical database. Which of the following best describes these metrics?

After a security incident, the response team holds a lessons learned meeting. Which TWO are primary objectives of this meeting? (Select two.)

During the preparation phase of the incident response lifecycle, which of the following is the MOST important component to establish?

An analyst detects suspicious outbound traffic from a server to a known command-and-control IP address. According to NIST SP 800-61, which phase of the incident response lifecycle does this activity fall under?

During a malware outbreak, a security analyst needs to contain the spread. The affected systems are on the same VLAN as critical servers. Which of the following containment actions should be performed FIRST to minimize impact?

An incident responder is collecting evidence from a compromised server. Which of the following is the correct order for collecting volatile data?

During a forensic investigation, an examiner creates a bit-for-bit copy of a hard drive using a write blocker. What is the purpose of using a write blocker?

Which metric is used to measure the average time it takes to detect an incident?

After a security incident, the incident response team holds a lessons learned meeting. What is the PRIMARY outcome of this meeting?

After a ransomware incident, the incident response team is conducting recovery. Which THREE steps are essential to ensure a secure restoration and prevent reinfection? (Choose three.)

During a post-incident review of a data breach, the incident response team is evaluating the chain of custody for forensic evidence. Which THREE practices demonstrate proper evidence handling? (Choose three.)

During which phase of the NIST SP 800-61 incident response lifecycle are incident response plan updates and lessons learned typically documented?

An organization's security team detects a potential data breach. After confirming the incident, they classify it as P2 (high severity) and begin containment. Which action should be performed FIRST to preserve evidence for forensic analysis?

A security analyst receives a chain of custody form for a hard drive that was seized from a suspected insider threat. The form shows that the drive was handled by three individuals over two days. Which of the following is the PRIMARY reason for maintaining a chain of custody?

During incident response, a team needs to isolate an infected workstation that is part of a critical manufacturing network. Which containment method is MOST appropriate to minimize disruption while preventing the spread of malware?

After a ransomware incident, an organization decides to restore data from backups. The RPO (Recovery Point Objective) is 4 hours. What does this RPO indicate?

Which DR testing type involves running recovery systems in parallel with production systems to verify functionality without impacting live operations?

Track your progress over time

Start a Incident Response and Recovery only practice session

Related SSCP topic practice pages

Access Controls practice questions

Risk Identification, Monitoring, and Analysis practice questions

Incident Response and Recovery practice questions

Security Operations and Administration practice questions

Cryptography practice questions

Network and Communications Security practice questions

Systems and Application Security practice questions

SSCP fundamentals practice questions

SSCP scenario practice questions

SSCP troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid