Free SSCA Incident Response & Recovery Questions and Answers

Question 1

What is the first step in the incident response lifecycle?

Accepted Answer

Preparation

Answer

Containment

Answer

Recovery

Answer

Eradication

Question 2

Which phase involves stopping an active threat and preventing further damage?

Accepted Answer

Containment

Answer

Detection

Answer

Reporting

Answer

Documentation

Question 3

Why is evidence preservation important during an incident?

Accepted Answer

To support forensic analysis and legal procedures

Answer

To improve software performance

Answer

To assist in future audits

Answer

To notify customers

Question 4

What is the primary goal of the recovery phase in incident response?

Accepted Answer

Restore operations and validate fixes

Answer

Install new antivirus

Answer

Delete logs

Answer

Isolate unaffected systems

Question 5

What tool is typically used to document the timeline and actions taken during an incident?

Accepted Answer

Incident response log

Answer

System restore

Answer

Antivirus scan

Answer

Performance monitor

Question 6

Which of the following is a key activity during post-incident review?

Accepted Answer

Conduct root cause analysis

Answer

Eradicate malware

Answer

Change all user accounts

Answer

Disconnect the internet

Question 7

What is one benefit of using incident response playbooks?

Accepted Answer

Improve consistency in handling incidents

Answer

Reduce staffing costs

Answer

Block all incoming traffic

Answer

Automate marketing processes

Question 8

Who should be informed first when a critical incident is detected?

Accepted Answer

Incident response team

Answer

Legal team

Answer

Marketing department

Answer

General public

Question 9

What is an example of a recovery control after a data breach?

Accepted Answer

Changing user passwords

Answer

Reviewing job descriptions

Answer

Shredding paper files

Answer

Rebooting systems