SSCP Certification SSCP Incident Response and Recovery 2 — Questions and Answers
Question 1: During the containment phase of incident response, what is the PRIMARY goal?
- Eradicate the threat completely
- Limit the damage and prevent further spread (Correct answer)
- Restore normal operations immediately
- Document the attack vector for legal purposes
Correct answer: Limit the damage and prevent further spread
Containment aims to limit damage and prevent the incident from spreading to other systems before eradication begins.
Question 2: Which type of evidence is considered MOST volatile and should be collected first during incident response?
- Hard drive contents
- System logs on disk
- Contents of RAM (memory) (Correct answer)
- Network traffic logs stored on a SIEM
Correct answer: Contents of RAM (memory)
RAM contents are the most volatile evidence because they are lost when a system is powered off, so they must be captured first.
Question 3: An organization's incident response plan calls for 'short-term containment' after detection. Which action best describes this?
- Restoring from a clean backup
- Isolating affected systems from the network (Correct answer)
- Patching the vulnerability that was exploited
- Filing a criminal complaint with law enforcement
Correct answer: Isolating affected systems from the network
Short-term containment involves isolating affected systems to stop ongoing damage without permanently altering the environment.
Question 4: What does the term 'chain of custody' mean in the context of digital forensics during incident response?
- The sequence of commands executed by the attacker
- The documented process of evidence handling from collection to court (Correct answer)
- The hierarchy of incident response team members
- The order in which systems were compromised
Correct answer: The documented process of evidence handling from collection to court
Chain of custody documents who collected, handled, and transferred evidence to ensure its integrity and admissibility in legal proceedings.
Question 5: During the eradication phase, a security analyst discovers malware persisting via a registry run key. After removing the malware, what is the NEXT critical step?
- Immediately reconnect the system to the network
- Remove the malicious registry entry as well (Correct answer)
- Notify users the system is clean
- Archive the malware sample and close the ticket
Correct answer: Remove the malicious registry entry as well
Removing only the malware executable without eliminating its persistence mechanism (the registry key) allows it to re-execute on reboot.
Question 6: Which metric defines the maximum acceptable amount of data loss measured in time that an organization can tolerate after an incident?
- RTO (Recovery Time Objective)
- MTD (Maximum Tolerable Downtime)
- RPO (Recovery Point Objective) (Correct answer)
- MTTR (Mean Time To Recover)
Correct answer: RPO (Recovery Point Objective)
RPO defines the maximum acceptable age of backup data that can be restored after a disruption, measured as a point in time.
Question 7: After recovering from a ransomware attack, which action should be taken BEFORE reconnecting restored systems to the production network?
- Update the incident response plan documentation
- Verify systems are clean and vulnerability is patched (Correct answer)
- Notify law enforcement of the ransom demand
- Disable endpoint detection to reduce false positives
Correct answer: Verify systems are clean and vulnerability is patched
Systems must be verified as clean and the exploited vulnerability patched before reconnection to prevent re-infection.
SSCP Certification SSCP Incident Response and Recovery 2
During the containment phase of incident response, what is the PRIMARY goal?