SSCP Certification SSCP Incident Response and Recovery 2

Question 1

During the containment phase of incident response, what is the PRIMARY goal?

Accepted Answer

Limit the damage and prevent further spread

Answer

Eradicate the threat completely

Answer

Restore normal operations immediately

Answer

Document the attack vector for legal purposes

Question 2

Which type of evidence is considered MOST volatile and should be collected first during incident response?

Accepted Answer

Contents of RAM (memory)

Answer

Hard drive contents

Answer

System logs on disk

Answer

Network traffic logs stored on a SIEM

Question 3

An organization's incident response plan calls for 'short-term containment' after detection. Which action best describes this?

Accepted Answer

Isolating affected systems from the network

Answer

Restoring from a clean backup

Answer

Patching the vulnerability that was exploited

Answer

Filing a criminal complaint with law enforcement

Question 4

What does the term 'chain of custody' mean in the context of digital forensics during incident response?

Accepted Answer

The documented process of evidence handling from collection to court

Answer

The sequence of commands executed by the attacker

Answer

The hierarchy of incident response team members

Answer

The order in which systems were compromised

Question 5

During the eradication phase, a security analyst discovers malware persisting via a registry run key. After removing the malware, what is the NEXT critical step?

Accepted Answer

Remove the malicious registry entry as well

Answer

Immediately reconnect the system to the network

Answer

Notify users the system is clean

Answer

Archive the malware sample and close the ticket

Question 6

Which metric defines the maximum acceptable amount of data loss measured in time that an organization can tolerate after an incident?

Accepted Answer

RPO (Recovery Point Objective)

Answer

RTO (Recovery Time Objective)

Answer

MTD (Maximum Tolerable Downtime)

Answer

MTTR (Mean Time To Recover)

Question 7

After recovering from a ransomware attack, which action should be taken BEFORE reconnecting restored systems to the production network?

Accepted Answer

Verify systems are clean and vulnerability is patched

Answer

Update the incident response plan documentation

Answer

Notify law enforcement of the ransom demand

Answer

Disable endpoint detection to reduce false positives