SSCP Certification SSCP Incident Response and Recovery 2

Question 1

During the containment phase of incident response, what is the PRIMARY goal?

Accepted Answer

Limit the damage and prevent further spread

Answer

Containment aims to limit damage and prevent the incident from spreading to other systems before eradication begins.

Question 2

Which type of evidence is considered MOST volatile and should be collected first during incident response?

Accepted Answer

Contents of RAM (memory)

Answer

RAM contents are the most volatile evidence because they are lost when a system is powered off, so they must be captured first.

Question 3

An organization's incident response plan calls for 'short-term containment' after detection. Which action best describes this?

Accepted Answer

Isolating affected systems from the network

Answer

Short-term containment involves isolating affected systems to stop ongoing damage without permanently altering the environment.

Question 4

What does the term 'chain of custody' mean in the context of digital forensics during incident response?

Accepted Answer

The documented process of evidence handling from collection to court

Answer

Chain of custody documents who collected, handled, and transferred evidence to ensure its integrity and admissibility in legal proceedings.

Question 5

During the eradication phase, a security analyst discovers malware persisting via a registry run key. After removing the malware, what is the NEXT critical step?

Accepted Answer

Remove the malicious registry entry as well

Answer

Removing only the malware executable without eliminating its persistence mechanism (the registry key) allows it to re-execute on reboot.

SSCP Certification Practice Test

SSCP Certification Practice Test

SSCP Certification SSCP Incident Response and Recovery 2