SSCP Certification SSCP Incident Response and Recovery 3 — Questions and Answers
Question 1: Which NIST SP 800-61 incident response lifecycle phase involves activities such as installing patches and improving defenses to prevent recurrence?
- Detection and Analysis
- Containment
- Post-Incident Activity
- Eradication and Recovery (Correct answer)
Correct answer: Eradication and Recovery
The Eradication and Recovery phase in NIST SP 800-61 includes eliminating the root cause, patching systems, and restoring them to normal operation.
Question 2: A security team receives an alert that an insider is exfiltrating data via encrypted USB drives. What is the MOST appropriate initial containment action?
- Immediately terminate the employee
- Disable the employee's USB port access and alert HR/legal (Correct answer)
- Encrypt all company data immediately
- Perform a full forensic investigation before taking any action
Correct answer: Disable the employee's USB port access and alert HR/legal
Disabling USB access stops ongoing exfiltration while alerting HR and legal ensures proper handling of the insider threat.
Question 3: What is the purpose of a 'lessons learned' meeting held after an incident is resolved?
- To assign blame to responsible individuals
- To improve processes, update documentation, and prevent future incidents (Correct answer)
- To satisfy legal requirements for incident disclosure
- To calculate the total financial cost of the incident
Correct answer: To improve processes, update documentation, and prevent future incidents
Lessons learned meetings focus on identifying what worked, what failed, and how to improve the incident response process going forward.
Question 4: In incident classification, a 'Category 3' incident typically refers to which severity level in most frameworks?
- Low impact, affecting only a single workstation
- Medium impact, affecting a department or business unit (Correct answer)
- High impact, affecting the entire organization
- Critical, involving nation-state actors
Correct answer: Medium impact, affecting a department or business unit
While frameworks vary, Category 3 typically maps to medium severity—affecting a significant portion of the organization but not causing total outage.
Question 5: Which log source would be MOST useful for determining whether a compromised account was used for lateral movement within a network?
- Application server access logs
- Windows Security Event Logs (authentication/logon events) (Correct answer)
- Antivirus scan reports
- Physical access control logs
Correct answer: Windows Security Event Logs (authentication/logon events)
Windows Security Event Logs capture authentication and logon events, revealing which accounts accessed which systems and when.
Question 6: A forensic investigator creates a bit-for-bit copy of a hard drive before analysis. What is this copy called?
- A logical backup
- A forensic image (Correct answer)
- A shadow copy
- A differential backup
Correct answer: A forensic image
A forensic image is a bit-for-bit copy of storage media that captures all data including deleted files, preserving the original evidence.
Question 7: During incident response, a team member suggests wiping and reimaging an infected server immediately. What is a key risk of this approach?
- It will restore the vulnerability that caused the infection
- Evidence critical to understanding the attack may be destroyed (Correct answer)
- The server cannot be reimaged if malware is present
- Reimaging takes longer than manual cleanup
Correct answer: Evidence critical to understanding the attack may be destroyed
Wiping without first collecting forensic evidence destroys attack indicators, making root cause analysis and attribution impossible.
SSCP Certification SSCP Incident Response and Recovery 3
Which NIST SP 800-61 incident response lifecycle phase involves activities such as installing patches and improving defenses to prevent recurrence?