SSCP Certification SSCP Incident Response and Recovery 3

Question 1

Which NIST SP 800-61 incident response lifecycle phase involves activities such as installing patches and improving defenses to prevent recurrence?

Accepted Answer

Eradication and Recovery

Answer

The Eradication and Recovery phase in NIST SP 800-61 includes eliminating the root cause, patching systems, and restoring them to normal operation.

Question 2

A security team receives an alert that an insider is exfiltrating data via encrypted USB drives. What is the MOST appropriate initial containment action?

Accepted Answer

Disable the employee's USB port access and alert HR/legal

Answer

Disabling USB access stops ongoing exfiltration while alerting HR and legal ensures proper handling of the insider threat.

Question 3

What is the purpose of a 'lessons learned' meeting held after an incident is resolved?

Accepted Answer

To improve processes, update documentation, and prevent future incidents

Answer

Lessons learned meetings focus on identifying what worked, what failed, and how to improve the incident response process going forward.

Question 4

In incident classification, a 'Category 3' incident typically refers to which severity level in most frameworks?

Accepted Answer

Medium impact, affecting a department or business unit

Answer

While frameworks vary, Category 3 typically maps to medium severity—affecting a significant portion of the organization but not causing total outage.

Question 5

Which log source would be MOST useful for determining whether a compromised account was used for lateral movement within a network?

Accepted Answer

Windows Security Event Logs (authentication/logon events)

Answer

Windows Security Event Logs capture authentication and logon events, revealing which accounts accessed which systems and when.

SSCP Certification Practice Test

SSCP Certification Practice Test

SSCP Certification SSCP Incident Response and Recovery 3