SSCP Certification SSCP Incident Response and Recovery 4 — Questions and Answers
Question 1: What is the primary purpose of a Computer Security Incident Response Team (CSIRT)?
- To develop security policies and compliance frameworks
- To coordinate the detection, analysis, and response to security incidents (Correct answer)
- To perform vulnerability assessments on production systems
- To manage firewall rules and network access control lists
Correct answer: To coordinate the detection, analysis, and response to security incidents
A CSIRT is responsible for coordinating the organization's response to security incidents, from detection through recovery.
Question 2: Which of the following best describes 'indicator of compromise' (IoC)?
- A predictive model for future attack vectors
- Forensic artifacts that suggest a system has been breached (Correct answer)
- A baseline configuration for secure system deployment
- A metric used to calculate incident response effectiveness
Correct answer: Forensic artifacts that suggest a system has been breached
IoCs are forensic artifacts such as malicious IPs, file hashes, or registry keys that indicate a system has likely been compromised.
Question 3: An attacker used a zero-day exploit to breach a network. During post-incident analysis, which document should be UPDATED first to address this gap?
- The organization's privacy policy
- The incident response plan and detection playbooks (Correct answer)
- The acceptable use policy for employees
- The disaster recovery plan for natural disasters
Correct answer: The incident response plan and detection playbooks
The incident response plan and playbooks must be updated to incorporate detection methods and response procedures for previously unknown exploit types.
Question 4: In the context of business continuity, what is an 'Alternate Processing Site' that is fully operational and can take over immediately with no setup time?
- Cold site
- Warm site
- Hot site (Correct answer)
- Mobile site
Correct answer: Hot site
A hot site is a fully equipped, operational duplicate facility that can take over immediately with minimal or no downtime after a disaster.
Question 5: During a security incident, an analyst notices that an attacker deleted Windows Event Logs to cover their tracks. Which forensic technique might still recover evidence of the deleted logs?
- Reviewing the firewall's stateful inspection tables
- Analyzing Volume Shadow Copies or backup snapshots (Correct answer)
- Checking the active directory replication logs
- Running a new vulnerability scan against the system
Correct answer: Analyzing Volume Shadow Copies or backup snapshots
Volume Shadow Copies (VSS) or backup snapshots may contain previous versions of event logs before they were deleted by the attacker.
Question 6: What does 'dwell time' refer to in the context of cybersecurity incidents?
- The time required to restore systems after an incident
- The duration between initial compromise and detection of the breach (Correct answer)
- The time an incident response team spends in the containment phase
- The interval between vulnerability disclosure and patch release
Correct answer: The duration between initial compromise and detection of the breach
Dwell time (also called breakout time) is the period an attacker remains undetected inside a network after initial compromise.
Question 7: Which type of backup strategy involves backing up only the data that has changed since the LAST FULL backup, regardless of incremental backups?
- Incremental backup
- Differential backup (Correct answer)
- Continuous backup
- Snapshot backup
Correct answer: Differential backup
A differential backup captures all changes since the last full backup, making restoration faster than incremental since only two sets (full + latest differential) are needed.
SSCP Certification SSCP Incident Response and Recovery 4
What is the primary purpose of a Computer Security Incident Response Team (CSIRT)?