SSCP Certification SSCP Incident Response and Recovery 4

Question 1

What is the primary purpose of a Computer Security Incident Response Team (CSIRT)?

Accepted Answer

To coordinate the detection, analysis, and response to security incidents

Answer

A CSIRT is responsible for coordinating the organization's response to security incidents, from detection through recovery.

Question 2

Which of the following best describes 'indicator of compromise' (IoC)?

Accepted Answer

Forensic artifacts that suggest a system has been breached

Answer

IoCs are forensic artifacts such as malicious IPs, file hashes, or registry keys that indicate a system has likely been compromised.

Question 3

An attacker used a zero-day exploit to breach a network. During post-incident analysis, which document should be UPDATED first to address this gap?

Accepted Answer

The incident response plan and detection playbooks

Answer

The incident response plan and playbooks must be updated to incorporate detection methods and response procedures for previously unknown exploit types.

Question 4

In the context of business continuity, what is an 'Alternate Processing Site' that is fully operational and can take over immediately with no setup time?

Accepted Answer

Hot site

Answer

A hot site is a fully equipped, operational duplicate facility that can take over immediately with minimal or no downtime after a disaster.

Question 5

During a security incident, an analyst notices that an attacker deleted Windows Event Logs to cover their tracks. Which forensic technique might still recover evidence of the deleted logs?

Accepted Answer

Analyzing Volume Shadow Copies or backup snapshots

Answer

Volume Shadow Copies (VSS) or backup snapshots may contain previous versions of event logs before they were deleted by the attacker.

SSCP Certification Practice Test

SSCP Certification Practice Test

SSCP Certification SSCP Incident Response and Recovery 4