SSCP Certification SSCP Incident Response and Recovery 5

Question 1

A company activates its Business Continuity Plan (BCP) after a flood damages its primary datacenter. Which phase of incident response does this MOST align with?

Accepted Answer

Recovery

Answer

Activating a BCP to restore business functions after a disaster aligns with the Recovery phase, which focuses on restoring normal operations.

Question 2

Under US federal law, which regulation requires certain organizations to report cybersecurity incidents to CISA within 72 hours?

Accepted Answer

CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act)

Answer

CIRCIA mandates that covered critical infrastructure entities report significant cyber incidents to CISA within 72 hours of reasonable belief of occurrence.

Question 3

What is the key difference between an 'incident' and an 'event' in security operations?

Accepted Answer

An incident is an adverse event that threatens confidentiality, integrity, or availability; an event is any observable occurrence

Answer

An event is any observable system occurrence, while an incident is specifically an adverse event (or threat of one) that negatively impacts security.

Question 4

During a ransomware incident, the security team is deciding whether to pay the ransom. Which factor MOST influences the decision from a security policy perspective?

Accepted Answer

Availability of clean backups to restore from

Answer

The existence of reliable, clean backups is the most critical factor because it provides an alternative to paying the ransom and enables recovery.

Question 5

Which incident response concept involves pre-approved, documented procedures for specific attack types that analysts follow step-by-step?

Accepted Answer

Security playbooks (runbooks)

Answer

Security playbooks (runbooks) are pre-documented, step-by-step procedures for responding to specific incident types, ensuring consistent and efficient response.

SSCP Certification Practice Test

SSCP Certification Practice Test

SSCP Certification SSCP Incident Response and Recovery 5