SSCP Incident Response & Recovery 2 — Questions and Answers
Question 1: Which document formally authorizes an incident response team to investigate a suspected security breach on production systems?
- Chain of custody form
- Rules of engagement or authorization memo (Correct answer)
- Business continuity plan
- Risk register entry
Correct answer: Rules of engagement or authorization memo
Rules of engagement or an authorization memo grant the IR team legal permission to access and investigate systems without being liable for unauthorized access.
Question 2: During a ransomware incident, the IR team must decide whether to restore from backup or pay the ransom. Which factor most directly drives this decision?
- Cost of the ransom payment
- Age and integrity of available backups (Correct answer)
- Number of systems encrypted
- Attacker's known identity
Correct answer: Age and integrity of available backups
The viability, recency, and tested integrity of backups determines whether restoration is feasible and faster than negotiating a ransom.
Question 3: What is the primary purpose of a 'hot wash' or after-action review following an incident?
- Destroy evidence before litigation
- Restore all affected systems
- Identify lessons learned to improve future response (Correct answer)
- Notify regulators of the breach
Correct answer: Identify lessons learned to improve future response
A hot wash captures what worked, what failed, and recommended improvements so the organization strengthens its IR capability for the next event.
Question 4: A security analyst receives an alert that a workstation is beaconing to a known C2 IP every 60 seconds. The FIRST containment action should be to:
- Reimage the workstation immediately
- Isolate the host from the network while preserving volatile memory (Correct answer)
- Block the C2 IP at the firewall only
- Notify law enforcement before taking any action
Correct answer: Isolate the host from the network while preserving volatile memory
Network isolation stops ongoing exfiltration while preserving volatile memory (running processes, connections) critical for forensic analysis.
Question 5: Which metric best measures the effectiveness of an incident response program over time?
- Total number of security tools deployed
- Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) (Correct answer)
- Number of incidents declared per year
- Headcount of the security operations center
Correct answer: Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR)
MTTD and MTTR quantify how quickly threats are found and neutralized, directly reflecting IR program maturity and effectiveness.
Question 6: An organization's IR plan calls for notifying legal counsel immediately upon incident declaration. This requirement primarily addresses which concern?
- Ensuring technical remediation is prioritized
- Establishing attorney-client privilege over IR communications (Correct answer)
- Speeding up forensic imaging
- Complying with change management procedures
Correct answer: Establishing attorney-client privilege over IR communications
Involving legal counsel early can extend attorney-client privilege to IR findings, protecting sensitive investigation details from discovery in litigation.
Question 7: When rebuilding a compromised server, which action must occur BEFORE returning it to production?
- Applying all patches and verifying the system against a known-good baseline (Correct answer)
- Archiving all old log files from the compromised system
- Disabling the firewall temporarily to test connectivity
- Notifying all end users of the rebuild schedule
Correct answer: Applying all patches and verifying the system against a known-good baseline
Patching and baseline verification ensure the root vulnerability is closed and no malicious artifacts remain before the system handles live traffic.
SSCP Incident Response & Recovery 2
Which document formally authorizes an incident response team to investigate a suspected security breach on production systems?