SSCP Incident Response & Recovery 2

Question 1

Which document formally authorizes an incident response team to investigate a suspected security breach on production systems?

Accepted Answer

Rules of engagement or authorization memo

Answer

Rules of engagement or an authorization memo grant the IR team legal permission to access and investigate systems without being liable for unauthorized access.

Question 2

During a ransomware incident, the IR team must decide whether to restore from backup or pay the ransom. Which factor most directly drives this decision?

Accepted Answer

Age and integrity of available backups

Answer

The viability, recency, and tested integrity of backups determines whether restoration is feasible and faster than negotiating a ransom.

Question 3

What is the primary purpose of a 'hot wash' or after-action review following an incident?

Accepted Answer

Identify lessons learned to improve future response

Answer

A hot wash captures what worked, what failed, and recommended improvements so the organization strengthens its IR capability for the next event.

Question 4

A security analyst receives an alert that a workstation is beaconing to a known C2 IP every 60 seconds. The FIRST containment action should be to:

Accepted Answer

Isolate the host from the network while preserving volatile memory

Answer

Network isolation stops ongoing exfiltration while preserving volatile memory (running processes, connections) critical for forensic analysis.

Question 5

Which metric best measures the effectiveness of an incident response program over time?

Accepted Answer

Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR)

Answer

MTTD and MTTR quantify how quickly threats are found and neutralized, directly reflecting IR program maturity and effectiveness.

(SSCP) Security Operations and Administration Practice Test

(SSCP) Security Operations and Administration Practice Test

SSCP Incident Response & Recovery 2