SSCP Incident Response & Recovery 3 — Questions and Answers
Question 1: Which NIST SP 800-61 Rev. 2 phase occurs immediately after 'Detection and Analysis'?
- Preparation
- Containment, Eradication, and Recovery (Correct answer)
- Post-Incident Activity
- Risk Assessment
Correct answer: Containment, Eradication, and Recovery
NIST SP 800-61 defines four phases: Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-Incident Activity.
Question 2: A forensic investigator uses write blockers when imaging a hard drive primarily to:
- Speed up the imaging process
- Prevent modification of evidence on the source drive (Correct answer)
- Encrypt the forensic image automatically
- Validate the hash of the destination media
Correct answer: Prevent modification of evidence on the source drive
Write blockers are hardware or software controls that ensure no data is written back to the evidence drive, preserving its original state for legal admissibility.
Question 3: Which type of incident response team model embeds security personnel within each business unit rather than centralizing them?
- Centralized CSIRT
- Distributed CSIRT (Correct answer)
- Coordinating CSIRT
- Virtual CSIRT
Correct answer: Distributed CSIRT
A distributed CSIRT places IR staff within individual departments, improving response speed and local knowledge at the cost of coordination overhead.
Question 4: During eradication, the IR team discovers a backdoor account created by the attacker. The BEST response is to:
- Rename the account and reset its password
- Delete the account and audit all other accounts for similar backdoors (Correct answer)
- Disable the account but retain it for monitoring
- Transfer the account to a honeypot environment
Correct answer: Delete the account and audit all other accounts for similar backdoors
Removing the backdoor account and sweeping all accounts ensures eradication is complete and no other persistence mechanisms were planted.
Question 5: An IR team classifies an event as a 'security incident' rather than a mere 'security event' when:
- A vulnerability scanner reports a finding
- An event adversely impacts confidentiality, integrity, or availability (Correct answer)
- An employee reports suspicious email
- A firewall blocks an inbound connection
Correct answer: An event adversely impacts confidentiality, integrity, or availability
An incident is a security event that actually or imminently threatens the CIA triad, distinguishing it from routine alerts that do not indicate a breach.
Question 6: Which recovery strategy involves maintaining a fully operational duplicate site that can assume production load within minutes?
- Cold site
- Warm site
- Hot site (Correct answer)
- Mobile recovery unit
Correct answer: Hot site
A hot site mirrors the production environment with live data synchronization, enabling near-instant failover with minimal data loss or downtime.
Question 7: What does 'scoping' an incident mean in IR terminology?
- Writing the final incident report
- Determining the full extent of affected systems, data, and users (Correct answer)
- Assigning severity levels to new alerts
- Scheduling the next tabletop exercise
Correct answer: Determining the full extent of affected systems, data, and users
Scoping defines the blast radius of an incident—which assets are compromised, what data may be exposed, and how far lateral movement has spread.
SSCP Incident Response & Recovery 3
Which NIST SP 800-61 Rev. 2 phase occurs immediately after 'Detection and Analysis'?