SSCP Incident Response & Recovery 3

Question 1

Which NIST SP 800-61 Rev. 2 phase occurs immediately after 'Detection and Analysis'?

Accepted Answer

Containment, Eradication, and Recovery

Answer

NIST SP 800-61 defines four phases: Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-Incident Activity.

Question 2

A forensic investigator uses write blockers when imaging a hard drive primarily to:

Accepted Answer

Prevent modification of evidence on the source drive

Answer

Write blockers are hardware or software controls that ensure no data is written back to the evidence drive, preserving its original state for legal admissibility.

Question 3

Which type of incident response team model embeds security personnel within each business unit rather than centralizing them?

Accepted Answer

Distributed CSIRT

Answer

A distributed CSIRT places IR staff within individual departments, improving response speed and local knowledge at the cost of coordination overhead.

Question 4

During eradication, the IR team discovers a backdoor account created by the attacker. The BEST response is to:

Accepted Answer

Delete the account and audit all other accounts for similar backdoors

Answer

Removing the backdoor account and sweeping all accounts ensures eradication is complete and no other persistence mechanisms were planted.

Question 5

An IR team classifies an event as a 'security incident' rather than a mere 'security event' when:

Accepted Answer

An event adversely impacts confidentiality, integrity, or availability

Answer

An incident is a security event that actually or imminently threatens the CIA triad, distinguishing it from routine alerts that do not indicate a breach.

(SSCP) Security Operations and Administration Practice Test

(SSCP) Security Operations and Administration Practice Test

SSCP Incident Response & Recovery 3