SSCP Incident Response & Recovery 4 — Questions and Answers
Question 1: A company must notify affected individuals within 72 hours of discovering a personal data breach. This requirement most likely comes from:
- NIST Cybersecurity Framework
- GDPR Article 33 (Correct answer)
- ISO/IEC 27001 Annex A
- SOC 2 Type II criteria
Correct answer: GDPR Article 33
GDPR Article 33 mandates that controllers notify the supervisory authority within 72 hours of becoming aware of a personal data breach.
Question 2: Which technique allows an IR team to monitor attacker activity on a compromised host without alerting the attacker, gathering additional intelligence?
- Immediate reimaging
- Strategic monitoring or 'watch and wait' (Correct answer)
- Hard network isolation
- Forced password reset for all accounts
Correct answer: Strategic monitoring or 'watch and wait'
Strategic monitoring lets defenders observe attacker TTPs and identify additional compromised assets before taking containment action that would tip off the adversary.
Question 3: When collecting volatile evidence from a live system, what is the correct ORDER of collection according to the order of volatility?
- Disk → RAM → Network connections → CPU registers
- CPU registers → RAM → Network connections → Disk (Correct answer)
- Network connections → Disk → RAM → CPU registers
- RAM → Disk → CPU registers → Network connections
Correct answer: CPU registers → RAM → Network connections → Disk
RFC 3227 and forensic best practice dictate collecting most volatile (CPU/registers) to least volatile (disk), so that the shortest-lived data is captured first.
Question 4: An organization experiences a DDoS attack that overwhelms its upstream bandwidth. Which mitigation technique routes attack traffic through a scrubbing center before delivering clean traffic?
- BGP blackholing
- Anycast diffusion
- Traffic scrubbing / cloud DDoS mitigation (Correct answer)
- Rate limiting at the perimeter firewall
Correct answer: Traffic scrubbing / cloud DDoS mitigation
Cloud scrubbing services absorb and filter malicious DDoS traffic upstream, forwarding only legitimate packets to the origin infrastructure.
Question 5: A tabletop exercise differs from a full-scale IR drill primarily because it:
- Involves actual network failover and system recovery
- Is a discussion-based simulation with no live system actions (Correct answer)
- Tests backup restoration procedures in production
- Requires all staff to be on-site simultaneously
Correct answer: Is a discussion-based simulation with no live system actions
Tabletop exercises are verbal walkthroughs of an incident scenario that test decision-making and communication without disrupting live systems or services.
Question 6: What is the role of a 'public affairs' or 'communications' team member in an IR plan?
- Perform forensic disk imaging
- Manage external messaging to media, customers, and regulators (Correct answer)
- Monitor SIEM alerts during the incident
- Coordinate technical containment actions
Correct answer: Manage external messaging to media, customers, and regulators
The communications function controls the narrative during an incident, issuing approved statements to prevent rumor, reputational damage, and regulatory missteps.
Question 7: Which IR concept describes the practice of preemptively searching through networks and endpoints for hidden threats before alerts fire?
- Incident triage
- Threat hunting (Correct answer)
- Vulnerability scanning
- Log correlation
Correct answer: Threat hunting
Threat hunting is a proactive, human-driven process of seeking indicators of compromise that evaded automated detection, rather than waiting for SIEM alerts.
SSCP Incident Response & Recovery 4
A company must notify affected individuals within 72 hours of discovering a personal data breach.
This requirement most likely comes from: