SSCP Incident Response & Recovery 4

Question 1

A company must notify affected individuals within 72 hours of discovering a personal data breach. This requirement most likely comes from:

Accepted Answer

GDPR Article 33

Answer

GDPR Article 33 mandates that controllers notify the supervisory authority within 72 hours of becoming aware of a personal data breach.

Question 2

Which technique allows an IR team to monitor attacker activity on a compromised host without alerting the attacker, gathering additional intelligence?

Accepted Answer

Strategic monitoring or 'watch and wait'

Answer

Strategic monitoring lets defenders observe attacker TTPs and identify additional compromised assets before taking containment action that would tip off the adversary.

Question 3

When collecting volatile evidence from a live system, what is the correct ORDER of collection according to the order of volatility?

Accepted Answer

CPU registers → RAM → Network connections → Disk

Answer

RFC 3227 and forensic best practice dictate collecting most volatile (CPU/registers) to least volatile (disk), so that the shortest-lived data is captured first.

Question 4

An organization experiences a DDoS attack that overwhelms its upstream bandwidth. Which mitigation technique routes attack traffic through a scrubbing center before delivering clean traffic?

Accepted Answer

Traffic scrubbing / cloud DDoS mitigation

Answer

Cloud scrubbing services absorb and filter malicious DDoS traffic upstream, forwarding only legitimate packets to the origin infrastructure.

Question 5

A tabletop exercise differs from a full-scale IR drill primarily because it:

Accepted Answer

Is a discussion-based simulation with no live system actions

Answer

Tabletop exercises are verbal walkthroughs of an incident scenario that test decision-making and communication without disrupting live systems or services.

(SSCP) Security Operations and Administration Practice Test

(SSCP) Security Operations and Administration Practice Test

SSCP Incident Response & Recovery 4