SSCP Incident Response & Recovery 5 — Questions and Answers
Question 1: Which term describes the documented record showing who had custody of digital evidence and when, used to prove evidence was not tampered with?
- Evidence log
- Chain of custody (Correct answer)
- Audit trail
- System journal
Correct answer: Chain of custody
Chain of custody is a chronological record of every person who handled evidence, ensuring integrity and legal admissibility in court or regulatory proceedings.
Question 2: An insider threat incident is suspected. Which initial action best balances investigation needs against tipping off the subject?
- Immediately confront the employee
- Covertly preserve logs and monitor activity while notifying HR and legal (Correct answer)
- Disable the employee's accounts without notice
- Announce a company-wide security review
Correct answer: Covertly preserve logs and monitor activity while notifying HR and legal
Covert log preservation and monitoring builds the evidentiary record without alerting the suspect, while HR and legal oversight protects the organization legally.
Question 3: A Recovery Time Objective (RTO) of four hours means the organization must:
- Back up data every four hours
- Restore systems and resume operations within four hours of a disruption (Correct answer)
- Retain logs for four hours before deletion
- Complete forensic analysis within four hours
Correct answer: Restore systems and resume operations within four hours of a disruption
RTO defines the maximum acceptable downtime; a four-hour RTO means business functions must be restored within four hours of an incident or disaster.
Question 4: Which eradication step specifically addresses removing attacker-installed scheduled tasks, cron jobs, or startup scripts?
- Patching the exploited vulnerability
- Removing persistence mechanisms (Correct answer)
- Rebuilding the OS from scratch
- Rotating all service account credentials
Correct answer: Removing persistence mechanisms
Attackers establish persistence through scheduled tasks, registry run keys, or cron jobs; explicitly hunting and removing these ensures the threat doesn't survive a reboot.
Question 5: During recovery, an organization restores a database from backup but discovers the backup itself was encrypted by ransomware. This scenario highlights the importance of:
- Storing backups on the same network segment as production
- Air-gapping or immutable backup storage inaccessible to ransomware (Correct answer)
- Compressing backups to reduce storage costs
- Running more frequent vulnerability scans
Correct answer: Air-gapping or immutable backup storage inaccessible to ransomware
Ransomware often targets connected backup systems; air-gapped or immutable (WORM) storage ensures backups remain clean and recoverable.
Question 6: A CSIRT receives a tip from law enforcement about a threat actor targeting their sector. This is an example of which IR input?
- Internal audit finding
- Threat intelligence sharing (Correct answer)
- Vulnerability disclosure
- Penetration test result
Correct answer: Threat intelligence sharing
Threat intelligence sharing from external partners like law enforcement, ISACs, or CERTs provides early warning that helps organizations prepare before an attack occurs.
Question 7: What distinguishes a 'major incident' from a 'standard incident' in most IR classification schemes?
- Major incidents always involve external attackers
- Major incidents have significant business impact requiring executive involvement (Correct answer)
- Major incidents only affect endpoint devices
- Major incidents are always caused by malware
Correct answer: Major incidents have significant business impact requiring executive involvement
Major incidents are defined by severity—significant operational, financial, or reputational impact—that triggers escalation to senior leadership and potentially crisis management protocols.
SSCP Incident Response & Recovery 5
Which term describes the documented record showing who had custody of digital evidence and when, used to prove evidence was not tampered with?