SSCP Incident Response & Recovery 5

Question 1

Which term describes the documented record showing who had custody of digital evidence and when, used to prove evidence was not tampered with?

Accepted Answer

Chain of custody

Answer

Chain of custody is a chronological record of every person who handled evidence, ensuring integrity and legal admissibility in court or regulatory proceedings.

Question 2

An insider threat incident is suspected. Which initial action best balances investigation needs against tipping off the subject?

Accepted Answer

Covertly preserve logs and monitor activity while notifying HR and legal

Answer

Covert log preservation and monitoring builds the evidentiary record without alerting the suspect, while HR and legal oversight protects the organization legally.

Question 3

A Recovery Time Objective (RTO) of four hours means the organization must:

Accepted Answer

Restore systems and resume operations within four hours of a disruption

Answer

RTO defines the maximum acceptable downtime; a four-hour RTO means business functions must be restored within four hours of an incident or disaster.

Question 4

Which eradication step specifically addresses removing attacker-installed scheduled tasks, cron jobs, or startup scripts?

Accepted Answer

Removing persistence mechanisms

Answer

Attackers establish persistence through scheduled tasks, registry run keys, or cron jobs; explicitly hunting and removing these ensures the threat doesn't survive a reboot.

Question 5

During recovery, an organization restores a database from backup but discovers the backup itself was encrypted by ransomware. This scenario highlights the importance of:

Accepted Answer

Air-gapping or immutable backup storage inaccessible to ransomware

Answer

Ransomware often targets connected backup systems; air-gapped or immutable (WORM) storage ensures backups remain clean and recoverable.

(SSCP) Security Operations and Administration Practice Test

(SSCP) Security Operations and Administration Practice Test

SSCP Incident Response & Recovery 5