SSCP Security Operations & Incident Response 2 — Questions and Answers
Question 1: During a security incident, the FIRST action after detecting a potential breach should be to:
- Eradicate the threat immediately
- Notify law enforcement
- Contain the incident to prevent further spread (Correct answer)
- Restore affected systems from backup
Correct answer: Contain the incident to prevent further spread
Containment is prioritized immediately after detection to limit the scope and damage of an incident before eradication or recovery.
Question 2: Which type of backup strategy copies only the data that has changed since the LAST full or incremental backup?
- Differential backup
- Incremental backup (Correct answer)
- Mirror backup
- Snapshot backup
Correct answer: Incremental backup
Incremental backups copy only data changed since the last backup of any type, making them smaller but requiring more restore steps than differential.
Question 3: A security analyst notices CPU usage spikes every night at 2 AM on a server. This is MOST likely indicative of:
- Hardware failure
- A scheduled task or cron job (Correct answer)
- A denial-of-service attack
- Memory corruption
Correct answer: A scheduled task or cron job
Predictable, scheduled CPU spikes are most consistent with legitimate or malicious scheduled tasks (cron jobs, task scheduler) rather than random attacks.
Question 4: What is the PRIMARY purpose of a Security Information and Event Management (SIEM) system?
- Encrypt sensitive data at rest
- Aggregate and correlate log data to detect security events (Correct answer)
- Perform vulnerability scanning on network hosts
- Block malicious traffic at the network perimeter
Correct answer: Aggregate and correlate log data to detect security events
SIEM systems collect, normalize, and correlate log data from multiple sources to identify security incidents and support compliance reporting.
Question 5: During incident response, 'lessons learned' activities should occur:
- Before containment to plan the response
- During active eradication of the threat
- After the incident is fully resolved (Correct answer)
- Only when the incident caused financial loss
Correct answer: After the incident is fully resolved
Lessons learned (post-incident review) occurs after full resolution to analyze what happened, improve processes, and prevent recurrence.
Question 6: Which of the following is an example of a TRUE POSITIVE in an IDS alert?
- The IDS flags normal traffic as an attack
- The IDS correctly identifies an attack in progress (Correct answer)
- The IDS misses an actual attack
- The IDS generates no alert for clean traffic
Correct answer: The IDS correctly identifies an attack in progress
A true positive occurs when the IDS correctly identifies and alerts on actual malicious activity.
Question 7: What does 'chain of custody' refer to in digital forensics?
- The encryption chain used to protect evidence
- The documented and unbroken record of evidence handling from collection to court (Correct answer)
- The sequence of commands executed during an attack
- The network path taken by an attacker
Correct answer: The documented and unbroken record of evidence handling from collection to court
Chain of custody documents who collected, handled, and transferred evidence to ensure its integrity and admissibility in legal proceedings.
SSCP Security Operations & Incident Response 2
During a security incident, the FIRST action after detecting a potential breach should be to: