SSCP Security Operations & Incident Response 2

Question 1

During a security incident, the FIRST action after detecting a potential breach should be to:

Accepted Answer

Contain the incident to prevent further spread

Answer

Containment is prioritized immediately after detection to limit the scope and damage of an incident before eradication or recovery.

Question 2

Which type of backup strategy copies only the data that has changed since the LAST full or incremental backup?

Accepted Answer

Incremental backup

Answer

Incremental backups copy only data changed since the last backup of any type, making them smaller but requiring more restore steps than differential.

Question 3

A security analyst notices CPU usage spikes every night at 2 AM on a server. This is MOST likely indicative of:

Accepted Answer

A scheduled task or cron job

Answer

Predictable, scheduled CPU spikes are most consistent with legitimate or malicious scheduled tasks (cron jobs, task scheduler) rather than random attacks.

Question 4

What is the PRIMARY purpose of a Security Information and Event Management (SIEM) system?

Accepted Answer

Aggregate and correlate log data to detect security events

Answer

SIEM systems collect, normalize, and correlate log data from multiple sources to identify security incidents and support compliance reporting.

Question 5

During incident response, 'lessons learned' activities should occur:

Accepted Answer

After the incident is fully resolved

Answer

Lessons learned (post-incident review) occurs after full resolution to analyze what happened, improve processes, and prevent recurrence.

(SSCP) Systems Security Certified Practitioner Exam Practice Test

(SSCP) Systems Security Certified Practitioner Exam Practice Test

SSCP Security Operations & Incident Response 2