SSCP Security Operations & Incident Response 3 — Questions and Answers
Question 1: Which incident response phase involves removing malware, closing vulnerabilities, and eliminating attacker footholds?
- Identification
- Containment
- Eradication (Correct answer)
- Recovery
Correct answer: Eradication
Eradication focuses on completely removing the threat, including malware, compromised accounts, and the vulnerabilities exploited during the attack.
Question 2: An attacker sends millions of packets to a target host to exhaust its resources. This is BEST described as:
- A man-in-the-middle attack
- A denial-of-service (DoS) attack (Correct answer)
- A SQL injection attack
- A session hijacking attack
Correct answer: A denial-of-service (DoS) attack
Flooding a target with excessive traffic to exhaust resources and deny service to legitimate users is the definition of a denial-of-service attack.
Question 3: In the context of vulnerability management, a 'zero-day' vulnerability is one that:
- Has been patched within 24 hours of discovery
- Has no known patch and may already be exploited in the wild (Correct answer)
- Is rated critical by CVSS
- Only affects systems with no antivirus installed
Correct answer: Has no known patch and may already be exploited in the wild
A zero-day vulnerability is unknown to the vendor with no available patch, making it especially dangerous as attackers may exploit it before defenses are developed.
Question 4: Which forensic acquisition method provides the MOST complete evidence by capturing deleted files and unallocated space?
- Logical acquisition
- Sparse acquisition
- Bit-stream (physical) image (Correct answer)
- File-level copy
Correct answer: Bit-stream (physical) image
A bit-stream image captures every bit of a storage device including deleted files, slack space, and unallocated areas, providing the most forensically complete copy.
Question 5: A company's IRP (Incident Response Plan) should be tested using tabletop exercises. What is the PRIMARY goal of these exercises?
- To deploy actual incident response tools in production
- To identify gaps in the plan without disrupting operations (Correct answer)
- To train new security staff on technical skills
- To satisfy regulatory audit requirements
Correct answer: To identify gaps in the plan without disrupting operations
Tabletop exercises walk stakeholders through simulated scenarios to identify weaknesses in the IRP without affecting production systems.
Question 6: What is the role of a 'first responder' in a cybersecurity incident?
- Prosecute the attacker in court
- Be the first to arrive and preserve evidence while containing the incident (Correct answer)
- Immediately restore systems to production state
- Notify all employees about the breach
Correct answer: Be the first to arrive and preserve evidence while containing the incident
The first responder secures and preserves the scene, documents initial findings, and takes containment actions while avoiding evidence contamination.
Question 7: Which metric in the CVSS scoring system reflects the complexity of the conditions required for an attacker to exploit a vulnerability?
- Attack Vector
- Attack Complexity (Correct answer)
- Privileges Required
- Scope
Correct answer: Attack Complexity
Attack Complexity (AC) in CVSS measures how difficult it is for the attacker to exploit the vulnerability, considering conditions beyond the attacker's control.
SSCP Security Operations & Incident Response 3
Which incident response phase involves removing malware, closing vulnerabilities, and eliminating attacker footholds?