SSCP Security Operations & Incident Response 3

Question 1

Which incident response phase involves removing malware, closing vulnerabilities, and eliminating attacker footholds?

Accepted Answer

Eradication

Answer

Eradication focuses on completely removing the threat, including malware, compromised accounts, and the vulnerabilities exploited during the attack.

Question 2

An attacker sends millions of packets to a target host to exhaust its resources. This is BEST described as:

Accepted Answer

A denial-of-service (DoS) attack

Answer

Flooding a target with excessive traffic to exhaust resources and deny service to legitimate users is the definition of a denial-of-service attack.

Question 3

In the context of vulnerability management, a 'zero-day' vulnerability is one that:

Accepted Answer

Has no known patch and may already be exploited in the wild

Answer

A zero-day vulnerability is unknown to the vendor with no available patch, making it especially dangerous as attackers may exploit it before defenses are developed.

Question 4

Which forensic acquisition method provides the MOST complete evidence by capturing deleted files and unallocated space?

Accepted Answer

Bit-stream (physical) image

Answer

A bit-stream image captures every bit of a storage device including deleted files, slack space, and unallocated areas, providing the most forensically complete copy.

Question 5

A company's IRP (Incident Response Plan) should be tested using tabletop exercises. What is the PRIMARY goal of these exercises?

Accepted Answer

To identify gaps in the plan without disrupting operations

Answer

Tabletop exercises walk stakeholders through simulated scenarios to identify weaknesses in the IRP without affecting production systems.

(SSCP) Systems Security Certified Practitioner Exam Practice Test

(SSCP) Systems Security Certified Practitioner Exam Practice Test

SSCP Security Operations & Incident Response 3