SSCP Security Operations & Incident Response 4 — Questions and Answers
Question 1: Which type of malware disguises itself as legitimate software but performs malicious actions in the background?
- Worm
- Rootkit
- Trojan horse (Correct answer)
- Ransomware
Correct answer: Trojan horse
A Trojan horse appears to be a legitimate application but contains hidden malicious functionality executed without the user's knowledge.
Question 2: When performing memory forensics on a live system, which data would be LOST if the system is powered off?
- Hard disk contents
- Registry hives stored on disk
- Running processes and network connections in RAM (Correct answer)
- Installed application logs
Correct answer: Running processes and network connections in RAM
Volatile data in RAM — including running processes, network connections, and encryption keys — is lost when a system loses power.
Question 3: A security team uses 'honeypots' primarily to:
- Speed up network performance
- Detect and study attacker techniques by luring them to decoy systems (Correct answer)
- Back up critical business data
- Encrypt communications between endpoints
Correct answer: Detect and study attacker techniques by luring them to decoy systems
Honeypots are decoy systems designed to attract attackers, detect intrusion attempts, and gather intelligence on attacker tactics and tools.
Question 4: Which incident classification level would typically trigger executive notification and external legal counsel?
- Low severity — minor policy violation
- Medium severity — single workstation compromise
- High severity — breach of customer PII affecting thousands (Correct answer)
- Informational — routine security scan findings
Correct answer: High severity — breach of customer PII affecting thousands
High-severity incidents involving large-scale PII breaches require executive escalation, legal counsel, and potentially regulatory notification.
Question 5: What is the primary function of a Security Operations Center (SOC)?
- Develop new security software products
- Continuously monitor and respond to security events across the organization (Correct answer)
- Conduct annual penetration testing
- Manage employee access provisioning
Correct answer: Continuously monitor and respond to security events across the organization
A SOC provides 24/7 monitoring, detection, analysis, and response to cybersecurity threats using people, processes, and technology.
Question 6: An organization discovers ransomware has encrypted critical files. As part of recovery, which action should occur BEFORE restoring from backup?
- Pay the ransom to speed up recovery
- Restore systems and then run antivirus
- Eradicate the ransomware and close the attack vector it used (Correct answer)
- Notify the media about the incident
Correct answer: Eradicate the ransomware and close the attack vector it used
Restoring backups without first eradicating the ransomware and patching the entry point risks immediate re-infection.
Question 7: Which of the following BEST describes 'indicators of compromise' (IoCs)?
- Security policies that define acceptable use
- Artifacts or evidence that suggest a system has been compromised (Correct answer)
- Penetration testing reports summarizing vulnerabilities
- Metrics used to measure SOC performance
Correct answer: Artifacts or evidence that suggest a system has been compromised
IoCs are forensic artifacts such as malicious IPs, file hashes, registry keys, or domains that indicate a security incident has occurred.
SSCP Security Operations & Incident Response 4
Which type of malware disguises itself as legitimate software but performs malicious actions in the background?