SSCP Security Operations & Incident Response 4

Question 1

Which type of malware disguises itself as legitimate software but performs malicious actions in the background?

Accepted Answer

Trojan horse

Answer

A Trojan horse appears to be a legitimate application but contains hidden malicious functionality executed without the user's knowledge.

Question 2

When performing memory forensics on a live system, which data would be LOST if the system is powered off?

Accepted Answer

Running processes and network connections in RAM

Answer

Volatile data in RAM — including running processes, network connections, and encryption keys — is lost when a system loses power.

Question 3

A security team uses 'honeypots' primarily to:

Accepted Answer

Detect and study attacker techniques by luring them to decoy systems

Answer

Honeypots are decoy systems designed to attract attackers, detect intrusion attempts, and gather intelligence on attacker tactics and tools.

Question 4

Which incident classification level would typically trigger executive notification and external legal counsel?

Accepted Answer

High severity — breach of customer PII affecting thousands

Answer

High-severity incidents involving large-scale PII breaches require executive escalation, legal counsel, and potentially regulatory notification.

Question 5

What is the primary function of a Security Operations Center (SOC)?

Accepted Answer

Continuously monitor and respond to security events across the organization

Answer

A SOC provides 24/7 monitoring, detection, analysis, and response to cybersecurity threats using people, processes, and technology.

(SSCP) Systems Security Certified Practitioner Exam Practice Test