SSCP Security Operations & Incident Response 5 — Questions and Answers
Question 1: Which of the following is the CORRECT order of the NIST incident response lifecycle phases?
- Preparation → Detection & Analysis → Containment/Eradication/Recovery → Post-Incident Activity (Correct answer)
- Detection → Preparation → Recovery → Containment
- Containment → Preparation → Detection → Eradication
- Identification → Containment → Notification → Closure
Correct answer: Preparation → Detection & Analysis → Containment/Eradication/Recovery → Post-Incident Activity
The NIST SP 800-61 incident response lifecycle follows Preparation, Detection & Analysis, Containment/Eradication/Recovery, and Post-Incident Activity.
Question 2: A write blocker is used during forensic disk acquisition to:
- Speed up the copying process
- Prevent any data from being written to the evidence drive, preserving its integrity (Correct answer)
- Encrypt the forensic image for secure transport
- Verify the hash value of the original drive
Correct answer: Prevent any data from being written to the evidence drive, preserving its integrity
A write blocker prevents the forensic workstation from accidentally writing data to the original evidence disk, maintaining its integrity.
Question 3: Which approach to patch management involves testing patches in a non-production environment before deploying them to live systems?
- Emergency patching
- Staged rollout with testing (Correct answer)
- Automatic deployment without review
- Patch deferral policy
Correct answer: Staged rollout with testing
Staged rollout with testing validates patches in a test environment first to prevent untested patches from breaking production systems.
Question 4: During incident triage, an analyst must determine the SCOPE of compromise. Which tool is MOST useful for identifying all affected hosts?
- Password cracker
- Network flow analysis and SIEM correlation (Correct answer)
- Steganography tool
- Certificate authority
Correct answer: Network flow analysis and SIEM correlation
Network flow data combined with SIEM correlation allows analysts to trace lateral movement and identify all hosts the attacker touched.
Question 5: What is 'smurfing' in the context of network attacks?
- Exploiting buffer overflows in web applications
- Amplifying a DoS attack by sending ICMP requests to a broadcast address spoofed with the victim's IP (Correct answer)
- Intercepting unencrypted login credentials
- Using social engineering to obtain passwords
Correct answer: Amplifying a DoS attack by sending ICMP requests to a broadcast address spoofed with the victim's IP
A smurf attack floods a victim by sending spoofed ICMP echo requests to network broadcast addresses, causing all hosts to reply to the victim.
Question 6: Which of the following actions is an example of 'evidence tampering' during an investigation?
- Hashing the forensic image before analysis
- Documenting the chain of custody for seized hardware
- Running programs on a compromised system before imaging it (Correct answer)
- Taking photographs of the physical scene
Correct answer: Running programs on a compromised system before imaging it
Running programs on a compromised system before imaging it alters volatile and disk data, potentially destroying or contaminating evidence.
Question 7: What distinguishes a 'worm' from a traditional 'virus' in terms of propagation?
- A worm requires user interaction to spread; a virus does not
- A worm self-replicates and spreads across networks without human interaction; a virus requires a host file (Correct answer)
- A worm only targets mobile devices; a virus targets desktops
- A worm encrypts files; a virus deletes them
Correct answer: A worm self-replicates and spreads across networks without human interaction; a virus requires a host file
Worms propagate autonomously across networks by exploiting vulnerabilities, while viruses require a host file and typically depend on user actions to spread.
SSCP Security Operations & Incident Response 5
Which of the following is the CORRECT order of the NIST incident response lifecycle phases?