SSCP Security Operations & Incident Response 5

Question 1

Which of the following is the CORRECT order of the NIST incident response lifecycle phases?

Accepted Answer

Preparation → Detection & Analysis → Containment/Eradication/Recovery → Post-Incident Activity

Answer

The NIST SP 800-61 incident response lifecycle follows Preparation, Detection & Analysis, Containment/Eradication/Recovery, and Post-Incident Activity.

Question 2

A write blocker is used during forensic disk acquisition to:

Accepted Answer

Prevent any data from being written to the evidence drive, preserving its integrity

Answer

A write blocker prevents the forensic workstation from accidentally writing data to the original evidence disk, maintaining its integrity.

Question 3

Which approach to patch management involves testing patches in a non-production environment before deploying them to live systems?

Accepted Answer

Staged rollout with testing

Answer

Staged rollout with testing validates patches in a test environment first to prevent untested patches from breaking production systems.

Question 4

During incident triage, an analyst must determine the SCOPE of compromise. Which tool is MOST useful for identifying all affected hosts?

Accepted Answer

Network flow analysis and SIEM correlation

Answer

Network flow data combined with SIEM correlation allows analysts to trace lateral movement and identify all hosts the attacker touched.

Question 5

What is 'smurfing' in the context of network attacks?

Accepted Answer

Amplifying a DoS attack by sending ICMP requests to a broadcast address spoofed with the victim's IP

Answer

A smurf attack floods a victim by sending spoofed ICMP echo requests to network broadcast addresses, causing all hosts to reply to the victim.

(SSCP) Systems Security Certified Practitioner Exam Practice Test

(SSCP) Systems Security Certified Practitioner Exam Practice Test

SSCP Security Operations & Incident Response 5