SSCP Practice Questions: Incident Response and Recovery Domain

Correct Answer: B

Explanation: Reimaging the affected endpoints and applying the latest security patches (Option B) is the most effective method to ensure complete removal of the malware and protect against future infections, as it restores the system to a known good state. Running an antivirus scan (Option A) may not remove all traces of malware. Isolating endpoints (Option C) is a containment step but does not remove the malware. Performing a root cause analysis (Option D) is important for future prevention but does not address immediate removal.

Correct Answer: C

Explanation: The most appropriate immediate action is to investigate the source IP address and correlate with other logs to look for indicators of compromise. Blocking the IP (A) might be necessary later, but could be premature without understanding the full context. Initiating a password reset (B) or shutting down the server (D) are reactive measures that could disrupt operations and should only be considered after further investigation.

Correct Answer: B

Explanation: The best immediate action is to modify the rule to restrict traffic to only necessary ports and IP addresses, ensuring that only legitimate traffic is allowed. Removing the rule entirely (A) might disrupt legitimate services. Monitoring (C) without action does not mitigate the risk, and disabling (D) might cause unnecessary service disruption.

Correct Answer: C

Explanation: Checking the SIEM logs for correlating alerts or anomalies can provide insights into the cause of the traffic spike and whether it is part of a larger incident. This step helps in understanding the context before taking more disruptive actions like disconnecting the server. Deep packet inspection and firewall review are important but should follow initial log analysis.

Correct Answer: A

Explanation: Unusual outbound traffic patterns to an external IP address (Option A) are a strong indicator of data exfiltration, as they suggest data is being sent outside the network. Increased CPU usage (Option B) could indicate malware but not specifically data exfiltration. Multiple failed login attempts (Option C) suggest attempted unauthorized access but not data exfiltration. Unexpected reboots and error messages (Option D) might indicate system instability or compromise but not specifically data exfiltration.

Correct Answer: B

Explanation: The best approach is to review the firewall rules and close only the ports that are not required for business operations. This ensures that necessary services remain operational while reducing the attack surface. Closing all ports without analysis could disrupt services. Reinstalling the OS is excessive and enabling HIDS does not address the immediate issue of unauthorized ports.

Correct Answer: A

Explanation: Capturing and analyzing the outbound traffic will provide insights into what data is being sent and to where, which is crucial for understanding the nature of the anomaly. Isolating the server is a containment step that should follow understanding the issue. Checking processes is useful but secondary to understanding the traffic. Notifying the SOC is important but should be informed by initial analysis.

Correct Answer: C

Explanation: The initial step should be to review the firewall logs and network traffic to gather more information about the spike, such as the source and destination of the traffic. This will help in understanding whether the spike is malicious or benign. Shutting down the server immediately could disrupt legitimate services and should be considered only after confirming malicious activity. Conducting a full forensic analysis is time-consuming and should come after confirming the incident. Informing management is important but should be done after initial verification of the incident.

Correct Answer: B

Explanation: The immediate action in a ransomware attack is to isolate affected systems from the network (B) to prevent the ransomware from spreading to other systems. Paying the ransom (A) is not recommended as it does not guarantee file recovery and encourages further attacks. Contacting law enforcement (C) is important but not the immediate step. Restoring from backups (D) should be done after containment and ensuring the threat has been neutralized.

Correct Answer: B

Explanation: Updating the incident response plan based on lessons learned is crucial for improving future response efforts. Disciplining employees does not contribute to process improvement. Restoring systems is part of recovery, not review. Security awareness training is beneficial but not directly related to improving the incident response plan.