4.1 - Understand and Support Incident Response Lifecycle (e.g., National Institute of Standards and Technology (NIST), International Organization for Standardization (ISO)) SSCP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is an indicator of compromise (IOC)?

   • AA security policy document
   • BA type of firewall rule used to block malicious traffic
   • CA piece of evidence that suggests a security breach may have occurred
   • DA vulnerability scanner report
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company is comparing the NIST and ISO incident response lifecycles to decide which to adopt. The CISO notes that the NIST lifecycle includes a dedicated phase for 'Post-Incident Activity' that emphasizes lessons learned. Which phase in the ISO lifecycle is most similar in purpose?

   • AContainment, Eradication, and Recovery
   • BPreparation
   • CLessons Learned
   • DDetection and Analysis
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which activity is part of post-incident activities?

   • AIsolating affected systems
   • BImplementing new countermeasures based on lessons learned
   • CRestoring data from backups
   • DRemoving malware from systems
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which action is an example of a containment strategy?

   • ADisconnecting an infected system from the network
   • BRestoring data from backups
   • CUpdating the incident response plan
   • DConducting a forensic analysis
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   After containing a ransomware outbreak, the incident response team has identified that the initial infection vector was a phishing email with a malicious attachment. The team has cleaned the infected endpoints. What is the NEXT step in the NIST lifecycle to ensure the threat is fully eliminated?

   • ARestore all systems from backups and verify data integrity.
   • BConduct a lessons learned meeting with the incident response team.
   • CIdentify and remove the phishing email from all mailboxes and block the sender.
   • DIncrease the frequency of antivirus scans on all endpoints.
   Reveal Solution Discussion Select an answer first