A security operations center (SOC) analyst notices multiple failed login attempts followed by a successful login from an unusual geographic location for a user account. The account then began downloading large amounts of data. Which phase of the NIST lifecycle is the analyst currently in?

Containment, Eradication, and Recovery

What is the primary purpose of a lessons learned review after an incident?

To assign blame for the incident

To restore systems to normal operation

To identify what went well and what could be improved in incident response

A security analyst has confirmed a malware infection on a critical server. The incident response team needs to inform the appropriate stakeholders. According to the NIST incident response lifecycle, which communication should occur FIRST?

Issue a press release to the public.

Notify all employees via email.

Notify the incident response team lead and the system owner.

Notify the organization's customers immediately.

After containing a malware outbreak, the incident response team has identified that the malware was introduced through a vulnerable third-party application. The team has removed the malware from all affected systems. What is the NEXT step to ensure the threat is fully eliminated?

Patch or update the vulnerable third-party application.

Conduct a lessons learned meeting.

Restore all systems from backups.

Increase the frequency of antivirus scans.

Which activity is part of the Detection and Analysis phase in incident response?

Monitoring network traffic for anomalies

Conducting a lessons learned review

Implementing new firewall rules

Systems Security Certified Practitioner

Domain 4Objective 1

4.1 - Understand and Support Incident Response Lifecycle (e.g., National Institute of Standards and Technology (NIST), International Organization for Standardization (ISO)) SSCP Practice Questions (Page 3)

Part of the Incident Response and Recovery domain, which accounts for 14% of the SSCP exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 2–4 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

8concepts

14%of the exam

Questions 11–15

11application · medium
A security operations center (SOC) analyst notices multiple failed login attempts followed by a successful login from an unusual geographic location for a user account. The account then began downloading large amounts of data. Which phase of the NIST lifecycle is the analyst currently in?
Select an answer first
12foundation · easy
What is the primary purpose of a lessons learned review after an incident?
Select an answer first
13application · medium
A security analyst has confirmed a malware infection on a critical server. The incident response team needs to inform the appropriate stakeholders. According to the NIST incident response lifecycle, which communication should occur FIRST?
Select an answer first
14application · medium
After containing a malware outbreak, the incident response team has identified that the malware was introduced through a vulnerable third-party application. The team has removed the malware from all affected systems. What is the NEXT step to ensure the threat is fully eliminated?
Select an answer first
15foundation · easy
Which activity is part of the Detection and Analysis phase in incident response?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SSCP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “SSCP” is a trademark of its owner, used for identification only.