EC-Council · Free Practice Questions · Last reviewed May 2026
36 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
Which role in the Incident Response Team is primarily responsible for ensuring that the incident handling activities remain aligned with organizational legal and privacy requirements?
Legal Counsel
Legal Counsel interprets applicable statutes, privacy regulations, and contractual obligations, then advises the team on evidence handling, notification duties, and disclosure limits. This keeps containment and investigation actions within legal boundaries, satisfying the requirement that incident handling align with organisational legal and privacy requirements.
Technical Investigator
Incident Lead
Communications Officer
You are managing chain of custody for a physical server seized during an investigation. What is the most critical action to ensure the evidence remains admissible in court?
Taking photographs of the server location
Logging every individual who accessed, transported, or stored the device
An unbroken, documented access log proves the evidence was continuously controlled and untampered from seizure onward. This documented chain satisfies the admissibility requirement by letting the court verify integrity, defeating challenges that the device was altered or substituted.
Using an anti-static bag for transport
Hashing the drive contents immediately
You are performing a post-incident review. Which action is the most important to ensure that the 'Lessons Learned' process effectively improves future response capabilities?
Documenting the root cause and defining specific, actionable process changes
Documenting the root cause converts the incident into evidence, and defining specific, actionable process changes turns that evidence into revised procedures, runbooks and controls. Without concrete changes, the review produces observations only, so future response capability does not actually improve.
Updating the password policy
Archiving all forensic images for ten years
Assigning blame to the employee who made the error
You are setting up a secure communication channel for the IR team during a major incident. Why is it recommended to use an out-of-band communication method?
To comply with the Acceptable Use Policy
To simplify documentation for the final report
To increase bandwidth for file transfers
To prevent the attacker from monitoring team communications
Out-of-band channels use separate infrastructure from the compromised production network, so an attacker with persistent access cannot intercept or monitor incident-response coordination. This satisfies the stem's requirement to keep team communications confidential during a major incident.
You are establishing an Incident Response Plan (IRP). Which document should prioritize the technical steps for restoring services after a ransomware attack?
Playbook
A playbook provides specific, repeatable steps for handling a defined incident type.
Business Continuity Plan
Communication Plan
Security Policy
You suspect an incident involves an insider threat. Which step should be taken FIRST to preserve the integrity of the potential evidence while minimizing system downtime?
Change the root password to lock out the attacker
Delete the suspicious user account
Reboot the compromised system to clear malicious memory
Capture a bit-stream image of the storage media
A bit-stream image captures an exact, write-blocked replica of the storage media, preserving the original evidence intact for forensic examination and admissibility. Analysing the copy rather than the source minimises downtime on the suspect's live system while maintaining evidential integrity.
Want more Incident Handling Process practice?
Practice this domainYou suspect a DNS tunneling attack for data exfiltration. In your DNS server logs, which characteristic is the strongest indicator of a tunnel rather than standard recursive lookups?
High volume of A records
Requests for PTR records
Unusually long, high-entropy subdomains
DNS tunnelling encodes exfiltrated data into query names, producing subdomains far longer than legitimate hostnames and with high entropy from base64 or hex encoding. This pattern distinguishes tunnelling from normal recursive lookups, which resolve short, dictionary-like names.
Queries to root hints
You are performing log correlation in a SIEM. You want to match Windows Event ID 4624 (Logon) with network traffic. Which field is the primary 'join key' to correlate the event with a specific network flow?
Source IP Address
Event ID 4624 records the originating workstation's IP address in its network information fields. That address is the shared identifier matching the corresponding network flow records in the SIEM, letting the analyst join authentication events to specific traffic.
Target Username
Process Name
Event Correlation ID
During an investigation into lateral movement, you notice an unusual RDP connection from a workstation to a domain controller. Which Wireshark filter would be most effective in isolating only the RDP traffic associated with that specific source IP to identify potential credential dumping activity?
tcp.flags.syn == 1 && ip.src == 192.168.1.50
data.data == 3389
rdp.data && ip.dst == 192.168.1.50
tcp.port == 3389 && ip.src == 192.168.1.50
Combining tcp.port == 3389 with ip.src == 192.168.1.50 restricts capture to RDP sessions originating from the suspect workstation, filtering out unrelated port 3389 traffic. This isolates the lateral-movement flow toward the domain controller for credential-dumping analysis.
You are investigating a compromised Linux host. Using 'tcpdump' to capture traffic on interface eth0 to analyze C2 communication on port 443, which command is most efficient for saving the output to a file for later analysis in Wireshark?
tcpdump -c eth0 port 443
tcpdump -i eth0 port 443 > capture.txt
tcpdump -r capture.pcap port 443
tcpdump -i eth0 port 443 -w capture.pcap
The -w flag correctly writes the captured traffic to a file.
When segmenting a network to contain an incident, what is the best practice for a 'Jump Server' in a DMZ to limit the attack surface?
Whitelisting source IPs that can access the jump server
Whitelisting permitted source IP addresses on the jump server ensures only authorised administrative hosts can initiate connections, sharply reducing exposed services in the DMZ. This directly limits the attack surface, satisfying the stem's segmentation best-practise requirement for containing an incident.
Enabling telnet for administrative flexibility
Disabling all logging to save space
Assigning the jump server a public IP address
A security analyst is investigating lateral movement using PowerShell Remoting (WinRM). Which Windows Event Log should be prioritized to confirm the execution of remote commands?
Application Log
Security Log
System Log
Microsoft-Windows-PowerShell/Operational
PowerShell Remoting executes commands through the PowerShell engine, which writes script block and command invocation events to the Microsoft-Windows-PowerShell/Operational log. Event ID 4104 records the actual script content executed remotely, confirming command execution that WinRM transport logs alone cannot show.
Want more Network Incidents practice?
Practice this domainYou are using Wireshark to analyze traffic from an infected host. You notice consistent beaconing activity to an external IP on port 443. How do you isolate this traffic in your capture?
ip.addr == [IP_ADDRESS]
Filtering on ip.addr matches packets where the beaconing IP appears as either source or destination, isolating the command-and-control conversation from unrelated traffic. This display filter satisfies the need to narrow the capture to the infected host's external communications on port 443, letting you inspect beacon timing and payloads.
tcp.port == 80
frame.len > 1000
http.request
You are analyzing a malware sample using Cuckoo Sandbox. The report shows the malware is attempting to modify the 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run' registry key. What is the intent of this activity?
Injecting code into explorer.exe
Escalating user privileges
Establishing system persistence
Writing to the Run key causes Windows to execute the listed program automatically at every user logon, so the malware survives reboots without any user action. This satisfies the persistence objective by embedding an autostart entry in the registry.
Disabling the Windows Firewall
A malware infection has encrypted several network shares. You decide to restore from backups. What is the most critical step to perform before restoring data to the production environment?
Scan the backup media with the same AV used previously
Reboot the domain controllers
Restore data to a sandbox or isolated VLAN
Restoring to a sandbox or isolated VLAN lets you verify backup integrity and confirm malware is absent before production reconnection. This prevents reintroducing the infection or overwriting clean data, directly satisfying the stem's requirement for the most critical pre-restoration step.
Change all user passwords
You are using YARA to detect a specific strain of ransomware. You want to match a file if it contains a specific hex string OR a specific string value. How do you construct this in your rule?
condition: $a + $b
condition: $a != $b
condition: $a && $b
condition: $a or $b
The condition section with the OR operator evaluates both string identifiers, matching the file when either $a or $b is found. This satisfies the requirement to detect files containing the hex string or the string value.
During an incident, you need to isolate a compromised workstation from the network immediately. Which action is the most effective containment strategy while preserving volatile memory?
Shut down the computer immediately
Disconnect the network cable
Physically unplugging the cable severs all network communication instantly, satisfying immediate isolation, while the workstation stays powered so volatile memory and running processes remain intact for later forensic capture. Wireless or software-based blocking risks missing alternate paths or triggering shutdown.
Delete the suspicious files
Run a full antivirus scan
An analyst is reviewing logs from an EDR solution. They see a 'process hollowing' event. What is the primary purpose of this malware technique?
Brute-forcing system credentials
Hiding malicious code inside a legitimate process
Process hollowing unmounts a legitimate executable's memory and injects malicious code into that reserved space, so the payload executes under a trusted process identity. This satisfies the scenario's requirement to conceal activity from the EDR solution, since monitoring sees a signed, benign parent rather than an unknown binary.
Encrypting local user files
Creating a hidden user account
Want more Malware Incidents practice?
Practice this domainYou are auditing Apache logs to detect potential OS command injection. Which characters should you search for in the access logs?
'%20', '+', and '='
'{', '}', and '$'
'<', '>', and '/'
';', '|', '&', and '`'
Shell metacharacters ';', '|', '&' and '`' allow command chaining, piping and substitution, so their appearance in Apache access logs signals attempted OS command injection. Searching for these satisfies the audit requirement to detect injection attempts against web-facing services.
During a Cross-Site Scripting (XSS) incident, you notice the WAF is blocking legitimate user sessions. What is the most effective tuning step to prevent false positives while maintaining protection?
Disable the entire XSS protection rule set
Implement a negative security model
Create a granular exclusion for the specific parameter triggering the alert
A granular exclusion targets only the specific parameter producing false positives, so legitimate sessions pass while the WAF continues inspecting all other traffic. This preserves protection rather than disabling the rule wholesale, satisfying the stem's dual requirement.
Switch the WAF from Blocking mode to Transparent mode
An analyst is investigating a suspected SQL injection attack on an IIS server. Which log file should they prioritize to identify the specific URL-encoded payload strings submitted by the attacker?
Application Event logs
HTTPERR logs
Security Event logs
W3C Extended Log File Format logs
W3C Extended logs record the full query string of each HTTP request, including URL-encoded characters, so injected payloads such as %27 or %20 appear verbatim. IIS access logs therefore expose the attacker's submitted strings, unlike error or event logs.
A web server log shows repeated '403 Forbidden' errors for a specific directory. What is the most likely cause during an incident?
The user session has expired
The requested file does not exist
The server is offline
Directory traversal or unauthorized access attempts are being blocked
A 403 means the server understood the request but refused authorisation, so the directory exists yet access is denied. Repeated hits indicate traversal or unauthorised access attempts being blocked, rather than a missing file or server fault.
A web application is vulnerable to session fixation. What is the primary indicator of this attack in the logs?
High volume of requests to the login page without POST data
The same session ID is associated with two different IP addresses within a short timeframe
A sudden spike in failed login attempts
A user session ID remains identical before and after a successful authentication event
Session fixation succeeds when the attacker plants a known session identifier and the victim's authentication does not regenerate it. An unchanged session ID across the login boundary therefore evidences the flaw; legitimate implementations issue a fresh identifier upon successful authentication.
An attacker is bypassing WAF signatures by using Unicode encoding. Which WAF feature must be enabled to normalize the traffic before inspection?
Content-Type header inspection
SSL/TLS offloading
UTF-8/Unicode normalization
Unicode encoding lets attackers disguise malicious payloads so signature matching fails. Enabling UTF-8/Unicode normalization converts encoded characters into their canonical form before the WAF inspects traffic, restoring signature detection and satisfying the stem's requirement to normalise requests prior to inspection.
Request body buffering
Want more Web Application Incidents practice?
Practice this domainWhen DKIM signature verification fails, what is the most likely technical cause?
The sender's IP address is on a blocklist
The body of the message was modified in transit
DKIM signs selected headers and the body, so any alteration to the message body after signing invalidates the hash comparison. This directly satisfies the stem's constraint that verification failed due to content modification in transit.
The user clicked a phishing link
The SPF record is missing
An organization uses Microsoft 365. Which feature should an admin use to globally remove a malicious phishing email from all user mailboxes?
Conditional Access policies
Exchange Transport Rules
Search and Purge in Microsoft 365 Defender
Search and Purge locates messages by sender, subject or URL across all mailboxes, then deletes them tenant-wide, including copies already delivered. This satisfies the global removal requirement that per-mailbox deletion or transport rules cannot achieve after delivery.
Mail Flow Connector configuration
You are analyzing an email with a suspicious attachment. You notice the file name is 'invoice.pdf.exe'. What does this indicate?
The file is a double-extension obfuscation attempt
The double extension exploits Windows' default behaviour of hiding known file extensions, so 'invoice.pdf.exe' displays as 'invoice.pdf' in Explorer. The executable extension remains .exe, meaning the attachment runs code rather than opening as a document — satisfying the stem's suspicious-attachment indicator.
The file is a legitimate script file
The file is encrypted with a password
The file is a genuine PDF that requires an executable
Which protocol is used in conjunction with SPF and DKIM to provide instructions to the receiver on how to handle emails that fail authentication?
SMTPS
IMAP
DMARC
DMARC builds on SPF and DKIM alignment, letting the domain owner publish a policy telling receivers whether to quarantine, reject or monitor messages failing authentication. SPF and DKIM alone verify origin but carry no handling instructions.
POP3
While analyzing an email header, you observe an SPF 'softfail'. What does this imply?
The sending IP is not listed in the domain's SPF record
This is the definition of a softfail.
The message was spoofed and must be blocked
The email has been encrypted with TLS
The email passed DKIM verification
An analyst receives a report of a phishing email. Which email header field is most reliable for verifying the path taken by the email through intermediate mail transfer agents?
X-Originating-IP
Return-Path
X-Mailer
Received
Received headers are prepended by each mail transfer agent as the message traverses the path, so their sequence records the actual hops taken; unlike From or Return-Path, they are added by servers rather than supplied by the sender.
Want more Email Incidents practice?
Practice this domainYou are investigating a Linux server breach. You need to capture the current state of network connections without altering the evidence. Which command-line tool is preferred by first responders?
tcpdump -i eth0
lsof -i
ss -tupn
The `ss -tupn` command reads live socket tables directly from the kernel, listing TCP and UDP connections with numeric ports and owning processes. Unlike `netstat`, it does not write to disk or modify connection state, satisfying the requirement to capture current network connections without altering evidence.
iptables -L
You are performing initial containment on a cloud-based AWS EC2 instance. The instance is under a DDoS attack. What is the most effective way to isolate this specific resource?
Stop the EC2 instance immediately.
Remove the VPC from the region.
Delete the EC2 instance.
Modify the assigned Security Group to restrict all inbound/outbound traffic.
Security Groups act as stateful virtual firewalls at the instance's elastic network interface, so restricting all inbound and outbound rules immediately severs the EC2 instance's traffic without terminating it — satisfying the containment requirement while preserving forensic state.
You are performing an investigation on a compromised mobile device. What is the primary risk of connecting the device to a standard workstation without a write blocker?
The battery will drain faster.
The workstation might write metadata or sync files, altering the original evidence.
Connecting the device lets the workstation mount it as a writable volume, so the operating system or sync services can update timestamps, journal entries and file metadata. That violates the forensic requirement to preserve the original evidence unaltered, which a hardware write blocker prevents by enforcing read-only access at the block level.
The workstation will be instantly infected.
The device will automatically wipe itself.
A stakeholder asks you to prioritize the recovery of a compromised system. According to incident response best practices, what is your first responsibility?
Notify legal counsel.
Update firewall rules.
Rebuild the system from backup.
Identify and confirm the security incident.
Before containment, eradication or recovery, the responder must verify that an incident actually occurred, distinguishing genuine compromise from false positives. Confirming the incident satisfies the stem's requirement to prioritise recovery only after validation, per incident response best practice.
Which documentation is required when transferring physical evidence from a responder to a forensic lab?
User access log.
Incident summary report.
Chain of Custody form.
A Chain of Custody form records each transfer, handler, date and purpose, preserving evidence integrity and admissibility. It satisfies the scenario's requirement to document the handover from responder to forensic lab, ensuring an unbroken, auditable trail that courts accept.
Asset inventory list.
When investigating an incident on a virtualized platform (VMware), what is the first step to capture the state of the VM for analysis?
Take a VM snapshot with memory included.
A snapshot with memory captures the VM's volatile state, including running processes and RAM contents, alongside disk. This preserves forensic evidence that a disk-only snapshot or live login would alter, satisfying the requirement to capture the VM's state before any analysis begins.
Export the VM to OVF.
Power off the VM.
Clone the VM disk file.
Want more First Response practice?
Practice this domainThe 212-89 exam has 100 questions and must be completed in 180 minutes. Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 6 domains: Incident Handling Process, Network Incidents, Malware Incidents, Web Application Incidents, Email Incidents, First Response. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official EC-Council 212-89 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.