212-89 Practice Test — Free Certified Incident Handler (212-89) Questions with Explanations

After a major security breach, you are tasked with conducting a lessons learned meeting. Which of the following is the PRIMARY objective of this meeting?

A security analyst notices that an internal web server is receiving a large number of HTTP requests with unusually long and complex query strings, causing the server's CPU usage to spike. The requests appear to be targeting a search function. Which type of network incident is most likely occurring?

You are using YARA to detect a specific strain of ransomware. You want to match a file if it contains a specific hex string OR a specific string value. How do you construct this in your rule?

You suspect a CSRF (Cross-Site Request Forgery) attack. What log entry pattern confirms this?

An employee receives a suspicious email asking to verify account details by clicking a link. What is the most effective user behavior to mitigate this?

You are analyzing an incident where a user account is being used to exfiltrate data. What is the most immediate action to contain the account?

You suspect a DNS tunneling attack for data exfiltration. In your DNS server logs, which characteristic is the strongest indicator of a tunnel rather than standard recursive lookups?

An incident handler is documenting the timeline of a security breach. The handler discovers that system clocks on different servers are not synchronized. Which action should the handler take to ensure the timeline is accurate and defensible?

Which role in the Incident Response Team is primarily responsible for ensuring that the incident handling activities remain aligned with organizational legal and privacy requirements?

You are the first responder to a Linux server that is suspected of being compromised. You need to collect volatile data in the order of volatility. Which command should you run first to capture the most volatile data?

During an incident response engagement, a first responder is collecting volatile data from a compromised Windows server. The responder needs to capture the current network connections, including the process ID associated with each connection, without installing any third-party tools. Which native Windows command should the responder use?

You are dealing with a legal hold request for data related to an investigation. How should you handle the data retention policy for this specific case?

An incident handler is reviewing a suspicious executable found on a compromised Windows system. The file has a double extension, such as 'invoice.pdf.exe'. Which type of malware delivery technique is this most likely an example of?

You are investigating a compromised Linux host. Using 'tcpdump' to capture traffic on interface eth0 to analyze C2 communication on port 443, which command is most efficient for saving the output to a file for later analysis in Wireshark?

Which tool would you use to perform a live analysis of HTTP traffic and inspect for malicious payloads in real-time?

During an investigation into lateral movement, you notice an unusual RDP connection from a workstation to a domain controller. Which Wireshark filter would be most effective in isolating only the RDP traffic associated with that specific source IP to identify potential credential dumping activity?

A web application is vulnerable to session fixation. What is the primary indicator of this attack in the logs?

A web application is returning verbose error messages that include full stack traces and database query fragments to users. An attacker is using these messages to map the application's internal structure. Which remediation step should the incident handler recommend to the development team?

You suspect an incident involves an insider threat. Which step should be taken FIRST to preserve the integrity of the potential evidence while minimizing system downtime?

During a web application incident, an analyst discovers that an attacker is using SQL injection to extract data from a backend database. Which SQL injection technique involves the attacker inferring data by asking the database true/false questions and observing the application's response?