212-89 Practice Test 1 — 10 Questions

Question 1

You suspect a CSRF (Cross-Site Request Forgery) attack. What log entry pattern confirms this?

Accepted Answer

Referer header showing a domain different from the application's domain. CSRF attacks originate from a different site. Checking the 'Referer' header in the logs for unexpected domains is the primary method for detection.

Answer

Multiple POST requests without a corresponding GET request

Answer

High volume of 401 Unauthorized errors

Answer

A sudden change in the session cookie value

Question 2

After a major security breach, you are tasked with conducting a lessons learned meeting. Which of the following is the PRIMARY objective of this meeting?

Accepted Answer

To identify improvements to the incident response process and prevent recurrence.. The primary objective of a lessons learned meeting is to identify improvements to the incident response process and prevent recurrence. It is a constructive review that focuses on what happened, why, and how to enhance future response. Blame, cost calculation, or immediate plan updates are secondary or separate activities.

Answer

To immediately update the incident response plan with new technical controls.

Answer

To assign blame to the individuals responsible for the breach.

Answer

To determine the exact financial cost of the incident.

Question 3

A security analyst notices that an internal web server is receiving a large number of HTTP requests with unusually long and complex query strings, causing the server's CPU usage to spike. The requests appear to be targeting a search function. Which type of network incident is most likely occurring?

Accepted Answer

HTTP flood. The scenario describes a high volume of HTTP requests with complex query strings targeting a search function, leading to CPU exhaustion. This matches an HTTP flood, a layer 7 denial-of-service attack that exploits resource-intensive operations. Other attacks like XSS, SQL injection, or directory traversal do not primarily cause CPU spikes through such requests.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Question 4

You suspect a DNS tunneling attack for data exfiltration. In your DNS server logs, which characteristic is the strongest indicator of a tunnel rather than standard recursive lookups?

Accepted Answer

Unusually long, high-entropy subdomains. DNS tunneling encodes data in the subdomain portion of DNS queries, and because DNS labels are limited to 63 characters, attackers pack them with long, random-looking (high-entropy) strings to maximize data throughput. Standard recursive lookups use short, human-readable domain names, so unusually long, high-entropy subdomains are the strongest indicator of a tunnel. Tools like iodine and dnscat2 produce exactly this pattern.

Answer

High volume of A records

Answer

Requests for PTR records

Answer

Queries to root hints

Question 5

An incident handler is documenting the timeline of a security breach. The handler discovers that system clocks on different servers are not synchronized. Which action should the handler take to ensure the timeline is accurate and defensible?

Accepted Answer

Normalize all timestamps to a common time zone and document the clock offsets.. When system clocks are unsynchronized, the handler must account for offsets and normalize timestamps to a common reference, such as UTC, while documenting each system's deviation. This preserves the integrity of the original evidence and enables accurate correlation. Excluding data, trusting one clock, or reconfiguring systems during the investigation are all inappropriate and can compromise the timeline's defensibility.

Answer

Reconfigure all servers to use a network time protocol server and restart them.

Answer

Exclude timestamps from servers with unsynchronized clocks to avoid confusion.

Answer

Use the timestamps from the server with the most reliable clock as the single source of truth.

Question 6

You are using YARA to detect a specific strain of ransomware. You want to match a file if it contains a specific hex string OR a specific string value. How do you construct this in your rule?

Accepted Answer

condition: $a or $b. YARA uses the 'or' operator within the condition section to evaluate multiple criteria, allowing a match if either condition is met.

Answer

condition: $a + $b

Answer

condition: $a != $b

Answer

condition: $a && $b

Question 7

You are analyzing an incident where a user account is being used to exfiltrate data. What is the most immediate action to contain the account?

Accepted Answer

Reset the user password and invalidate active sessions.. Resetting the password and invalidating active sessions immediately cuts off the attacker's access while preserving the account and its data for forensic investigation. This contains the incident without destroying evidence, and it revokes any stolen session tokens or cookies the attacker may be using. It is the standard first containment step for a compromised account.

Answer

Delete the user account.

Answer

Delete the user's home directory.

Answer

Lock the user's computer.

Question 8

Which role in the Incident Response Team is primarily responsible for ensuring that the incident handling activities remain aligned with organizational legal and privacy requirements?

Accepted Answer

Legal Counsel. The legal counsel or representative ensures that all actions taken during an incident are compliant with applicable laws.

Answer

Technical Investigator

Answer

Incident Lead

Answer

Communications Officer

Question 9

You are handling a malware incident on a Windows server and need to determine whether the malware has established persistence. Which two registry locations should you inspect first because they are the most common autostart points used by malware? (Choose two.)

Accepted Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. The HKLM and HKCU Run keys are the most commonly abused registry autostart locations because they execute code at logon for all users or the current user respectively, require minimal effort to modify, and are widely used by commodity and targeted malware alike. Inspecting both ensures coverage of system-wide and per-user persistence.

Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

Answer

HKEY_CLASSES_ROOT\Installer\Products

Question 10

Which THREE components are typically involved in a web application's logging infrastructure that an incident responder should audit?

Accepted Answer

Web server access and error logs. Option A (Web server access and error logs) is correct because these logs record every HTTP request, response code, source IP, and server-side errors, which are essential for reconstructing how an attacker interacted with the web application. Option B (WAF audit logs) is correct because a Web Application Firewall logs blocked, allowed, and flagged requests, revealing attempted exploits such as SQL injection or XSS that may not appear in normal server logs. Option D (Application-level audit logs) is correct because they capture business-logic events like authentication, authorization changes, and user actions, providing the internal context that infrastructure logs lack. Option C (Printer spooler logs) is not relevant since print services are unrelated to web application request handling or attack surfaces. Option E (Hardware router logs) is not part of the web application's logging infrastructure, as routers operate at the network layer and do not record application-level activity.

Answer

Printer spooler logs

Answer

Hardware router logs