212-89 Practice Test 10 — 10 Questions

Question 1

An analyst receives a report of a phishing email. Which email header field is most reliable for verifying the path taken by the email through intermediate mail transfer agents?

Accepted Answer

Received. The 'Received' header field is added by each mail transfer agent (MTA) as the message passes through it, creating a chronological list of hops. It is the most reliable field for tracing the path an email took, including originating IP and intermediate servers. Analysts read Received headers from bottom to top to follow the actual delivery chain.

Answer

X-Originating-IP

Answer

Return-Path

Answer

X-Mailer

Question 2

You have identified a potential Advanced Persistent Threat (APT) in your network. Which evidence preservation strategy is required to maintain the validity of the logs found in a SIEM?

Accepted Answer

Applying a cryptographic hash to the exported logs. Generating cryptographic hashes for log files ensures they can be verified as untampered during later analysis.

Answer

Moving the logs to a backup server

Answer

Printing the logs to a secure PDF

Answer

Taking a screenshot of the SIEM dashboard

Question 3

You suspect a file on a Linux server is malicious. What command can you use to obtain the MD5 hash of the file?

Accepted Answer

md5sum [filename]. The md5sum utility is the standard Linux command-line tool for computing and verifying MD5 message digests. Running 'md5sum [filename]' outputs the 128-bit MD5 hash followed by the filename, which is exactly what an incident responder needs to fingerprint a suspected malicious file. It is part of GNU coreutils and is present on virtually every Linux distribution by default.

Answer

checkhash [filename]

Answer

hash -md5 [filename]

Answer

echo md5 [filename]

Question 4

A malware incident has been contained and eradicated on an infected Windows server. Before returning the server to production, you need to verify that no malicious processes or unauthorized autostart entries remain. Which action best supports this validation?

Accepted Answer

Compare current autoruns, services, scheduled tasks, and running processes against a known-good baseline.. Validation after eradication requires confirming that no malicious persistence or processes remain. Comparing autoruns, services, scheduled tasks, and running processes against a known-good baseline exposes unauthorized changes that signature-based scans might overlook. This approach directly verifies the eradication was complete and supports a defensible decision to return the server to production.

Answer

Restore the server from a backup taken before the incident.

Answer

Reboot the server and confirm it boots successfully.

Answer

Run a full antivirus scan and review the scan report.

Question 5

You are managing chain of custody for a physical server seized during an investigation. What is the most critical action to ensure the evidence remains admissible in court?

Accepted Answer

Logging every individual who accessed, transported, or stored the device. Maintaining a verifiable, gapless log of every person who touched the evidence is the core requirement of chain of custody.

Answer

Taking photographs of the server location

Answer

Using an anti-static bag for transport

Answer

Hashing the drive contents immediately

Question 6

An analyst is drafting an email to a user who reported a phishing attempt. What is the most important tone to maintain?

Accepted Answer

Professional, calm, and informative. When responding to a user who reported a phishing attempt, the analyst's primary goal is to encourage future reporting and avoid discouraging the user. A professional, calm, and informative tone reassures the user that their action was correct, provides clear guidance without blame, and maintains trust in the security team. This approach aligns with incident response best practices, which emphasize positive reinforcement to foster a security-aware culture. Accusatory, alarmist, or overly technical tones can backfire by making users defensive or confused, reducing the likelihood they will report future incidents.

Answer

Accusatory, to discourage clicking

Answer

Technical and jargon-heavy

Answer

Alarmist, to ensure they remain scared

Question 7

You are auditing Apache logs to detect potential OS command injection. Which characters should you search for in the access logs?

Accepted Answer

';', '|', '&', and '`'. OS command injection payloads use shell metacharacters to chain or execute additional commands: semicolon (;), pipe (|), ampersand (&), and backtick (`) are the classic separators and command substitution operators. Searching access logs for these characters reveals attempts to append commands like '; cat /etc/passwd' or '| whoami'.

Answer

'%20', '+', and '='

Answer

'{', '}', and '$'

Answer

'<', '>', and '/'

Question 8

You are performing initial containment on a cloud-based AWS EC2 instance. The instance is under a DDoS attack. What is the most effective way to isolate this specific resource?

Accepted Answer

Modify the assigned Security Group to restrict all inbound/outbound traffic.. Modifying the assigned Security Group to restrict all inbound and outbound traffic is the most effective way to isolate the EC2 instance because it immediately cuts off all network communication while preserving the instance's state for forensic analysis. This action is reversible and does not destroy evidence. Stopping the instance may still allow some network activity during shutdown and can lose volatile memory. Deleting the instance destroys evidence. Removing the VPC is overly broad and affects other resources.

Answer

Stop the EC2 instance immediately.

Answer

Remove the VPC from the region.

Answer

Delete the EC2 instance.

Question 9

An attacker is bypassing WAF signatures by using Unicode encoding. Which WAF feature must be enabled to normalize the traffic before inspection?

Accepted Answer

UTF-8/Unicode normalization. Unicode encoding allows attackers to represent characters in multiple ways (e.g., using full-width characters or overlong UTF-8 sequences) to bypass signature-based WAF rules that look for literal ASCII patterns. Enabling UTF-8/Unicode normalization forces the WAF to convert all input into a canonical form before matching signatures, so obfuscated payloads are decoded and inspected correctly. Without normalization, the WAF sees encoded gibberish and misses the attack.

Answer

Content-Type header inspection

Answer

SSL/TLS offloading

Answer

Request body buffering

Question 10

Which THREE of the following are effective network forensics techniques for identifying an attacker's C2 server infrastructure?

Accepted Answer

Reverse DNS (PTR) lookup of destination IPs. Reverse DNS (PTR) lookup of destination IPs (C) is effective because resolving suspicious destination addresses to hostnames can reveal attacker-controlled domains, VPS providers, or naming patterns tied to C2 infrastructure. WHOIS registration data analysis (D) is effective because it exposes registrant details, registrar, creation dates, and name servers that can link multiple malicious domains or IP ranges to the same threat actor or campaign. Threat intelligence reputation checks (E) are effective because querying destination IPs/domains against feeds, sandboxes, and IOC databases can flag known C2 servers, malware families, or adversary infrastructure. Enabling SNMP on all edge hosts (A) is not a forensics technique for identifying C2; it expands the attack surface and exposes device management data. Disabling ICMP echo responses (B) is a hardening/stealth measure, not an investigative method, and it does not reveal C2 endpoints.

Answer

Enabling SNMP on all edge hosts

Answer

Disabling ICMP echo responses