212-89 Practice Test 10 — 10 Questions

Question 1

When performing manual phishing triage, which action should an analyst perform first after identifying a suspicious URL in an email body?

Accepted Answer

Run the URL against an automated sandbox analysis tool. Before interaction, you must detonate in a sandbox to ensure safety.

Answer

Click the URL to inspect the landing page

Answer

Block the sender domain immediately

Answer

Forward the email to the user for confirmation

Question 2

Which TWO of the following steps are required when performing a post-mortem analysis of an email incident?

Accepted Answer

Evaluating the performance of security controls. Reviewing incident logs and evaluating the effectiveness of security controls are critical post-mortem steps.

Answer

Promoting the security analyst involved

Answer

Contacting the local law enforcement authorities

Answer

Deleting all evidence to maintain privacy

Question 3

Which THREE of the following could be considered 'indicators of compromise' (IOCs) for an email incident?

Accepted Answer

Malicious URL within the email body. Sender IP addresses, malicious URLs, and file hashes are standard IOCs.

Answer

The name of the email service provider

Answer

The user's password

Question 4

You are responding to a web-based attack. Which log source is most critical for identifying the origin of a SQL injection attempt?

Accepted Answer

Web server access logs.. Web server access logs contain the request methods and query strings used to deliver the attack payload.

Answer

DHCP logs.

Answer

Windows System Event log.

Answer

Application crash dumps.

Question 5

Which protocol is used in conjunction with SPF and DKIM to provide instructions to the receiver on how to handle emails that fail authentication?

Accepted Answer

DMARC. DMARC provides the policy instructions for SPF and DKIM failures.

Answer

SMTPS

Answer

IMAP

Answer

POP3

Question 6

You are reviewing a suspicious macro in a Word document attachment. Which tool is best suited for static analysis of the macro code?

Accepted Answer

Oledump. Oledump is the industry standard tool for identifying and extracting macros from Office documents.

Answer

Nmap

Answer

Wireshark

Answer

Volatility

Question 7

You are analyzing an email with a suspicious attachment. You notice the file name is 'invoice.pdf.exe'. What does this indicate?

Accepted Answer

The file is a double-extension obfuscation attempt. The double extension is a common technique to trick users into executing a binary file.

Answer

The file is a legitimate script file

Answer

The file is encrypted with a password

Answer

The file is a genuine PDF that requires an executable

Question 8

You are analyzing an email and the URL redirects through multiple shortened link services. What is the recommended way to find the final landing page?

Accepted Answer

Use a URL lookup or unshortening service. Using a 'URL unshortening' service or tool allows the analyst to see the final destination without clicking the link.

Answer

Click the link to see where it goes

Answer

Block all shortened links

Answer

Run a packet capture on the gateway

Question 9

As a first responder, you arrive at a compromised workstation showing signs of active malware beaconing. Which action should be performed first according to the Order of Volatility?

Accepted Answer

Perform a physical memory dump using FTK Imager.. Memory (RAM) is the most volatile component and must be captured before it is overwritten or lost during a shutdown.

Answer

Create a bit-stream image of the hard drive.

Answer

Power down the machine to stop the malware.

Answer

Disconnect the network cable from the workstation.

Question 10

An analyst receives a report of a phishing email. Which email header field is most reliable for verifying the path taken by the email through intermediate mail transfer agents?

Accepted Answer

Received. The Received header is added by every MTA that handles the message, providing a verifiable path.

Answer

X-Originating-IP

Answer

Return-Path

Answer

X-Mailer