212-89 Exam Simulation 1 — 100 Questions

Question 1

Which TWO of the following are safe practices when analyzing a suspicious email?

Accepted Answer

Ensuring the analysis environment is isolated from the network. Using virtual machines and disconnecting from the corporate network are safe practices.

Answer

Disabling all antivirus tools to observe behavior

Answer

Opening attachments in your primary email client

Answer

Clicking every link to check for live sites

Question 2

What is the primary risk associated with 'Executive Spoofing' or BEC (Business Email Compromise)?

Accepted Answer

Financial loss via unauthorized transfers. BEC targets employees to perform unauthorized financial transfers through social engineering.

Answer

System performance degradation

Answer

Infrastructure downtime

Answer

Spam distribution

Question 3

While analyzing an email header, you observe an SPF 'softfail'. What does this imply?

Accepted Answer

The sending IP is not listed in the domain's SPF record. A softfail (~all) indicates the server is not explicitly authorized but the domain owner is not strictly enforcing rejection.

Answer

The message was spoofed and must be blocked

Answer

The email has been encrypted with TLS

Answer

The email passed DKIM verification

Question 4

Which THREE of the following email security technologies should be configured to prevent domain spoofing?

Accepted Answer

DKIM. SPF, DKIM, and DMARC are the three pillars of email authentication to prevent spoofing.

Answer

SSL/TLS

Answer

HTTP/2

Question 5

Which THREE of the following are appropriate communication channels to keep users informed during an email phishing incident?

Accepted Answer

Corporate security intranet portal. Company-wide announcements, helpdesk tickets, and security awareness portals are appropriate channels.

Answer

Individual user personal phone numbers

Answer

Public social media accounts

Question 6

An email header contains 'X-Forefront-Antispam-Report'. What can an analyst determine from this?

Accepted Answer

The email was scanned by Microsoft's filtering engine. This header provides information on how Microsoft's filtering engine analyzed the message, including spam confidence levels.

Answer

The email is definitely malicious

Answer

The sender is a known spammer

Answer

The email is encrypted

Question 7

Which TWO of the following describe the role of an email gateway in incident response?

Accepted Answer

Filtering and blocking malicious content. Email gateways act as a filter for incoming threats and provide logs for post-incident investigation.

Answer

Replacing all passwords automatically

Answer

Manually deleting user account files

Answer

Encrypting all outgoing traffic

Question 8

Which TWO types of evidence are considered 'volatile'?

Accepted Answer

System memory (RAM).. RAM and network connections are lost when power is removed or the system is reset.

Answer

Optical disc contents.

Answer

Hard drive data.

Answer

Printed log files.

Question 9

Which TWO of the following are valid methods to identify a malicious attachment?

Accepted Answer

Performing behavioral analysis in a sandbox. Analyzing file hashes against threat intelligence and performing behavioral analysis in a sandbox are valid methods.

Answer

Forwarding the email to the entire company

Answer

Opening the attachment on a personal device

Answer

Deleting the attachment based on its size

Question 10

Which THREE of the following items should be included in an email incident report?

Accepted Answer

Chronological timeline of the incident. A description of the incident, the impact, and the remediation steps are required for a report.

Answer

Personal contact information of the attacker

Answer

Full history of every email ever sent to the user

Question 11

Which of the following is a symptom of an 'Email Forwarding Rule' attack?

Accepted Answer

Emails are being forwarded to an external address. Attackers set up auto-forwarding rules to intercept sensitive business communications without the user's knowledge.

Answer

The user's inbox is empty

Answer

The mailbox reached its size limit

Answer

The password was changed

Question 12

During an incident, a responder needs to capture the ARP cache to identify potential local spoofing. Which tool provides this information?

Accepted Answer

arp -a. The 'arp -a' command shows the current Address Resolution Protocol cache on a Windows or Linux system.

Answer

ipconfig /displaydns

Answer

route print

Answer

netstat -s

Question 13

An employee receives a suspicious email asking to verify account details by clicking a link. What is the most effective user behavior to mitigate this?

Accepted Answer

Use the organization's 'Report Phishing' tool. Reporting the suspicious email through the provided 'Report Phishing' button is the most effective user action.

Answer

Reply to the sender to verify

Answer

Ignore and delete the email without reporting

Answer

Forward it to a friend for a second opinion

Question 14

What is the 'First Responder Toolkit' used for during an incident?

Accepted Answer

To collect forensic artifacts without modifying the target system.. A first responder toolkit provides pre-configured, trusted tools for incident triage and data collection.

Answer

To install new security software.

Answer

To permanently delete malicious files.

Answer

To provide remote access for the attacker.

Question 15

Which THREE categories of stakeholders should be considered for notification in a major data breach?

Accepted Answer

Legal and Compliance departments.. Legal, IT Management, and the Privacy Officer are critical stakeholders during a breach.

Answer

The local coffee shop staff.

Answer

The company's external social media followers.

Question 16

Which TWO criteria must a first responder satisfy when choosing a tool for a toolkit?

Accepted Answer

The tool must be known to have minimal impact on the target system.. Tools must be trusted and cause minimal impact on the subject system.

Answer

The tool must run on a cloud-based server.

Answer

The tool must be proprietary and expensive.

Answer

The tool must be able to delete the malware.

Question 17

In the context of the NIST Incident Response Life Cycle, which phase immediately follows the 'Detection and Analysis' phase, specifically focusing on limiting the scope of the compromise?

Accepted Answer

Containment. Containment is the phase where the responder takes action to stop the spread or further damage of the incident.

Answer

Recovery

Answer

Lessons Learned

Answer

Eradication

Question 18

You are managing chain of custody for a physical server seized during an investigation. What is the most critical action to ensure the evidence remains admissible in court?

Accepted Answer

Logging every individual who accessed, transported, or stored the device. Maintaining a verifiable, gapless log of every person who touched the evidence is the core requirement of chain of custody.

Answer

Taking photographs of the server location

Answer

Using an anti-static bag for transport

Answer

Hashing the drive contents immediately

Question 19

When classifying the severity of an incident, which factor should carry the most weight in your decision-making process?

Accepted Answer

The potential impact on business availability and data integrity. The impact on business operations is the most significant factor in determining the urgency and scope of the response.

Answer

The number of security tools that flagged the alert

Answer

The time of day the incident occurred

Answer

The technical complexity of the exploit

Question 20

A first responder is using a 'Live Response' toolkit. What is the main characteristic of these tools?

Accepted Answer

They are designed to run from a USB drive to minimize impact on the target disk.. Live response tools are designed to collect data from a running system with minimal impact on the target environment.

Answer

They provide permanent remote access to the attacker.

Answer

They require the computer to be turned off.

Answer

They automatically delete evidence after collection.