212-89 Practice Test 11 — 15 Questions

Question 1

When investigating an incident on a virtualized platform (VMware), what is the first step to capture the state of the VM for analysis?

Accepted Answer

Take a VM snapshot with memory included.. Taking a VM snapshot captures the memory and disk state of the VM, which is the equivalent of a live acquisition.

Answer

Export the VM to OVF.

Answer

Power off the VM.

Answer

Clone the VM disk file.

Question 2

When DKIM signature verification fails, what is the most likely technical cause?

Accepted Answer

The body of the message was modified in transit. DKIM verification fails if the body content or headers were altered after signing.

Answer

The sender's IP address is on a blocklist

Answer

The user clicked a phishing link

Answer

The SPF record is missing

Question 3

What is the primary purpose of a write blocker in a forensic investigation?

Accepted Answer

To ensure no data is modified on the source media.. A write blocker prevents any data from being written to the source drive, ensuring the integrity of the evidence.

Answer

To speed up data transfer.

Answer

To encrypt the data on the drive.

Answer

To allow multiple people to read the drive.

Question 4

You are investigating a Linux server breach. You need to capture the current state of network connections without altering the evidence. Which command-line tool is preferred by first responders?

Accepted Answer

ss -tupn. 'ss' (socket statistics) or 'netstat' is used to view network connections, but 'ss' is modern and more efficient for incident response.

Answer

tcpdump -i eth0

Answer

lsof -i

Answer

iptables -L

Question 5

You are performing initial containment on a cloud-based AWS EC2 instance. The instance is under a DDoS attack. What is the most effective way to isolate this specific resource?

Accepted Answer

Modify the assigned Security Group to restrict all inbound/outbound traffic.. Modifying the Security Group to deny all ingress and egress is the fastest way to isolate the instance at the network level in AWS.

Answer

Stop the EC2 instance immediately.

Answer

Remove the VPC from the region.

Answer

Delete the EC2 instance.

Question 6

You are analyzing an incident where a user account is being used to exfiltrate data. What is the most immediate action to contain the account?

Accepted Answer

Reset the user password and invalidate active sessions.. Disabling the account is the standard containment measure to stop an active session or further logins.

Answer

Delete the user account.

Answer

Delete the user's home directory.

Answer

Lock the user's computer.

Question 7

You need to capture forensic data from a Windows machine using a remote agent. What is the risk of using built-in administrative tools like PowerShell for this?

Accepted Answer

They leave significant forensic footprints on the target system.. Native tools leave extensive traces in the event logs and process history, which might overwrite evidence or alert the attacker.

Answer

They are always blocked by the firewall.

Answer

They cannot collect binary data.

Answer

They require the system to be offline.

Question 8

When identifying stakeholders to notify during an incident, which group should be notified first?

Accepted Answer

The incident response team.. The technical incident response team must be activated immediately to manage the incident.

Answer

The local police.

Answer

The company board of directors.

Answer

The public.

Question 9

You are investigating a suspected rootkit. Which area of the operating system should you examine for unauthorized boot-time execution?

Accepted Answer

The Master Boot Record (MBR) or EFI partition.. The Master Boot Record (MBR) or the EFI partition are common targets for rootkits that persist across reboots.

Answer

The browser cache.

Answer

The user profile folder.

Answer

The temporary files directory.

Question 10

Which TWO actions are recommended for secure evidence storage?

Accepted Answer

Storing in a locked cabinet with access control.. Evidence should be kept in a controlled, access-restricted environment to maintain its integrity.

Answer

Mailing evidence without tracking.

Answer

Leaving the evidence on a public desk.

Answer

Copying evidence to a public server for sharing.

Question 11

A user reports a 'missing' file that was present earlier. What is the first thing you should check in a forensic triage?

Accepted Answer

File system logs or audit logs for file deletion events.. Checking the file system journals or event logs (Event ID 4663 for file deletion) is the first step to understand if a file was deleted.

Answer

The recycle bin.

Answer

The backup server.

Answer

The user's email.

Question 12

You are documenting an incident and need to record the time of the event. Why is accurate time synchronization critical?

Accepted Answer

To correlate events across different log sources accurately.. Correlation of logs across different systems requires synchronized clocks, typically via NTP.

Answer

To ensure the server doesn't crash.

Answer

To comply with user privacy laws.

Answer

To make the report look professional.

Question 13

Which documentation is required when transferring physical evidence from a responder to a forensic lab?

Accepted Answer

Chain of Custody form.. Chain of Custody (CoC) documents are required to ensure the legal integrity of the evidence.

Answer

User access log.

Answer

Incident summary report.

Answer

Asset inventory list.

Question 14

Which of the following is an example of a non-volatile data source?

Accepted Answer

Hard Disk Drive.. Hard drives and flash storage are non-volatile because they retain data when power is removed.

Answer

Processor Cache.

Answer

Network state table.

Answer

System RAM.

Question 15

You are performing a triage on a server and see unauthorized outbound connections to a foreign IP. What is the best way to determine which process initiated the connection?

Accepted Answer

Run 'netstat -ano' to map the connection to a PID.. 'netstat -ano' or 'lsof -i' are used, but specifically 'netstat -ano' associates the PID with the connection.

Answer

ping the IP address.

Answer

Check the ARP table.

Answer

Use 'ipconfig /all'.