212-89 Practice Test 12 — 15 Questions

Question 1

A first responder is documenting a compromised Linux server that is still running. The responder needs to record the system's current network state to later identify unauthorized connections and potential data exfiltration. Which two commands should the responder use to capture this volatile information? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

netstat -antp. To capture current network state on a live Linux server, the responder must use commands that display active connections, listening ports, and associated processes. Both netstat -antp and ss -tulpn provide this information; ss is the modern replacement for netstat. These outputs are volatile and must be saved to external media. The other commands address disk usage, kernel modules, or process lists, which do not fulfil the requirement to record network connections. Thus, the two network-focused commands are the correct choices.

Answer

ps aux

Answer

lsmod

Answer

df -h

Question 2

A junior responder arrives at a compromised Windows 10 workstation. Before touching the keyboard, they photograph the screen. The system is still powered on and a suspicious process is visible in Task Manager. The responder's supervisor asks them to capture the most volatile evidence first. Which action should the responder take next?

Accepted Answer

Capture the contents of RAM using a forensic memory acquisition tool.. The order of volatility dictates that the most perishable evidence must be collected first. RAM contains running processes, network connections, and encryption keys that are lost on shutdown or reboot. Capturing memory before any other action preserves this critical evidence. Antivirus scanning, shutdown, or network isolation would alter or destroy volatile data, so they are inappropriate as the immediate next step. Only memory acquisition aligns with the supervisor's instruction and standard first response practice.

Answer

Shut down the system and remove the hard drive for imaging.

Answer

Disconnect the network cable to isolate the workstation from the network.

Answer

Run a full antivirus scan to identify and remove the malicious process.

Question 3

An incident responder is examining a suspected business email compromise (BEC) message. The message passed SPF, DKIM, and DMARC alignment checks. The From display name is the CEO's name, but the actual envelope sender is a lookalike domain registered two days ago. Which characteristic of this message most directly explains why the authentication checks succeeded while the message is still malicious?

Accepted Answer

The lookalike domain published its own SPF, DKIM, and DMARC records that align with its own domain, so authentication passes for that domain even though it impersonates the CEO's display name.. Email authentication validates the domain that sent the message, not the display name shown to the user. A lookalike domain can publish its own SPF, DKIM, and DMARC records and pass all checks for itself, allowing a BEC message to appear legitimate. Incident handlers must inspect the actual envelope sender and domain age, not rely solely on authentication results.

Answer

The message used a compromised internal mailbox with a valid SPF record, so the sending IP passed SPF.

Answer

The receiving gateway disabled DMARC enforcement for executive names, which is why the checks passed.

Answer

The message was sent through a reputable bulk email service, which automatically signs all outbound mail with the recipient's domain keys.

Question 4

Which TWO actions are recommended for secure evidence storage?

Accepted Answer

Storing in a locked cabinet with access control.. Option B is correct because storing evidence in a locked cabinet with access control enforces physical security and restricts custody to authorized personnel, satisfying chain-of-custody requirements for secure evidence storage. Option E is correct because keeping a digital log of who accesses the storage creates an auditable access record that documents each individual's interaction with the evidence, which is essential for maintaining chain of custody and detecting unauthorized access. Options A, C, and D do not belong: mailing evidence without tracking breaks the chain of custody and provides no delivery confirmation, leaving evidence on a public desk exposes it to theft or tampering, and copying evidence to a public server for sharing violates confidentiality and integrity controls by allowing uncontrolled access.

Answer

Mailing evidence without tracking.

Answer

Leaving the evidence on a public desk.

Answer

Copying evidence to a public server for sharing.

Question 5

Which of the following is a symptom of an 'Email Forwarding Rule' attack?

Accepted Answer

Emails are being forwarded to an external address. Attackers set up auto-forwarding rules to intercept sensitive business communications without the user's knowledge.

Answer

The user's inbox is empty

Answer

The mailbox reached its size limit

Answer

The password was changed

Question 6

A security analyst receives an alert about a possible data exfiltration from a compromised workstation. The analyst needs to determine the scope of the incident by identifying other systems that may have communicated with the same command-and-control (C2) server. Which data source is most effective for this correlation during the identification phase?

Accepted Answer

Firewall and proxy logs aggregated in a SIEM.. Firewall and proxy logs, especially when centralized in a SIEM, provide the network visibility needed to identify all hosts communicating with a known malicious IP or domain. This correlation is essential for scoping a data exfiltration incident, as it reveals other potentially compromised systems. Antivirus, domain controller, and email logs each offer valuable but different perspectives; none provide the direct network connection data required to track C2 communications across the enterprise.

Answer

Windows Event Logs from the domain controller.

Answer

Email gateway logs for inbound messages.

Answer

Antivirus logs from the endpoint protection console.

Question 7

Which THREE indicators in a web access log suggest a directory traversal attempt?

Accepted Answer

Repeated access to sensitive files like 'passwd' or 'config.php'. Option A is correct because directory traversal attacks aim to reach files outside the web root, so repeated requests for sensitive files such as 'passwd' (e.g., /etc/passwd) or 'config.php' in the access log strongly indicate an attempt to read protected system or application files. Option B is correct because URL parameters containing system file paths (e.g., ?file=/etc/passwd or ?page=C:\Windows\win.ini) show an attacker trying to supply an absolute path to force the application to disclose a local file. Option C is correct because the '../' sequence (dot-dot-slash) is the canonical traversal payload used to climb out of the web directory, and its presence in a requested URL is a direct signature of path traversal. Option D is not correct because requests for CSS files are normal static-resource traffic and do not by themselves indicate traversal. Option E is not correct because a high number of image file requests is typical of legitimate page rendering or caching and is not a traversal indicator.

Answer

Requests for CSS files

Answer

High number of image file requests

Question 8

You are assessing the effectiveness of a containment strategy for a worm spreading through the network. What is the most effective metric to use?

Accepted Answer

The rate of new successful infections. The rate of new successful infections directly measures whether the containment strategy is actually stopping the worm from spreading to new hosts, which is the definition of containment effectiveness. A declining infection rate indicates the worm is being contained; a rising or flat rate indicates the strategy is failing. This metric is outcome-focused and tied to the adversary's propagation capability.

Answer

Total time spent by the IR team

Answer

Number of emails sent by the IR team

Answer

Total number of systems scanned

Question 9

During a web application incident, you discover that an attacker is exfiltrating data through HTTP responses by abusing a deserialization endpoint. The endpoint returns serialized objects that include base64-encoded fields. Which technique should you use to identify the exfiltrated data within captured network traffic?

Accepted Answer

Search the packet capture for HTTP 200 responses to the deserialization endpoint and decode the base64 fields in the response bodies.. When exfiltration is described as occurring through HTTP responses from a specific endpoint, the packet capture must be filtered to that endpoint and response direction. Because the payloads are base64-encoded, decoding the response bodies exposes the exfiltrated data. Other channels such as DNS, SMTP, or ICMP are unrelated to the described mechanism and would not contain the relevant evidence.

Answer

Review outbound SMTP traffic for attachments sent from the web server to external addresses.

Answer

Inspect DNS query logs for unusually long TXT records originating from the web server.

Answer

Analyze ICMP packet payloads for embedded file fragments leaving the network.

Question 10

When segmenting a network to contain an incident, what is the best practice for a 'Jump Server' in a DMZ to limit the attack surface?

Accepted Answer

Whitelisting source IPs that can access the jump server. Restricting access to the jump server to only known source IPs significantly reduces the risk of unauthorized access.

Answer

Enabling telnet for administrative flexibility

Answer

Disabling all logging to save space

Answer

Assigning the jump server a public IP address

Question 11

An organization uses Microsoft 365. Which feature should an admin use to globally remove a malicious phishing email from all user mailboxes?

Accepted Answer

Search and Purge in Microsoft 365 Defender. Search and Purge in Microsoft 365 Defender (formerly Office 365 Advanced Threat Protection) allows administrators to search for and delete malicious emails from all user mailboxes. This feature is designed specifically for incident response to remove phishing or malware emails globally, ensuring they cannot be accessed by users. It supports searching by sender, subject, or other criteria and can purge messages from all mailboxes in the organization.

Answer

Conditional Access policies

Answer

Exchange Transport Rules

Answer

Mail Flow Connector configuration

Question 12

During a forensic investigation of a compromised Linux server, you need to collect volatile data from memory. The server is running critical services and cannot be taken offline. Which method is most appropriate for capturing memory while minimizing disruption?

Accepted Answer

Install and run a kernel module such as LiME (Linux Memory Extractor) to dump memory to a remote location or external storage.. LiME is specifically designed for live memory acquisition on Linux, allowing responders to capture RAM without rebooting or significantly disrupting services. It loads as a kernel module and can write the memory image to a file or send it over the network, preserving evidence integrity. Other methods like /dev/mem or gcore are either unreliable, incomplete, or disruptive, making LiME the most appropriate choice for this scenario.

Answer

Use the dd command to copy /dev/mem to an external drive.

Answer

Use the gcore command to dump the memory of all running processes, then combine them into a single image.

Answer

Trigger a kernel panic to force a memory dump to the swap partition, then recover it later.

Question 13

You have identified a malicious DLL that is being loaded by a legitimate process. Which tool allows you to view which DLLs are loaded by a specific process?

Accepted Answer

Process Explorer. Process Explorer's lower pane (when configured for DLLs) provides a clear list of all loaded modules/DLLs for any selected process.

Answer

Task Scheduler

Answer

Disk Cleanup

Answer

Device Manager

Question 14

Which THREE of the following could be considered 'indicators of compromise' (IOCs) for an email incident?

Accepted Answer

Malicious URL within the email body. Option A is correct because a malicious URL embedded in the email body is a classic host- or network-based IOC that defenders can extract, block at the proxy/email gateway, and pivot on to find other recipients. Option C is correct because the sender IP address is a network-based IOC that can be checked against threat-intel feeds, blocklists, and SPF/DKIM authentication results to identify the originating infrastructure. Option D is correct because the MD5 or SHA-256 hash of an attachment is a file-based IOC that uniquely identifies the malicious payload and can be used for hash-blocking and endpoint/AV hunting. Option B does not belong because the name of the email service provider is a benign, generic attribute that does not by itself indicate compromise. Option E does not belong because a user's password is a credential, not an observable artifact of an attack, and its exposure would be a consequence rather than an IOC.

Answer

The name of the email service provider

Answer

The user's password

Question 15

A finance workstation running Windows 10 begins displaying a full-screen message demanding Bitcoin payment and encrypts files with the .locky extension. The user reports the machine is still powered on and connected to the corporate network. As the incident handler, which action should you take FIRST to preserve volatile evidence?

Accepted Answer

Acquire a live memory dump using a tool such as Magnet RAM Capture or WinPmem.. Because the workstation is still powered on, volatile data in RAM, including process lists, network connections, and potential encryption keys, remains available. The order of volatility dictates that this evidence be captured before any shutdown, disconnection, or remediation action. Acquiring a live memory dump first preserves the most perishable evidence and supports subsequent malware analysis and containment decisions.

Answer

Run a full antivirus scan and quarantine all detected files.

Answer

Capture a forensic image of the physical hard drive using a write blocker.

Answer

Immediately disconnect the workstation from the network and power it off.