212-89 Practice Test 13 — 15 Questions

Question 1

Which TWO of the following are essential components of an effective Incident Communication Plan?

Accepted Answer

A list of internal and external stakeholder contact details. Option A is correct because an effective Incident Communication Plan must identify who needs to be notified during an incident, so maintaining up-to-date contact details for internal and external stakeholders (employees, customers, regulators, law enforcement, media) is essential for timely and accurate dissemination of information. Option D is correct because defined escalation criteria specify the thresholds, severity levels, and triggers that determine when and how executive management must be notified, ensuring leadership is engaged appropriately without unnecessary delays or over-notification. Options B, C, and E are not components of an Incident Communication Plan: a forensic report template (B) belongs to incident investigation and documentation procedures, firewall rules for blocking malicious IPs (C) are part of technical containment and network security controls, and password reset scripts (E) are remediation/IT operational tools rather than communication planning elements.

Answer

A standard template for forensic report generation

Answer

A list of firewall rules for blocking malicious IPs

Answer

Scripts for resetting user passwords

Question 2

You suspect a malware incident caused unauthorized data exfiltration. Which log source is most useful to identify the destination IP of the exfiltrated data?

Accepted Answer

Firewall logs. Firewall logs provide a record of all outbound connections and are the most reliable source for identifying destination IP addresses in an exfiltration event.

Answer

Application logs

Answer

Local security policy settings

Answer

System event logs

Question 3

You are handling a confirmed incident in which an attacker uploaded a web shell named 'image_thumb.php' to a public-facing Apache server running PHP. The file is being invoked repeatedly via HTTP POST requests. Which action should you take FIRST to contain the threat while preserving forensic evidence?

Accepted Answer

Capture volatile data and a forensic copy of the web shell, then block its execution and network access to it while keeping the original in place.. Containment must balance stopping the attacker with preserving evidence. Capturing volatile data and a forensic copy of the web shell, then blocking its execution and external access, achieves both. Deleting the file, rebuilding the server, or relying solely on a WAF signature all sacrifice forensic value or leave the intrusion path open, undermining the subsequent eradication and recovery phases.

Answer

Immediately rebuild the server from a known-good image and restore the most recent backup.

Answer

Configure the WAF to block requests containing the string 'image_thumb.php' and continue monitoring.

Answer

Delete the web shell and restart the Apache service to break any active attacker sessions.

Question 4

Which THREE of the following email security technologies should be configured to prevent domain spoofing?

Accepted Answer

DKIM. DKIM (A) is correct because it adds a cryptographic digital signature to outgoing messages, allowing the receiving server to verify that the message was actually sent by the claimed domain and was not altered in transit, which directly counters domain spoofing. SPF (B) is correct because it publishes a DNS TXT record listing the authorized sending hosts/IP addresses for a domain, so receivers can reject or flag mail sent from unauthorized servers impersonating that domain. DMARC (E) is correct because it builds on SPF and DKIM alignment, specifies a policy (none, quarantine, or reject) for messages failing authentication, and provides reporting, giving domain owners enforcement against spoofing. SSL/TLS (C) only encrypts data in transit between client and server and does not authenticate the sending domain of an email message, so it does not prevent spoofing. HTTP/2 (D) is a web transport protocol for HTTP traffic and is unrelated to email sender authentication or domain spoofing prevention.

Answer

SSL/TLS

Answer

HTTP/2

Question 5

A malware sample was found to use a 'Mutex' to ensure only one instance of the malware runs at a time. What tool would you use to find the Mutex name on an infected host?

Accepted Answer

Handle. Handle (Sysinternals Handle) is the correct tool because it enumerates open handles — including named mutexes — held by processes on a Windows system. Running 'handle.exe -a' lists all handle types, and you can search for the mutex name associated with the malware, confirming infection and enabling detection signatures. Mutexes are kernel objects, and Handle is purpose-built to display them per process.

Answer

TCPView

Answer

Procmon

Answer

Autoruns

Question 6

You are documenting an incident and need to record the time of the event. Why is accurate time synchronization critical?

Accepted Answer

To correlate events across different log sources accurately.. Accurate time synchronization is critical because incident responders must reconstruct the sequence of events from logs generated by many different devices (firewalls, servers, IDS, endpoints). If each device's clock drifts, timestamps cannot be reliably aligned, making it impossible to prove causality or build a defensible timeline. Standards such as RFC 5905 (NTP) and ISO 27037 emphasize synchronized, verifiable timestamps for evidence integrity.

Answer

To ensure the server doesn't crash.

Answer

To comply with user privacy laws.

Answer

To make the report look professional.

Question 7

After eradicating a malware infection, you need to ensure the system is hardened against future occurrences. Which action is most effective against fileless malware?

Accepted Answer

Implement PowerShell Constrained Language Mode. Disabling PowerShell for non-administrative users or implementing Constrained Language Mode is a key defense against fileless script-based attacks.

Answer

Enable auto-updates for all applications

Answer

Install an extra antivirus

Answer

Enable full disk encryption

Question 8

During an incident, you need to isolate a compromised workstation from the network immediately. Which action is the most effective containment strategy while preserving volatile memory?

Accepted Answer

Disconnect the network cable. Disconnecting the network cable is the correct containment action because it immediately severs the workstation's communication with the network (stopping lateral movement, C2 beaconing, and data exfiltration) while leaving the system powered on. This preserves volatile evidence such as RAM contents, running processes, network connections, and encryption keys that would be lost on shutdown. It is the least destructive way to isolate a host during the containment phase of incident response.

Answer

Shut down the computer immediately

Answer

Delete the suspicious files

Answer

Run a full antivirus scan

Question 9

Which document is essential to maintain during a malware incident to ensure accountability and track the actions taken by the incident response team?

Accepted Answer

Incident Log. An Incident Log (or Chain of Custody record) is critical for documenting every step, tool, and decision made during the response process.

Answer

User Manual

Answer

System Backup

Answer

Vulnerability Assessment Report

Question 10

When analyzing a potentially malicious script, which THREE of the following techniques help in deobfuscating the code?

Accepted Answer

Decrypting embedded strings. Option C (Decrypting embedded strings) is correct because obfuscated scripts frequently hide payloads, URLs, or commands inside encoded or encrypted string literals (e.g., Base64, XOR, ROT13), and extracting/decoding those strings reveals the script's true intent. Option D (Using an emulator for script execution) is correct because sandboxed emulators and instrumented interpreters let you execute the script in a controlled environment while logging API calls, string decryptions, and network activity, exposing behavior that static reading alone would miss. Option E (Manual code tracing in a debugger) is correct because stepping through the script line by line in a debugger lets you observe variable values, follow control flow through junk code and conditional obfuscation, and reconstruct the original logic. Option A (Renaming the file extension to .txt) is not a deobfuscation technique; changing the extension only affects how the OS associates the file and does not alter or reveal the code's obfuscation. Option B (Running the script as an administrator) is not a deobfuscation technique and is actually dangerous, since executing unknown malicious code with elevated privileges increases the risk of system compromise rather than helping to analyze the code.

Answer

Renaming the file extension to .txt

Answer

Running the script as an administrator

Question 11

Which THREE of the following are appropriate communication channels to keep users informed during an email phishing incident?

Accepted Answer

Corporate security intranet portal. Option B (Corporate security intranet portal) is correct because it is an authenticated, company-controlled channel where the security team can post authoritative incident updates and phishing indicators that employees already trust and routinely access. Option D (Official company-wide security alert email) is correct because it leverages the organization's existing mass-notification capability to reach all staff quickly with consistent guidance, even though email is the affected vector, since the alert is outbound and does not require users to click suspicious links. Option E (Internal helpdesk ticketing system status page) is correct because it provides a monitored, centralized location for real-time status updates and instructions, reducing inbound ticket volume while giving users a verified source of truth. Option A (Individual user personal phone numbers) is not appropriate because personal numbers are outside corporate control, raise privacy and consent issues, and are impractical for mass notification during an incident. Option C (Public social media accounts) is not appropriate because public channels can expose sensitive incident details, invite attacker impersonation and misinformation, and are not a reliable or secure way to reach internal users.

Answer

Individual user personal phone numbers

Answer

Public social media accounts

Question 12

Which THREE of the following represent critical log sources that should be correlated when investigating a potential network-based exfiltration incident?

Accepted Answer

DNS query logs for destination domain lookup. DNS query logs (B) are critical because exfiltration often relies on DNS tunneling or resolving attacker-controlled domains, and these logs reveal the queried names, record types, and client IPs involved in the lookup. Firewall logs (D) are essential since they record allowed and denied outbound connections, showing which internal hosts attempted to reach external IPs and ports during the incident window. NetFlow records (E) provide flow-level metadata such as source/destination IPs, ports, protocol, and byte/packet counts, enabling analysts to spot abnormally large or long-duration outbound transfers indicative of data exfiltration. NTP server logs (A) only show time synchronization activity and do not capture payload, connection, or transfer details relevant to exfiltration. Print server logs (C) relate to printing/spooling events and have no bearing on network-based data movement to external destinations.

Answer

NTP server logs

Answer

Print server logs

Question 13

Which THREE of the following are legal considerations when handling an incident?

Accepted Answer

Compliance with regional data breach notification laws. Option C is correct because incident handling must comply with regional data breach notification laws, which set mandatory timelines and reporting requirements (e.g., GDPR's 72-hour notification) that dictate how and when an incident is disclosed. Option D is correct because the admissibility of collected evidence in a court of law depends on maintaining proper chain of custody, forensic soundness, and legal seizure procedures, so evidence handling must follow legal standards to be usable in prosecution. Option E is correct because privacy rights of the employees involved impose legal limits on monitoring, searching, and disclosing personal data during an investigation, requiring adherence to privacy statutes and internal policies. Option A is not a legal consideration but a financial and operational one, and Option B is a technical performance factor, neither of which involves legal obligations or constraints.

Answer

The cost of upgrading the company's hardware

Answer

The speed of the internet connection used for analysis

Question 14

Which THREE of the following items should be included in an email incident report?

Accepted Answer

Chronological timeline of the incident. A chronological timeline of the incident is correct because an incident report must document the sequence of events (detection, initial response, containment, and resolution timestamps) so responders and auditors can reconstruct what happened and when. C, a list of affected users or systems, is correct because scoping the incident—identifying exactly which mailboxes, endpoints, or accounts were compromised—is essential for containment, notification, and impact assessment. E, remediation steps taken, is correct because the report must record the corrective actions performed (for example, password resets, MFA enforcement, mailbox rule deletion, or message purging) to verify the incident was resolved and to support lessons-learned analysis. B is not included because personal contact information of the attacker is typically unknown, unverifiable, and irrelevant to the report's factual scope, and pursuing it is a law-enforcement matter. D is not included because a full history of every email ever sent to the user is excessive, unrelated to the specific incident, and would introduce privacy and data-minimization concerns.

Answer

Personal contact information of the attacker

Answer

Full history of every email ever sent to the user

Question 15

An attacker uses a 'Homograph Attack' to spoof a domain. How does the analyst detect this?

Accepted Answer

Inspecting the Punycode representation of the domain. Homograph attacks use visually similar Unicode characters (e.g., Cyrillic 'а' instead of Latin 'a') to spoof legitimate domains. The Punycode representation (the ASCII-compatible encoding prefixed with 'xn--') exposes these non-ASCII characters, allowing analysts to detect the spoof. Inspecting the Punycode is the definitive technical method to unmask a homograph domain.

Answer

Scanning the email for attachments

Answer

Checking the SPF record

Answer

Looking for a valid TLS certificate