212-89 Practice Test 14 — 15 Questions

Question 1

During network forensics, you need to reconstruct an HTTP file transfer from a PCAP. Which Wireshark feature allows you to extract the file object directly from the stream?

Accepted Answer

File > Export Objects > HTTP. The 'Export Objects' feature in Wireshark is designed to reassemble and extract files from protocols like HTTP, SMB, and DICOM.

Answer

Statistics > HTTP > Reassemble

Answer

Edit > Follow > Stream Extract

Answer

Analyze > Extract File

Question 2

Which TWO of the following actions are standard steps in the 'Analysis' phase of an incident?

Accepted Answer

Identifying the scope and extent of the compromise. Analysis involves confirming the scope and technical details of the breach.

Answer

Training employees on phishing awareness

Answer

Installing new antivirus software

Answer

Restoring systems from a backup

Question 3

During a malware incident response, you identify a suspicious process with PID 4452 using Sysinternals Process Explorer. You need to verify the file's reputation before isolation. Which action allows you to do this directly within the tool?

Accepted Answer

Select the process and click Options > Check VirusTotal. Process Explorer provides a 'Check VirusTotal' feature under the Options menu to automatically submit file hashes to VirusTotal for reputation verification.

Answer

Use the 'Find Handle or DLL' search bar for the file name

Answer

Right-click the process and select 'Verify Signature'

Answer

Navigate to View > Lower Pane View > Handles

Question 4

Which team should be notified first in the event of a confirmed external data breach involving customer PII?

Accepted Answer

Legal and Privacy officers. Legal and Data Privacy teams must be involved early to handle regulatory compliance and notifications.

Answer

The local news media

Answer

The marketing department

Answer

The software development team

Question 5

Which TWO of the following are primary objectives of the 'Lessons Learned' phase?

Accepted Answer

Updating policies and procedures to prevent recurrence. Lessons learned aims to improve future response and document findings for management.

Answer

Deleting all incident records to protect privacy

Answer

Assigning financial bonuses to the team

Answer

Testing the backup power supply of the building

Question 6

Which TWO of the following are common indicators that an incident should be declared?

Accepted Answer

Unusual or unauthorized system access patterns. Evidence of unauthorized access or service disruption are clear triggers for declaring an incident.

Answer

A scheduled software update being pushed to clients

Answer

An increase in system CPU usage during scheduled maintenance

Answer

An employee requesting a password reset

Question 7

When conducting an interview with a potential witness during an investigation, what is the best practice to follow?

Accepted Answer

Ask open-ended questions to gather facts without bias. Structured, open-ended questions minimize bias and allow the witness to provide their full account.

Answer

Ask leading questions to confirm your suspicions

Answer

Have the witness sign a statement before they start talking

Answer

Record the interview without telling the witness

Question 8

You are analyzing a malware sample using Cuckoo Sandbox. The report shows the malware is attempting to modify the 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run' registry key. What is the intent of this activity?

Accepted Answer

Establishing system persistence. Modifying this registry key is a classic technique for establishing persistence, ensuring the malware executes automatically upon system startup.

Answer

Injecting code into explorer.exe

Answer

Escalating user privileges

Answer

Disabling the Windows Firewall

Question 9

Which THREE of the following roles are typically included in an IR team?

Accepted Answer

Human Resources Representative. An IR team requires technical, legal, and managerial expertise.

Answer

The company's primary janitor

Answer

The company's web designer

Question 10

You are analyzing a malware sample in a lab. You notice the malware uses the 'CreateRemoteThread' API. What is the objective of this malware activity?

Accepted Answer

Injecting a thread into another process. The 'CreateRemoteThread' API is commonly used to inject a thread into a separate process, which is a fundamental step in DLL injection and code execution.

Answer

Opening a network socket

Answer

Deleting files on disk

Answer

Modifying system time

Question 11

You are performing a live memory analysis using Volatility 3. You suspect a rootkit is hiding processes. Which plugin should you run to compare the process list from the EPROCESS block with the thread scheduler's list?

Accepted Answer

windows.psscan. The 'psxview' plugin in older versions or 'pslist' vs 'psscan' comparison helps identify hidden processes. In Volatility 3, 'windows.psscan' is used to find processes that are not linked in the active process list.

Answer

windows.netscan

Answer

windows.modules

Answer

windows.vadyarascan

Question 12

You are performing forensic analysis on a suspicious file. You need to determine if it is a packed executable. Which tool is most effective for viewing the file's section headers to identify anomalies?

Accepted Answer

PEview. PEview or CFF Explorer allows for detailed inspection of the Portable Executable structure, including section headers which often reveal abnormal names (e.g., UPX) for packed files.

Answer

Wireshark

Answer

Process Explorer

Answer

Regedit

Question 13

Which THREE of the following are effective methods for protecting backup systems from being encrypted by ransomware?

Accepted Answer

Restricting backup service account permissions. Backups should be immutable, physically or logically isolated (air-gapped), and have strictly controlled access to prevent modification or deletion by ransomware.

Answer

Storing backups on the same server as the primary data

Answer

Using an easy-to-guess password for the backup drive

Question 14

During an incident, you need to isolate a compromised workstation from the network immediately. Which action is the most effective containment strategy while preserving volatile memory?

Accepted Answer

Disconnect the network cable. Disconnecting the network cable or disabling the network interface card via BIOS/Switch port prevents C2 communication while keeping the system powered on for memory forensics.

Answer

Shut down the computer immediately

Answer

Delete the suspicious files

Answer

Run a full antivirus scan

Question 15

An incident handler is analyzing a malware incident that used a phishing email. What is the most important field to check in the email header to determine the true origin of the email?

Accepted Answer

Received header. The 'Received' headers show the path the email took and the IP addresses of the mail servers involved, helping trace the original sender.

Answer

Subject line

Answer

Message-ID

Answer

Content-Type