212-89 Practice Test 16 — 15 Questions

Question 1

You are analyzing a malware sample using Cuckoo Sandbox. The report shows the malware is attempting to modify the 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run' registry key. What is the intent of this activity?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Establishing system persistence. The Windows Run registry key is a well-known autostart location that causes programs to execute automatically when a user logs in. Malware modifying this key is attempting to ensure it runs every time the system starts, which is the definition of establishing persistence. This technique is catalogued in MITRE ATT&CK as T1547.001 (Registry Run Keys / Startup Folder).

Answer

Injecting code into explorer.exe

Answer

Escalating user privileges

Answer

Disabling the Windows Firewall

Question 2

An attacker is using ICMP tunneling to exfiltrate data. What field in an ICMP echo request packet would contain the unauthorized data?

Accepted Answer

Data field. In ICMP tunneling, attackers encapsulate data within the payload of ICMP echo request packets, which is the Data field. This field can carry arbitrary data, allowing covert exfiltration. The other fields are used for control and routing, not for carrying variable payloads.

Answer

Checksum field

Answer

Sequence number

Answer

TTL field

Question 3

What is the purpose of 'Network Segmentation' during an active network incident?

Accepted Answer

Containment of the attack by limiting communication paths. Network segmentation during an active incident isolates affected segments from the rest of the environment, limiting the attacker's ability to move laterally, exfiltrate data, or reach command-and-control infrastructure. By restricting communication paths (via VLANs, ACLs, firewall rules, or microsegmentation), responders contain the blast radius while preserving critical business traffic. This is a core containment tactic in incident response frameworks like NIST SP 800-61.

Answer

Eliminating the need for firewalls

Answer

Automatic removal of malware

Answer

Increasing network throughput

Question 4

Which TWO of the following steps are considered best practices when performing network forensics on a live environment?

Accepted Answer

Maintain a strict chain of custody for all PCAP files. Option A is correct because maintaining a strict chain of custody for all PCAP files ensures that captured evidence remains admissible and its integrity is verifiable in legal or disciplinary proceedings, documenting who handled the files, when, and how. Option C is correct because capturing traffic via a SPAN port or a network tap provides a non-intrusive, passive copy of live traffic without disrupting production flows or altering the packets, which is essential for accurate forensic analysis. Options B, D, and E are not best practices: disabling logging destroys valuable evidence and does not meaningfully prioritize bandwidth, rebooting network devices clears volatile buffers and loses forensic artifacts, and modifying firewall rules to allow all traffic contaminates the environment and changes the very conditions being investigated.

Answer

Disable all logging to prioritize bandwidth

Answer

Reboot the network devices to clear the buffer

Answer

Modify the firewall rule to allow all traffic for analysis

Question 5

Which THREE actions are essential when performing log review after a web application attack?

Accepted Answer

Correlate logs from the web server, WAF, and backend database. Option B is correct because correlating logs from the web server, WAF, and backend database provides a complete timeline of the attack, linking the initial HTTP request, the WAF's detection or bypass, and any resulting database queries or errors. Option D is correct because verifying log integrity with checksums (e.g., SHA-256 hashes) ensures that attackers have not altered or deleted evidence, which is critical for a trustworthy forensic review. Option E is correct because searching logs for known attack signatures such as SQL injection patterns (e.g., ' OR 1=1--), cross-site scripting payloads, or path traversal sequences helps identify the specific exploitation attempts and affected endpoints. Option A is incorrect because deleting logs destroys evidence and violates retention requirements; logs should be preserved and archived, not purged. Option C is incorrect because limiting review to only the last hour of the incident misses the initial reconnaissance, exploitation, and persistence phases, which may have occurred earlier.

Answer

Delete all log entries older than 24 hours to save space

Answer

Only review logs from the last hour of the incident

Question 6

You are reviewing logs after an incident. You see a sequence of requests starting with 'admin.php', then 'admin.php?id=1', then 'admin.php?id=1 OR 1=1'. What is the attacker doing?

Accepted Answer

Testing for SQL injection vulnerabilities. The progression from 'admin.php' to 'admin.php?id=1' to 'admin.php?id=1 OR 1=1' shows the attacker probing a parameter and then injecting a classic SQL tautology ('OR 1=1') to bypass authentication or extract data. This is textbook SQL injection testing.

Answer

Executing a cross-site scripting attack

Answer

Performing a directory traversal

Answer

Performing a brute-force attack

Question 7

What is the primary function of an Incident Response (IR) policy?

Accepted Answer

To establish the authority and framework for incident management. An IR policy is a high-level governance document that assigns authority, defines the scope of the incident response programme, and establishes the framework within which procedures and plans operate. It answers 'who is in charge and under what mandate', not 'how do I remove malware'. It is approved by executive management and provides the organisational legitimacy for the IR team to act.

Answer

To monitor network traffic for threats

Answer

To define the budget for new security tools

Answer

To provide step-by-step instructions for patching servers

Question 8

You are performing a triage on a server and see unauthorized outbound connections to a foreign IP. What is the best way to determine which process initiated the connection?

Accepted Answer

Run 'netstat -ano' to map the connection to a PID.. On Windows, 'netstat -ano' lists active connections with the owning Process ID (PID) via the -o switch, letting you map the foreign IP connection to the exact process. You then correlate the PID to a process name using Task Manager or 'tasklist /fi "pid eq <PID>"'. This is the fastest triage method to identify the responsible binary.

Answer

ping the IP address.

Answer

Check the ARP table.

Answer

Use 'ipconfig /all'.

Question 9

You are reviewing a failed incident case management report. The team failed to capture the 'Time of Detection' vs. 'Time of Occurrence'. Which metric is directly impacted by this lack of documentation?

Accepted Answer

Mean Time to Detect (MTTD). Mean Time to Detect (MTTD) is calculated by the difference between the actual occurrence and the detection time; failing to record these makes the metric impossible to compute.

Answer

False Positive Rate

Answer

Mean Time to Contain (MTTC)

Answer

Mean Time to Recover (MTTR)

Question 10

Which TWO of the following are common network-based indicators of a compromised host attempting to perform network discovery?

Accepted Answer

High volume of TCP SYN packets to multiple ports. Option B is correct because a compromised host performing port scanning typically sends a high volume of TCP SYN packets to many ports on one or more targets, which is the classic signature of a SYN scan used for network discovery. Option C is correct because ARP scanning tools (e.g., arp-scan, nmap -PR) flood the local subnet with ARP requests to enumerate live hosts, producing a high volume of ARP traffic that is a common indicator of internal discovery activity. Option A is not a discovery indicator, since DHCP release messages simply relinquish an existing lease and are not associated with host enumeration. Option D is unrelated, as HTTP 404 errors reflect web content requests rather than network discovery. Option E is not a network-based discovery indicator in the same sense, because DNS queries for internal hostnames are normal resolver behavior and do not by themselves indicate scanning or enumeration of the network.

Answer

Increase in DHCP release messages

Answer

Multiple HTTP 404 errors

Answer

Frequent DNS queries for internal hostnames

Question 11

Which TWO of the following are considered 'Legal Considerations' during the Incident Handling process that must be integrated into the response plan?

Accepted Answer

Ensuring compliance with data breach notification statutes. Option B is correct because data breach notification statutes (e.g., GDPR, HIPAA, state laws like California's CCPA) impose legally mandated timelines and procedures for informing regulators and affected parties, and these legal obligations must be built into the incident response plan to avoid fines and liability. Option D is correct because a formal chain of custody documents who collected, handled, and transferred digital evidence, ensuring its admissibility in legal or disciplinary proceedings, which is a core legal consideration during incident handling. Option A is not a legal consideration but a technical containment measure performed on the edge firewall. Option C is an administrative maintenance task unrelated to legal obligations during incident response. Option E is a technical assessment activity, not a legal requirement, and would not by itself satisfy legal or evidentiary obligations.

Answer

Configuring automated IP blocking on the edge firewall

Answer

Updating the organizational server maintenance schedule

Answer

Running a vulnerability scan on the impacted systems

Question 12

Which team should be notified first in the event of a confirmed external data breach involving customer PII?

Accepted Answer

Legal and Privacy officers. In a confirmed external data breach involving customer PII, Legal and Privacy officers must be notified first because they own the regulatory notification obligations (e.g., GDPR, CCPA, HIPAA) and privilege considerations. Involving legal counsel early preserves attorney-client privilege over the investigation and ensures breach notification deadlines are met. They also coordinate with regulators, law enforcement, and affected parties as required by law.

Answer

The local news media

Answer

The marketing department

Answer

The software development team

Question 13

While investigating a breach, you need to verify the integrity of a system file. Which process is correct to ensure the file has not been altered?

Accepted Answer

Generate a SHA-256 hash and compare to a trusted baseline.. Generating a cryptographic hash (SHA-256) of the file and comparing it to a known good baseline is the standard process for integrity verification.

Answer

Compare the file size with the original.

Answer

Check the 'Date Modified' timestamp.

Answer

Open the file in a text editor to look for changes.

Question 14

Which THREE of the following are critical requirements for maintaining a valid Chain of Custody?

Accepted Answer

Verifying that the evidence was not tampered with during transport. Option B is correct because a valid Chain of Custody must demonstrate that evidence remained unaltered from seizure through presentation, which requires verifying integrity during transport (e.g., via hash comparison or sealed tamper-evident containers). Option D is correct because the core of Chain of Custody is a chronological record documenting every individual who took possession of the evidence, including times, dates, and signatures, ensuring unbroken accountability. Option E is correct because documenting exactly where evidence was stored (location, container, conditions) is essential to prove it was secured against unauthorized access or contamination. Option A does not belong because a log of software installed on the investigator's machine relates to tool validation and forensic soundness, not to the custody of the evidence itself. Option C does not belong because the attacker's original IP address is an investigative artifact or indicator of compromise, not a requirement for maintaining Chain of Custody.

Answer

A log of all software installed on the investigator's machine

Answer

A copy of the attacker's original IP address

Question 15

Which THREE items should be included in an incident report following a successful SQL injection attack?

Accepted Answer

A list of potentially affected data or databases. Option A is correct because an incident report must scope the breach by identifying which data or databases may have been exposed, enabling impact assessment and notification obligations. Option D is correct because documenting the specific attack vector and payload (for example, the vulnerable parameter and injected SQL syntax) is essential for root-cause analysis and for reproducing and validating the fix. Option E is correct because recording the remediation steps performed to close the vulnerability provides an auditable record of containment and eradication and supports verification that the flaw no longer exists. Option B does not belong because the discoverer's personal name is not a required technical or impact element of the report, and Option C does not belong because the data center's exact physical address is irrelevant to describing the SQL injection incident, its scope, or its remediation.

Answer

The personal name of the person who discovered the attack

Answer

The exact physical address of the data center