212-89 Practice Test 17 — 15 Questions

Question 1

When reviewing network traffic for C2 communication, which THREE of the following indicators are commonly observed?

Accepted Answer

Periodic connections (beaconing) to a specific IP. Option B is correct because beaconing — repeated, evenly spaced outbound connections to the same IP or host — is a hallmark of malware checking in with its command-and-control server, often using fixed sleep/jitter intervals. Option C is correct because C2 channels frequently abuse non-standard ports (for example, running HTTPS on 8080, 8443, or 443 on an unexpected host) to blend in or bypass egress filtering that only permits common ports. Option E is correct because threat actors often stand up C2 infrastructure on newly registered or short-lived domains, so connections to domains with very recent registration dates are a strong indicator of compromise. Option A does not belong because local users printing to a printer is normal internal business traffic with no C2 relevance. Option D does not belong because a high volume of legitimate DNS traffic is ordinary network activity; only anomalous DNS patterns such as long TXT queries, high-entropy subdomains, or excessive NXDOMAIN responses would suggest C2 tunneling.

Answer

Connections from local users to a printer

Answer

High volume of legitimate DNS traffic

Question 2

Which TWO of the following sources of information are most helpful for building an Indicators of Compromise (IoC) list during an investigation?

Accepted Answer

EDR security event logs. EDR security event logs (A) are a primary IoC source because endpoint detection and response tools record process executions, command lines, file hashes, registry modifications, network connections, and persistence mechanisms that directly yield host-based indicators such as malicious file names, hashes, and parent-child process relationships. Firewall logs (D) are equally valuable for network-based IoCs, capturing source/destination IP addresses, ports, protocols, and connection timestamps that reveal command-and-control traffic and lateral movement. Together, endpoint and network telemetry provide the host and network indicators needed to construct a usable IoC list. The HR handbook (B) and cafeteria menus (E) contain no security telemetry and are irrelevant to threat detection, while office printer logs (C) are too narrow and rarely expose adversary activity beyond isolated print jobs, making them far less helpful than EDR and firewall data.

Answer

HR handbook

Answer

Office printer logs

Answer

Cafeteria menus

Question 3

Which TWO settings in a WAF policy are most effective at mitigating automated bot-driven web attacks?

Accepted Answer

Implementation of a CAPTCHA challenge. Option B (Implementation of a CAPTCHA challenge) is correct because CAPTCHAs are designed to distinguish human users from automated scripts, forcing bots to solve a challenge they typically cannot complete, thereby blocking automated bot-driven attacks at the application layer. Option D (Rate limiting based on IP address) is correct because throttling the number of requests a single IP can make within a time window directly mitigates the high-volume, repetitive request patterns characteristic of bot-driven attacks such as credential stuffing or scraping. Option A (Enabling verbose debugging mode) is incorrect because debugging output exposes internal details and does not mitigate bot traffic; it may actually aid attackers. Option C (Disabling all HTTP POST requests) is incorrect because it is overly broad and would break legitimate application functionality rather than selectively targeting bots. Option E (Reducing the global connection timeout) is incorrect because shortening timeouts does not distinguish bots from users and can degrade legitimate user experience without meaningfully stopping automated attacks.

Answer

Enabling verbose debugging mode

Answer

Disabling all HTTP POST requests

Answer

Reducing the global connection timeout

Question 4

Which TWO pieces of information must be collected to successfully track a session hijacking attack across multiple log sources?

Accepted Answer

The session ID/cookie value. To track a session hijacking attack across multiple log sources, you must be able to correlate the attacker's activity with the victim's session, which requires the session ID/cookie value (option B) because that token uniquely identifies the HTTP session and appears in web server, proxy, and application logs. You also need the exact timestamp of the requests (option E) so that events recorded in different logs (e.g., web server access logs, firewall logs, IDS/IPS alerts) can be aligned chronologically to reconstruct the attack sequence. The BIOS version of the server (option A) is irrelevant to session tracking because it does not identify user sessions or request timing. The web server's MAC address (option C) is a layer-2 hardware identifier that does not appear in application-layer session logs and cannot correlate a hijacked session. The server's physical location (option D) is also irrelevant, as session hijacking is tracked through logical identifiers and timestamps, not geographic placement of hardware.

Answer

The BIOS version of the server

Answer

The web server's MAC address

Answer

The server's physical location

Question 5

You are performing an incident investigation involving a suspected insider threat. Under GDPR compliance, you must ensure that your data collection methods adhere to the 'data minimization' principle. Which action best aligns with this requirement?

Accepted Answer

Collect only specific log entries and application artifacts related to the suspicious activity. Data minimization requires collecting only what is necessary for the investigation, avoiding the wholesale harvesting of unrelated user traffic or personal files.

Answer

Perform a full disk image of the suspect's entire workstation and cloud storage account

Answer

Install a keylogger on the workstation to monitor all user activity indefinitely

Answer

Request a full dump of the company-wide SQL database to search for activity

Question 6

An incident handler is reviewing an alert from the Endpoint Detection and Response (EDR) system. What is the main goal of the 'Containment' phase?

Accepted Answer

To limit the scope and damage of the incident. The primary goal of containment is to stop the spread of the attack and prevent further damage.

Answer

To identify the attacker

Answer

To analyze the root cause

Answer

To recover normal operations

Question 7

Which TWO of the following are safe practices when analyzing a suspicious email?

Accepted Answer

Ensuring the analysis environment is isolated from the network. Option C is correct because isolating the analysis environment from the network prevents any malicious payload from reaching command-and-control servers, exfiltrating data, or pivoting into production systems during examination. Option E is correct because an isolated virtual machine (VM) provides a disposable, sandboxed host where suspicious attachments or links can be detonated safely and then reverted via snapshots without risking the analyst's primary workstation. The remaining options are unsafe: A removes a critical defensive layer and exposes the host to malware, B risks executing malicious attachments in a production mail client with live credentials and data, and D can trigger drive-by downloads, tracking pixels, or credential-harvesting pages and may notify the attacker that the lure was opened.

Answer

Disabling all antivirus tools to observe behavior

Answer

Opening attachments in your primary email client

Answer

Clicking every link to check for live sites

Question 8

An organization is establishing an Incident Response (IR) team. According to NIST, which team structure is most suitable for a large, globally distributed organization that requires localized response capability with centralized oversight?

Accepted Answer

Distributed IR Team. A distributed team structure allows local teams to respond quickly to regional incidents while reporting to a centralized hub for unified policy enforcement.

Answer

Centralized IR Team

Answer

Virtual IR Team

Answer

Outsourced IR Team

Question 9

A network incident responder is analyzing a suspected ARP poisoning attack on a local subnet. Which two indicators would most likely be observed in the network traffic or ARP cache? (Choose two.)

Accepted Answer

Gratuitous ARP replies claiming an IP address already in use. ARP poisoning involves manipulating ARP caches to redirect traffic. Two key indicators are multiple IP addresses mapping to the same MAC address (often the attacker's) and gratuitous ARP replies that overwrite legitimate mappings. These directly reflect the attack mechanism. Other indicators like DNS failures, ICMP redirects, or TCP SYN floods are not specific to ARP poisoning and would mislead the investigation.

Answer

Frequent ICMP redirect messages from the default gateway

Answer

A sudden increase in DNS query failures

Answer

A high volume of TCP SYN packets from a single host

Question 10

During a web application incident, an analyst observes that an attacker is injecting malicious JavaScript into a comment field that is stored and later displayed to other users. Which type of web application incident is this?

Accepted Answer

Stored cross-site scripting (XSS). Stored XSS is identified when malicious script is saved by the application and later served to other users. The comment field acts as a persistent storage point, and the script executes in the browsers of anyone viewing the comment. This differs from reflected XSS, which is non-persistent, and from other injection types that target different components.

Answer

Reflected cross-site scripting (XSS)

Answer

Cross-site request forgery (CSRF)

Answer

SQL injection

Question 11

A security analyst is documenting an incident that involved unauthorized access to a database. The analyst needs to record the timeline of events. Which phase of the incident handling process includes documenting the timeline?

Accepted Answer

Post-Incident Activity. Documenting the timeline is a key part of post-incident activity, where the incident is reviewed and lessons learned are captured. While timeline information is gathered throughout the process, the formal documentation and analysis occur after the incident is resolved, ensuring a complete record for future reference.

Answer

Containment

Answer

Preparation

Answer

Identification

Question 12

A hospital's incident response team has just finished eradicating a ransomware infection that encrypted several clinical workstations. The CISO asks the handler to formally close the incident and release the team. According to the incident handling process, which activity must occur BEFORE the incident can be declared closed?

Accepted Answer

Conduct a post-incident review and document lessons learned with stakeholders.. Incident closure requires a formal post-incident review where the team, management, and stakeholders examine the timeline, root cause, and response effectiveness. This review produces lessons learned and assigned improvements, which is the defining activity of the post-incident phase. Reimaging the enterprise, notifying media, or destroying evidence are either disproportionate, policy-bound, or destructive actions that do not constitute the required closure step.

Answer

Immediately notify the media to demonstrate transparency about the ransomware attack.

Answer

Delete all forensic evidence to free storage space now that eradication is complete.

Answer

Reimage every workstation on the hospital network to guarantee no residual malware remains.

Question 13

An organization's incident response team is drafting its first formal incident handling capability. Management asks which phase of the process should include developing the incident response plan, acquiring forensic tools, and training the team before any real event occurs.

Accepted Answer

Preparation. Preparation is the only phase that occurs before incidents and encompasses building the plan, acquiring and maintaining forensic tooling, and training responders. Identification, containment, and post-incident activity all presuppose that this groundwork already exists, so they cannot be the phase in which the organization first creates its incident handling capability.

Answer

Containment

Answer

Identification

Answer

Post-incident activity

Question 14

A security analyst is reviewing network traffic and observes a high volume of TCP SYN packets from various spoofed source IP addresses to a single destination server, with no corresponding SYN-ACK replies. The server's connection table is nearly full. Which type of network incident is most likely occurring?

Accepted Answer

TCP SYN flood. The scenario describes a high volume of TCP SYN packets from spoofed sources to a single server, with no SYN-ACK replies and a nearly full connection table. This matches the behavior of a TCP SYN flood, where the attacker exhausts the server's resources by initiating many half-open connections. Other attacks like UDP amplification, Smurf, or DNS tunneling do not produce this specific pattern.

Answer

UDP amplification attack

Answer

DNS tunneling

Answer

Smurf attack

Question 15

Which TWO of the following steps are required when performing a post-mortem analysis of an email incident?

Accepted Answer

Evaluating the performance of security controls. Option C (Evaluating the performance of security controls) is correct because a post-mortem analysis must determine whether existing controls such as email gateways, spam filters, attachment sandboxing, and endpoint detection actually detected, blocked, or failed to stop the malicious email, so that gaps can be remediated. Option D (Reviewing the incident response timeline and logs) is correct because reconstructing the sequence of events from email gateway logs, mail server logs, EDR telemetry, and analyst actions is essential to identify what happened, how quickly the team responded, and where the process can be improved. Option A is not a required post-mortem step; promotions are an HR matter unrelated to analyzing the incident. Option B is not always required; law enforcement is contacted only when the incident meets legal or organizational thresholds, not as a standard post-mortem step. Option E is wrong because deleting evidence destroys the data needed for root-cause analysis, timeline reconstruction, and any legal or compliance obligations.

Answer

Promoting the security analyst involved

Answer

Contacting the local law enforcement authorities

Answer

Deleting all evidence to maintain privacy