212-89 Practice Test 18 — 15 Questions

Question 1

A user reports receiving an email with a .zip attachment that is password-protected and the password is included in the email body. The email claims to be an invoice from a known vendor. What is the most likely reason for this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The sender is trying to bypass antivirus detection by encrypting the payload.. Password-protected ZIP attachments with the password in the email body are a classic malware delivery technique. The encryption prevents antivirus scanning, and the password allows the user to open the file, often leading to infection. This is a strong indicator of a malicious email.

Answer

The email is a legitimate invoice that requires a password to comply with company policy.

Answer

The vendor is using a secure method to protect sensitive financial data.

Answer

The attachment is a compressed file to reduce email size and the password is for added security.

Question 2

Which of the following is an example of a non-volatile data source?

Accepted Answer

Hard Disk Drive.. A hard disk drive (HDD) is a non-volatile storage device — it retains data even when power is removed, because data is stored magnetically on platters. This makes it a classic example of a non-volatile data source in digital forensics, where investigators seek persistent artifacts like files, logs, and registry hives.

Answer

Processor Cache.

Answer

Network state table.

Answer

System RAM.

Question 3

During the containment phase of a ransomware incident, you must decide whether to disconnect the infected host from the network or keep it connected for monitoring. The host is encrypting files on a shared network drive. Which action should you take FIRST to limit the spread while preserving evidence?

Accepted Answer

Disconnect the host from the network by unplugging the Ethernet cable or disabling Wi-Fi.. Disconnecting the host from the network is the most effective first step to stop the spread of ransomware to shared drives while preserving volatile evidence. It isolates the threat without destroying memory or running processes, allowing later forensic analysis. Powering off or leaving it connected both have significant drawbacks that could worsen the incident or hinder investigation.

Answer

Run a full antivirus scan on the infected host to remove the malware.

Answer

Immediately power off the infected host to stop encryption.

Answer

Leave the host connected and monitor network traffic to identify the command-and-control server.

Question 4

An attacker compromises a user's Microsoft 365 mailbox and creates an inbox rule that moves all messages from the CFO to the 'RSS Feeds' folder and marks them as read. The user never sees these messages. Which type of email incident does this behavior most directly represent?

Accepted Answer

Business email compromise (BEC) with mailbox rule abuse. The attacker compromised a mailbox and configured a hidden inbox rule to suppress messages from the CFO, which is a signature of business email compromise with mailbox rule abuse. This allows the attacker to intercept financial communications, impersonate the executive, and initiate fraudulent transfers without the user noticing. The other options describe earlier-stage or unrelated email threats that do not match the post-compromise mail-flow manipulation shown.

Answer

Spam campaign targeting multiple recipients

Answer

Malware outbreak via a malicious attachment

Answer

Phishing email delivered to the user's inbox

Question 5

During an email incident investigation, an analyst needs to determine the originating IP address of a message that passed through multiple mail servers. The message headers contain several 'Received' fields. Which action should the analyst take to identify the true origin?

Accepted Answer

Read the 'Received' headers from bottom to top, as the bottom-most entry is the first server that handled the message.. Received headers are appended by each mail server that handles the message, with the oldest at the bottom. To find the originating IP, the analyst should read from bottom to top. The bottom-most Received header usually contains the IP address of the sender's mail server, providing the best indication of the true origin.

Answer

Check the 'Message-ID' header, which encodes the originating IP in its domain portion.

Answer

Read the 'Received' headers from top to bottom, because the top-most entry is the originating server.

Answer

Use the 'Return-Path' header, which always contains the originating IP address.

Question 6

What is the primary risk associated with 'Executive Spoofing' or BEC (Business Email Compromise)?

Accepted Answer

Financial loss via unauthorized transfers. BEC targets employees to perform unauthorized financial transfers through social engineering.

Answer

System performance degradation

Answer

Infrastructure downtime

Answer

Spam distribution

Question 7

You are leading the eradication phase of a malware incident. Which TWO activities are essential to ensure the malware is completely removed and the system is restored to a trusted state? (Choose two.)

Accepted Answer

Applying all missing security patches and updates to the affected system and its dependencies.. Reimaging from a known-good baseline and applying all missing security patches are essential for complete eradication. Reimaging removes all malware artifacts, while patching eliminates the vulnerability that allowed the compromise. Together, they ensure the system is restored to a trusted state and reduce the risk of reinfection.

Answer

Deleting all files in the temporary directories of the affected system.

Answer

Running a single antivirus scan and quarantining detected threats.

Answer

Disconnecting the system from the network and leaving it offline for 30 days.

Question 8

During an incident involving a web application, you discover that an attacker has uploaded a web shell to the server. You need to determine how the attacker uploaded the file. Which log source would provide the MOST relevant information about the upload mechanism?

Accepted Answer

Web server access logs showing POST requests to file upload endpoints.. Web server access logs are the most direct source for identifying file upload attempts. They record the HTTP method, URL, and source IP of requests. By searching for POST requests to known upload endpoints around the time the web shell was created, you can pinpoint the upload mechanism and the attacker's IP. Other logs may provide supporting context but are less specific.

Answer

Database logs showing INSERT statements into a files table.

Answer

Firewall logs showing outbound connections from the web server.

Answer

Operating system logs showing file creation events in the web root.

Question 9

During an incident, a security analyst discovers that a compromised workstation is communicating with a known malicious IP address. The analyst wants to block the IP at the perimeter firewall. Which phase of the incident handling process does this action fall under?

Accepted Answer

Containment. Blocking a malicious IP at the firewall is a containment action because it stops the incident from spreading or causing further damage. Containment is about limiting the blast radius, and this step prevents additional communication with the attacker. Eradication would involve removing the threat, while identification and recovery have different goals.

Answer

Recovery

Answer

Eradication

Answer

Identification

Question 10

During the first response to a compromised Windows workstation, you must capture volatile memory before shutting the system down. Which tool or technique is designed to acquire the full physical memory image while preserving its integrity for later analysis?

Accepted Answer

Use WinPmem or a similar memory acquisition tool to dump physical memory to a removable drive.. Capturing physical memory is critical in incident response because it contains running processes, network connections, encryption keys, and malware that may exist only in RAM. Tools like WinPmem are purpose-built to create a forensic image of memory without significantly altering the system state. Other options either capture different data types or modify the system, which would compromise the integrity of the volatile evidence needed for analysis.

Answer

Create a System Restore point and then copy the pagefile.sys file.

Answer

Export the Windows Event Logs to a CSV file on the local disk.

Answer

Run a full antivirus scan from a write-protected USB drive.

Question 11

Which THREE of the following are considered 'behavioral' indicators of a malware infection?

Accepted Answer

Unexplained outbound network connections to unknown IP addresses. Option A is correct because unexplained outbound network connections to unknown IP addresses are a behavioral indicator—they reflect the malware's runtime activity, such as command-and-control (C2) beaconing or data exfiltration, rather than a static artifact. Option C is correct because high CPU utilization by an unknown background process is behavioral: sustained resource consumption by an unrecognized process often signals cryptomining, worm propagation, or other malicious execution. Option D is correct because frequent modifications to system-protected files are behavioral, indicating ongoing tampering such as persistence mechanisms, rootkit installation, or system file replacement. Option B does not belong because a valid digital signature on a system file is a static integrity attribute, not an observed behavior, and it actually suggests the file is legitimate. Option E does not belong because the mere presence of a .txt file is a static file attribute with no behavioral context and is not indicative of malware.

Answer

A valid digital signature on a system file

Answer

Presence of a file with a .txt extension

Question 12

Which log file should you examine if you suspect an attacker is modifying the web server configuration files?

Accepted Answer

Audit logs (e.g., /var/log/audit/audit.log). Audit logs (e.g., /var/log/audit/audit.log) are the correct source because they capture system-level events including file modifications, permission changes, and access to critical configuration files via the Linux Audit subsystem. When an attacker tampers with web server configuration files such as httpd.conf or nginx.conf, the audit daemon (auditd) records the write, rename, or attribute-change syscalls against those file paths. This makes audit logs the authoritative record for detecting configuration tampering, unlike application-layer logs that only reflect the web server's own runtime behavior.

Answer

Application error logs

Answer

Web server status logs

Answer

Access logs

Question 13

Which protocol is used in conjunction with SPF and DKIM to provide instructions to the receiver on how to handle emails that fail authentication?

Accepted Answer

DMARC. DMARC (Domain-based Message Authentication, Reporting, and Conformance) builds on SPF and DKIM by allowing domain owners to publish a policy that instructs receivers on how to handle emails that fail SPF and/or DKIM alignment checks. It also provides reporting mechanisms. SPF authenticates the sending server, DKIM cryptographically signs the message, and DMARC ties them together with a policy.

Answer

SMTPS

Answer

IMAP

Answer

POP3

Question 14

When DKIM signature verification fails, what is the most likely technical cause?

Accepted Answer

The body of the message was modified in transit. DKIM uses a cryptographic signature over specified headers and the message body. If the body is modified in transit, the hash computed by the receiver will not match the signature, causing verification to fail. This is the most likely technical cause of DKIM failure.

Answer

The sender's IP address is on a blocklist

Answer

The user clicked a phishing link

Answer

The SPF record is missing

Question 15

You are the first responder dispatched to a workstation suspected of being compromised by a phishing payload. The user is still logged in and a suspicious process is actively communicating over the network. Before you begin any data collection, what should you do first?

Accepted Answer

Document the current state of the screen, running applications, and visible network activity using a camera or screenshot tool.. The first action in first response is to document the scene and capture volatile evidence before it is lost. Photographing or screenshotting the screen preserves visible indicators like open applications and network activity. Powering off, scanning, or disconnecting prematurely can destroy or alter critical volatile data that is essential for understanding the incident and supporting later forensic analysis.

Answer

Run a full antivirus scan to identify and remove the malicious files before collecting evidence.

Answer

Immediately power off the workstation to prevent further malware execution and data exfiltration.

Answer

Disconnect the workstation from the network and then begin collecting the hard drive for forensic imaging.