212-89 Practice Test 19 — 15 Questions

Question 1

A first responder arrives at a workstation where a user is suspected of exfiltrating data via a USB drive. The machine is still powered on. The responder must preserve the most volatile evidence first. Which artifact should be captured immediately?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The current contents of physical memory (RAM) and running processes. The order of volatility dictates that the most perishable evidence be collected first. Physical memory and running processes are lost when the system is powered off, so they must be captured before any disk-based artifacts. Pagefile, hibernation files, disk images, and event logs are persistent and can be acquired afterward without losing their content.

Answer

The Windows Event Log files stored in C:\Windows\System32\winevt\Logs

Answer

A forensic image of the entire hard drive using a write-blocker

Answer

The contents of the pagefile.sys and hiberfil.sys files on the local disk

Question 2

You are analyzing a malware sample that uses 'API Hooking'. What is the goal of this technique?

Accepted Answer

Interception and manipulation of system calls. API hooking is a technique where malware intercepts calls to system or library functions (APIs) by redirecting execution to attacker-controlled code, allowing it to monitor, modify, or block the original function's behavior. The goal is interception and manipulation of system calls — for example, hiding files, suppressing AV alerts, or stealing credentials passed to APIs. This is a core evasion and data-theft mechanism.

Answer

Increasing CPU priority

Answer

Bypassing network authentication

Answer

Preventing the system from hibernating

Question 3

A web application incident has been confirmed, and the responder needs to determine whether the attacker accessed sensitive customer records through a vulnerable API endpoint. Which log source should be examined first to identify the specific API calls and parameters used?

Accepted Answer

The application server log that records API request payloads and response sizes.. To determine whether specific customer records were accessed through an API, the responder needs application-level logs that capture request payloads and response details. These logs show the parameters and the volume of data returned, which allows correlation with database records. Web server access logs, database error logs, and OS authentication logs lack the necessary application context.

Answer

The web server access log containing request method, URI, status code, and user agent.

Answer

The database server error log capturing failed queries and connection issues.

Answer

The operating system authentication log recording successful and failed logins.

Question 4

While analyzing an email header, you observe an SPF 'softfail'. What does this imply?

Accepted Answer

The sending IP is not listed in the domain's SPF record. A softfail (~all) indicates the server is not explicitly authorized but the domain owner is not strictly enforcing rejection.

Answer

The message was spoofed and must be blocked

Answer

The email has been encrypted with TLS

Answer

The email passed DKIM verification

Question 5

A first responder is documenting a compromised Linux server. The server's system clock is accurate, but the file timestamps show inconsistencies. The responder needs to preserve the file system metadata for later analysis. Which action should be taken first to ensure the integrity of the metadata?

Accepted Answer

Create a forensic image of the disk using dd and then analyze the image.. To preserve file system metadata integrity, a forensic image should be created before any analysis. Imaging with dd captures all data and metadata without alteration. Commands like stat or cp -p do not provide a complete, verifiable copy and may alter the original. Modifying timestamps with touch destroys evidence. Therefore, the first step is to create a forensic image.

Answer

Copy the files to an external drive using cp -p to preserve timestamps.

Answer

Use the touch command to update the timestamps to the current time for consistency.

Answer

Run the stat command on each file and save the output to a text file on the same server.

Question 6

A user reports an email claiming to be from the IT helpdesk that asks them to click a link and re-enter their credentials because their mailbox is full. The user has not clicked the link. According to the Certified Incident Handler process, what is the most appropriate immediate action?

Accepted Answer

Report the email to the security team and preserve it as evidence without clicking any links.. When a user reports a suspected phishing email, the immediate priority is to prevent credential theft and preserve evidence. The user should not interact with the message, and the security team should be notified so the message can be analyzed and the campaign blocked. Deleting or forwarding the email prematurely can destroy evidence or spread the threat.

Answer

Instruct the user to delete the email and empty the deleted items folder.

Answer

Click the link from a sandboxed virtual machine to see where it leads.

Answer

Forward the email to all staff as a warning about phishing.

Question 7

You are setting up a secure communication channel for the IR team during a major incident. Why is it recommended to use an out-of-band communication method?

Accepted Answer

To prevent the attacker from monitoring team communications. If the primary network is compromised, internal communication (email/Slack) may be monitored by the attacker.

Answer

To comply with the Acceptable Use Policy

Answer

To simplify documentation for the final report

Answer

To increase bandwidth for file transfers

Question 8

An incident responder notices that a workstation is communicating with an external IP address on port 4444, and the traffic is encrypted. The workstation's user reports that the computer is running slowly. Which type of network incident is most likely indicated?

Accepted Answer

Command and control (C2) communication. The workstation is communicating with an external IP on port 4444 with encrypted traffic, and the user reports slow performance. Port 4444 is a default port for Metasploit and other attack tools, and encrypted C2 channels are common in malware. The slow performance could be due to the malware's operations. This is a classic sign of a compromised host under command and control.

Answer

Peer-to-peer file sharing

Answer

Legitimate remote desktop access

Answer

DNS tunneling

Question 9

You are using NetFlow to identify lateral movement. You see a high volume of connections from a web server to an internal database server on port 3306. What is the most appropriate next step in the investigation?

Accepted Answer

Examine the process list on the web server to identify the source of the connection. A high volume of connections from a web server to an internal database on port 3306 is suspicious because web servers typically connect to databases, but a sudden spike or unusual pattern may indicate lateral movement or data exfiltration. The most appropriate next step is to examine the process list on the web server to identify which process is initiating the connections — this could reveal a compromised web application, a malicious script, or an attacker's tool. This action is non-disruptive and directly identifies the source.

Answer

Reset the database server credentials

Answer

Block the web server access entirely

Answer

Increase the flow timeout settings

Question 10

A malware infection has encrypted several network shares. You decide to restore from backups. What is the most critical step to perform before restoring data to the production environment?

Accepted Answer

Restore data to a sandbox or isolated VLAN. Restoring data to a sandbox or isolated VLAN before production is the most critical step because it verifies the backups are clean and free of the ransomware or its persistence mechanisms. Ransomware frequently targets or encrypts backup repositories, and restoring directly to production risks reinfecting the environment. Testing in isolation confirms data integrity and allows scanning without exposing production systems.

Answer

Scan the backup media with the same AV used previously

Answer

Reboot the domain controllers

Answer

Change all user passwords

Question 11

During a network incident, you observe a large volume of ARP replies from a single MAC address claiming to be the default gateway. Which containment action should you take first to mitigate the immediate threat while preserving evidence for forensic analysis?

Accepted Answer

Capture network traffic and ARP tables, then isolate the affected VLAN. The immediate threat is ARP spoofing, which can lead to man-in-the-middle attacks. The best first action is to capture volatile evidence (network traffic, ARP caches) before taking containment steps, then isolate the affected VLAN to prevent lateral movement. This preserves forensic artifacts while stopping the attack from spreading. Other options either disrupt evidence, are not immediate, or do not contain the threat at the network level.

Answer

Shut down the switch port where the malicious MAC address is connected

Answer

Configure a static ARP entry for the default gateway on critical hosts

Answer

Enable Dynamic ARP Inspection (DAI) on all access ports

Question 12

When eradicating malware, which TWO of the following steps are essential to ensure the host is fully cleaned and the entry point is secured?

Accepted Answer

Identify and patch the vulnerability that allowed entry. Option B is correct because identifying and patching the vulnerability that allowed entry closes the initial access vector, preventing reinfection or re-exploitation by the same malware or attacker. Option D is correct because deleting all identified malicious artifacts—such as malicious executables, registry keys, scheduled tasks, and persistence mechanisms—ensures the host is actually cleaned and no residual malware remains. Option A is not relevant, as changing the wallpaper has no security impact on malware eradication. Option C is not relevant, since installing a new browser plugin does not address the infection or its entry point. Option E is insufficient on its own, as clearing the browser cache may remove some traces but does not eliminate malware or secure the vulnerability.

Answer

Change the background wallpaper to a default image

Answer

Install a new browser plugin

Answer

Clear the browser cache

Question 13

An incident handler is preparing the containment strategy for a compromised workstation that is communicating with a command-and-control server. Which TWO actions are appropriate immediate containment measures? (Choose two.)

Accepted Answer

Apply a firewall rule to block the known command-and-control IP address.. Containment aims to stop the spread and limit damage while preserving evidence. Disconnecting the workstation from the network and blocking the command-and-control IP at the firewall achieve isolation without destroying volatile data. Powering off, reimaging, or running antivirus scans either destroy evidence or are remediation steps, not containment, and should be deferred until after analysis.

Answer

Reimage the workstation with a clean operating system.

Answer

Run a full antivirus scan on the workstation.

Answer

Power off the workstation immediately.

Question 14

An employee receives a message that appears to come from the CEO asking for an urgent gift card purchase, and the reply-to address is a free webmail account. The employee reports it without clicking anything. Which containment action is most appropriate at this stage?

Accepted Answer

Block the sender address at the email gateway and search the environment for other recipients of the same message. The message was reported without interaction, so the proportionate response is to block the sender and determine who else received it. This scopes the campaign and identifies any colleague who may have acted, while avoiding disruptive actions such as account disablement or reimaging that the evidence does not support.

Answer

Close the incident because no user interaction occurred and no systems were affected

Answer

Immediately disable the employee's account and force a password reset

Answer

Reimage the employee's workstation to remove any potential persistence

Question 15

You are a first responder tasked with collecting volatile data from a compromised Windows system. Which two of the following commands or tools are appropriate for capturing network connection information? (Choose two.)

Accepted Answer

Get-NetTCPConnection. Capturing network connection information is critical to identify active communications, such as command-and-control channels. Both netstat -ano and Get-NetTCPConnection provide a list of active TCP connections and listening ports, along with the associated process IDs. These tools are built into Windows and can be run without additional software, making them ideal for first response. Other commands like ipconfig, route print, and arp -a provide configuration or cache data but not active connection details.

Answer

route print

Answer

arp -a

Answer

ipconfig /all