212-89 Practice Test 2 — 10 Questions

Question 1

A malware incident has been identified on a corporate workstation. The incident response team is following the containment, eradication, and recovery phases. Which TWO of the following actions are considered part of the eradication phase? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Applying security patches to the operating system. Eradication involves removing the malware and its components from the infected system. Deleting malicious files and registry keys eliminates the malware's presence and persistence. Applying security patches addresses the vulnerability that allowed the infection, preventing future occurrences. Containment (disconnecting from network) and recovery (restoring from backup, monitoring) are separate phases.

Answer

Monitoring network traffic for signs of re-infection

Answer

Restoring the system from a known good backup

Answer

Disconnecting the infected workstation from the network

Question 2

You are the first responder to a Linux server that is suspected of being compromised. You need to collect volatile data in the order of volatility. Which command should you run first to capture the most volatile data?

Accepted Answer

netstat -antp. The order of volatility guides first responders to collect the most perishable data first. Network connections are extremely volatile and can be lost within seconds if an attacker disconnects or a timeout occurs. Capturing them with netstat -antp provides immediate insight into active sessions and listening services. Process lists and disk logs, while important, are less volatile and can be collected subsequently without as much risk of loss.

Answer

cat /var/log/auth.log

Answer

df -h

Answer

ps aux

Question 3

Which THREE of the following characterize potential lateral movement using RDP in a domain environment?

Accepted Answer

Unusual use of NTLM for RDP authentication. Option A is correct because in a domain environment RDP authentication normally uses Kerberos, so a shift to NTLM for RDP (e.g., via Restricted Admin mode or credential-based attacks) is a strong indicator of lateral movement attempts. Option D is correct because mstsc.exe is the native RDP client, and its use with unusual flags (such as /admin, /restrictedAdmin, or /v to non-standard hosts) can signal an attacker pivoting between systems. Option E is correct because RDP logins originating from workstations to servers are atypical in most domain environments, where administrative RDP typically flows from jump hosts or management stations, making such connections a hallmark of lateral movement. Option B is incorrect because SNMP is a network management protocol unrelated to RDP session behavior. Option C is incorrect because HTTPS traffic is encrypted web traffic and does not characterize RDP-based lateral movement.

Answer

Increased usage of SNMP

Answer

High volume of HTTPS traffic

Question 4

Which TWO actions are recommended for evidence preservation in a digital incident?

Accepted Answer

Calculate cryptographic hashes for all collected files.. Hashing ensures integrity, and chain of custody ensures legal admissibility.

Answer

Reboot the system to clear temporary files.

Answer

Modify file permissions to prevent further access.

Answer

Delete all temporary logs to save space.

Question 5

During an incident response engagement, a first responder is collecting volatile data from a compromised Windows server. The responder needs to capture the current network connections, including the process ID associated with each connection, without installing any third-party tools. Which native Windows command should the responder use?

Accepted Answer

netstat -ano. The netstat -ano command is a native Windows utility that lists all active network connections and listening ports along with the owning process ID. This allows a first responder to quickly identify which process is associated with a suspicious connection, enabling immediate containment or further analysis without introducing third-party tools that could alter the system.

Answer

net session

Answer

tasklist /svc

Answer

ipconfig /displaydns

Question 6

You are dealing with a legal hold request for data related to an investigation. How should you handle the data retention policy for this specific case?

Accepted Answer

Suspend the automatic deletion for the affected data. A legal hold overrides existing retention policies, preventing the automatic deletion of relevant data.

Answer

Export the data to a public cloud storage service

Answer

Follow the standard 90-day retention policy

Answer

Delete the data and generate an audit log

Question 7

Which THREE of the following are common indicators of a phishing email?

Accepted Answer

Urgent or threatening language requiring immediate action. Option A is correct because phishing emails frequently use urgent or threatening language, such as warnings of account suspension or legal action, to pressure recipients into acting quickly without verifying the message. Option B is correct because a mismatch between the display name and the actual sender address is a classic spoofing indicator, since attackers often set a trusted-looking display name while the underlying SMTP From or Return-Path domain is different. Option D is correct because when the visible URL text differs from the actual hyperlink target (for example, displayed as https://bank.example.com but linking to http://malicious.example.net), it indicates an attempt to deceive the recipient about the destination. Option C is not a reliable indicator, because legitimate emails commonly use standard corporate branding and attackers can easily replicate logos and templates. Option E is not a reliable indicator, since phishing messages can be sent at any time, including during business hours, and timing alone does not indicate malicious intent.

Answer

The email uses standard corporate branding

Answer

The email is sent during business hours

Question 8

An incident handler is reviewing a suspicious executable found on a compromised Windows system. The file has a double extension, such as 'invoice.pdf.exe'. Which type of malware delivery technique is this most likely an example of?

Accepted Answer

Masquerading. Masquerading is the technique of making a malicious file appear benign, such as using a double extension to disguise an executable as a PDF. This exploits hidden file extensions in Windows to trick users. Phishing is a delivery vector, social engineering is a broader category, and rootkits are a different type of malware. The double extension is a direct example of masquerading.

Answer

Social engineering

Answer

Rootkit

Answer

Phishing

Question 9

You are investigating a compromised Linux host. Using 'tcpdump' to capture traffic on interface eth0 to analyze C2 communication on port 443, which command is most efficient for saving the output to a file for later analysis in Wireshark?

Accepted Answer

tcpdump -i eth0 port 443 -w capture.pcap. The -w flag is used in tcpdump to write raw packets to a .pcap file.

Answer

tcpdump -c eth0 port 443

Answer

tcpdump -i eth0 port 443 > capture.txt

Answer

tcpdump -r capture.pcap port 443

Question 10

Which THREE of the following are key components of a network-based containment strategy?

Accepted Answer

Isolation of the compromised segment from the rest of the network. Option A is correct because isolating the compromised network segment (for example, by moving it to a quarantine VLAN or applying ACLs on the switch/router) prevents lateral movement of the attacker to other hosts while containment is underway. Option B is correct because forcibly terminating active sessions (resetting TCP connections, killing authenticated sessions, or invalidating tokens) cuts off the attacker's existing foothold and command-and-control channels. Option C is correct because egress filtering at the perimeter blocks outbound traffic to known malicious IPs/domains, stopping data exfiltration and C2 callbacks, which is a core part of containing a network-based incident. Option D is not a containment measure; extending DHCP lease times only affects address assignment duration and does nothing to stop an active intrusion. Option E is not a containment action either, since wholesale hardware replacement is a costly remediation/recovery step, not a strategy for limiting the spread of an ongoing network-based attack.

Answer

Increasing the DHCP lease time

Answer

Installing new hardware across the network