212-89 Practice Test 20 — 15 Questions

Question 1

An analyst is reviewing logs from an EDR solution. They see a 'process hollowing' event. What is the primary purpose of this malware technique?

Accepted Answer

Hiding malicious code inside a legitimate process. Process hollowing is a code-injection technique in which malware creates a legitimate process in a suspended state, unmaps its original code from memory, and replaces it with malicious code, then resumes execution. The primary purpose is to hide malicious activity inside a trusted, legitimate process so that it evades detection by security tools that trust known executables. This is why EDR solutions flag it as a high-severity event.

Answer

Brute-forcing system credentials

Answer

Encrypting local user files

Answer

Creating a hidden user account

Question 2

An organization is conducting a post-incident review after a major data breach. The team must document the incident timeline, root cause, and corrective actions. Which phase of the incident handling process does this activity belong to?

Accepted Answer

Post-incident activity. The post-incident activity phase encompasses all actions taken after the incident is resolved, including reviewing what happened, why it happened, and how to prevent recurrence. Documenting the timeline, root cause, and corrective actions is central to this phase. Preparation, identification, and containment are earlier phases focused on readiness, detection, and damage limitation, respectively. Thus, the post-incident review belongs to post-incident activity.

Answer

Preparation

Answer

Containment

Answer

Identification

Question 3

During the identification phase, you notice a high volume of traffic from an unknown IP to your web server. What is the most appropriate action to take first?

Accepted Answer

Analyze the traffic logs to determine the nature of the activity. Analyzing the traffic confirms whether it is an attack or benign activity before taking disruptive action.

Answer

Block the IP at the firewall immediately

Answer

Notify the local law enforcement

Answer

Shut down the web server

Question 4

During a network incident, you observe a compromised host repeatedly connecting to an external IP on TCP port 443. The traffic is encrypted, but the connection duration is unusually short and the bytes transferred are small and consistent. Which of the following is the MOST likely explanation for this traffic pattern?

Accepted Answer

The host is communicating with a command-and-control server using HTTPS beaconing.. The correct answer is the one describing command-and-control beaconing. The scenario describes short, periodic connections with small, consistent data transfers to an external IP on TCP port 443. This is a classic indicator of malware beaconing, where the compromised host checks in with a C2 server at regular intervals. The use of HTTPS helps the traffic evade detection by blending with legitimate encrypted traffic.

Answer

The host is downloading a large file over HTTPS.

Answer

The host is performing a vulnerability scan against the external IP.

Answer

The host is using a peer-to-peer file sharing application.

Question 5

A malware incident has been detected on a Windows server. The incident handler needs to identify the persistence mechanism used by the malware. The handler runs the 'Autoruns' tool and observes an entry in the 'Scheduled Tasks' tab that points to a suspicious executable in the user's AppData folder. Which Windows feature is being abused for persistence?

Accepted Answer

Task Scheduler. The Scheduled Tasks tab in Autoruns displays tasks that are configured to run automatically. Malware can create scheduled tasks to ensure it executes after reboots or at specific intervals. Identifying the task and its associated executable is crucial for eradication. The other options are different persistence mechanisms that would appear in other tabs of Autoruns.

Answer

Startup folder

Answer

Windows Management Instrumentation (WMI) event subscription

Answer

Registry Run keys

Question 6

A web application is suspected of being compromised through a file inclusion vulnerability. The attacker has uploaded a web shell to the server. Which type of log should you examine to find evidence of the web shell being accessed and executed?

Accepted Answer

Web server access logs. Web server access logs are the most direct evidence of web shell access because they log every HTTP request, including the URL of the shell and any parameters passed. By examining these logs, you can identify the attacker's IP, the timeline of access, and potentially the commands executed. Other logs may provide supporting information but do not capture the web shell execution itself.

Answer

Application server error logs

Answer

Operating system authentication logs

Answer

Database audit logs

Question 7

You are investigating a Linux server breach. You need to capture the current state of network connections without altering the evidence. Which command-line tool is preferred by first responders?

Accepted Answer

ss -tupn. The ss command is preferred by first responders because it is part of the iproute2 package and is designed to be faster and more informative than netstat, showing detailed socket information including process IDs and network namespaces. It captures current network connections without altering evidence, as it reads from kernel structures. tcpdump captures packets but may not show current connections and can alter system state by putting interface in promiscuous mode. lsof -i lists open files including network connections but may be slower and less comprehensive. iptables -L lists firewall rules, not current connections.

Answer

tcpdump -i eth0

Answer

lsof -i

Answer

iptables -L

Question 8

You are analyzing a malware sample in a lab. You notice the malware uses the 'CreateRemoteThread' API. What is the objective of this malware activity?

Accepted Answer

Injecting a thread into another process. CreateRemoteThread is a Windows API used to start a thread in the virtual address space of another process. Malware uses it for process injection — typically after allocating memory in the target with VirtualAllocEx and writing shellcode with WriteProcessMemory, it calls CreateRemoteThread to execute the payload inside a legitimate process, evading detection and inheriting that process's privileges.

Answer

Opening a network socket

Answer

Deleting files on disk

Answer

Modifying system time

Question 9

When conducting an interview with a potential witness during an investigation, what is the best practice to follow?

Accepted Answer

Ask open-ended questions to gather facts without bias. Open-ended questions allow witnesses to provide their own account without being steered by the interviewer's assumptions, preserving the integrity and admissibility of the evidence. This approach aligns with forensic interviewing best practices, such as the cognitive interview technique, which emphasizes free recall before specific probing. It reduces the risk of contaminating witness memory and ensures the investigation remains objective.

Answer

Ask leading questions to confirm your suspicions

Answer

Have the witness sign a statement before they start talking

Answer

Record the interview without telling the witness

Question 10

Which THREE of the following should be included in an incident communication plan?

Accepted Answer

Rules for communicating with law enforcement. An incident communication plan must define how the organization interacts with external authorities, so option A (rules for communicating with law enforcement) is correct because it establishes when, how, and through whom law enforcement or regulatory bodies are contacted during a security incident. Option C (pre-approved templates for stakeholder notifications) is correct because having vetted templates for customers, executives, regulators, and media enables fast, consistent, and legally reviewed messaging under time pressure. Option E (emergency contact list for key personnel) is correct because the plan must identify who to reach (incident responders, legal counsel, PR, executives) and how, including after-hours numbers, to activate the response team quickly. Option B (the office building floor plan) is not part of an incident communication plan; it belongs to physical security or evacuation documentation. Option D (the marketing department's social media password) should never be included, since embedding credentials in a plan violates least privilege and secure credential management practices.

Answer

The office building floor plan

Answer

The company's marketing department's social media password

Question 11

An incident responder suspects a server-side request forgery (SSRF) incident against an internal web application that fetches remote images by URL. The application runs in a cloud VPC and can reach the instance metadata service. Which immediate containment action BEST reduces the risk of credential theft while preserving evidence?

Accepted Answer

Block outbound access from the application subnet to the instance metadata IP address 169.254.169.254 and capture the application's outbound traffic. Server-side request forgery that reaches the cloud instance metadata service can yield temporary credentials for the workload's IAM role. The most effective immediate containment is to deny the application's outbound access to the link-local metadata address while capturing traffic for analysis. This stops credential theft without destroying the instance, preserving memory, connections, and logs that are needed to determine whether any credentials were already used.

Answer

Enable verbose debug logging on the web application and wait for the next SSRF attempt

Answer

Immediately terminate the application instances and rebuild them from the base image

Answer

Rotate the TLS certificate used by the web application's public endpoint

Question 12

You are analyzing a Windows malware sample and observe that it creates a new service with an ImagePath pointing to a file in the user's AppData folder. The service is configured with a generic display name resembling a legitimate Windows component. What is the primary purpose of this behavior?

Accepted Answer

To establish persistence so the malware executes automatically at system startup.. Registering a Windows service whose binary resides in a user-writable path such as AppData is a classic persistence technique. Services start automatically at boot and often run under SYSTEM, so the malware survives reboots and gains elevated execution. The use of a legitimate-looking display name is a defense evasion tactic to avoid notice by casual administrators. Recognizing this helps handlers remove the service during eradication.

Answer

To escalate privileges by exploiting a vulnerable driver.

Answer

To encrypt files on the local system for ransomware impact.

Answer

To exfiltrate data to an external command-and-control server.

Question 13

When managing the 'Lessons Learned' phase of the incident response lifecycle, which THREE activities should be conducted to ensure continuous improvement?

Accepted Answer

Reviewing the incident timeline to identify gaps in detection. Option B is correct because reviewing the incident timeline during the Lessons Learned phase reveals where detection, triage, or escalation failed, exposing concrete gaps such as missing SIEM alerts, inadequate log coverage, or delayed analyst response that can be remediated. Option D is correct because a post-incident report formally documents what went right and what went wrong, capturing root cause, response effectiveness, and metrics (e.g., MTTD/MTTR) that drive measurable improvements. Option E is correct because updating SOPs based on identified operational failures translates lessons into durable process changes, ensuring playbooks, runbooks, and escalation paths reflect the corrected procedures. Option A does not belong because a full production penetration test is a proactive security assessment, not a Lessons Learned activity, and it is out of scope for post-incident review. Option C does not belong because retaining evidence for 50 years in cold storage is an arbitrary, excessive retention choice unrelated to continuous improvement, and evidence retention periods should follow legal, regulatory, and policy requirements.

Answer

Conducting a penetration test against the entire production network

Answer

Archiving all evidence in a cold storage bucket for 50 years

Question 14

During a live intrusion, the incident commander must choose a containment strategy. Taking the affected system offline immediately would destroy volatile memory evidence and alert the attacker, while leaving it online risks further data exfiltration. Which approach best balances evidence preservation with damage limitation?

Accepted Answer

Capture volatile memory and network connection data first, then isolate the host while monitoring for attacker reaction.. The correct balance is to collect volatile data first, because RAM and active connections vanish the moment a system is isolated or powered down, and then contain the host while watching for attacker reaction. Immediate shutdown sacrifices irreplaceable evidence, pure monitoring without containment permits ongoing theft, and reformatting destroys everything before scope is known.

Answer

Reformat the system's storage immediately and rebuild it from the original installation media.

Answer

Leave the system fully online and untouched to maximize the intelligence gathered about the attacker's tools.

Answer

Immediately power off the affected system to guarantee the attacker cannot exfiltrate any more data.

Question 15

If a phishing email bypassed the perimeter email gateway, what is the next logical step in the incident response process?

Accepted Answer

Attempt to contain the threat by removing the email. Once a phishing email has bypassed the perimeter gateway, the immediate priority is to prevent further harm by containing the threat. Removing the email from user inboxes (and possibly from the mail server) stops additional users from clicking malicious links or opening attachments, which is the core containment step in incident response. This aligns with the containment phase of the NIST SP 800-61 incident response lifecycle, which follows detection and precedes eradication and recovery.

Answer

Document the incident in the SIEM

Answer

Update the firewall blocklist

Answer

Wait for the user to report it again