212-89 Practice Exam 1 — 20 Questions

Question 1

You suspect a CSRF (Cross-Site Request Forgery) attack. What log entry pattern confirms this?

Accepted Answer

Referer header showing a domain different from the application's domain. CSRF attacks originate from a different site. Checking the 'Referer' header in the logs for unexpected domains is the primary method for detection.

Answer

Multiple POST requests without a corresponding GET request

Answer

High volume of 401 Unauthorized errors

Answer

A sudden change in the session cookie value

Question 2

After a major security breach, you are tasked with conducting a lessons learned meeting. Which of the following is the PRIMARY objective of this meeting?

Accepted Answer

To identify improvements to the incident response process and prevent recurrence.. The primary objective of a lessons learned meeting is to identify improvements to the incident response process and prevent recurrence. It is a constructive review that focuses on what happened, why, and how to enhance future response. Blame, cost calculation, or immediate plan updates are secondary or separate activities.

Answer

To immediately update the incident response plan with new technical controls.

Answer

To assign blame to the individuals responsible for the breach.

Answer

To determine the exact financial cost of the incident.

Question 3

A security analyst notices that an internal web server is receiving a large number of HTTP requests with unusually long and complex query strings, causing the server's CPU usage to spike. The requests appear to be targeting a search function. Which type of network incident is most likely occurring?

Accepted Answer

HTTP flood. The scenario describes a high volume of HTTP requests with complex query strings targeting a search function, leading to CPU exhaustion. This matches an HTTP flood, a layer 7 denial-of-service attack that exploits resource-intensive operations. Other attacks like XSS, SQL injection, or directory traversal do not primarily cause CPU spikes through such requests.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Question 4

You suspect a DNS tunneling attack for data exfiltration. In your DNS server logs, which characteristic is the strongest indicator of a tunnel rather than standard recursive lookups?

Accepted Answer

Unusually long, high-entropy subdomains. DNS tunneling encodes data in the subdomain portion of DNS queries, and because DNS labels are limited to 63 characters, attackers pack them with long, random-looking (high-entropy) strings to maximize data throughput. Standard recursive lookups use short, human-readable domain names, so unusually long, high-entropy subdomains are the strongest indicator of a tunnel. Tools like iodine and dnscat2 produce exactly this pattern.

Answer

High volume of A records

Answer

Requests for PTR records

Answer

Queries to root hints

Question 5

An incident handler is documenting the timeline of a security breach. The handler discovers that system clocks on different servers are not synchronized. Which action should the handler take to ensure the timeline is accurate and defensible?

Accepted Answer

Normalize all timestamps to a common time zone and document the clock offsets.. When system clocks are unsynchronized, the handler must account for offsets and normalize timestamps to a common reference, such as UTC, while documenting each system's deviation. This preserves the integrity of the original evidence and enables accurate correlation. Excluding data, trusting one clock, or reconfiguring systems during the investigation are all inappropriate and can compromise the timeline's defensibility.

Answer

Reconfigure all servers to use a network time protocol server and restart them.

Answer

Exclude timestamps from servers with unsynchronized clocks to avoid confusion.

Answer

Use the timestamps from the server with the most reliable clock as the single source of truth.

Question 6

You are using YARA to detect a specific strain of ransomware. You want to match a file if it contains a specific hex string OR a specific string value. How do you construct this in your rule?

Accepted Answer

condition: $a or $b. YARA uses the 'or' operator within the condition section to evaluate multiple criteria, allowing a match if either condition is met.

Answer

condition: $a + $b

Answer

condition: $a != $b

Answer

condition: $a && $b

Question 7

You are analyzing an incident where a user account is being used to exfiltrate data. What is the most immediate action to contain the account?

Accepted Answer

Reset the user password and invalidate active sessions.. Resetting the password and invalidating active sessions immediately cuts off the attacker's access while preserving the account and its data for forensic investigation. This contains the incident without destroying evidence, and it revokes any stolen session tokens or cookies the attacker may be using. It is the standard first containment step for a compromised account.

Answer

Delete the user account.

Answer

Delete the user's home directory.

Answer

Lock the user's computer.

Question 8

Which role in the Incident Response Team is primarily responsible for ensuring that the incident handling activities remain aligned with organizational legal and privacy requirements?

Accepted Answer

Legal Counsel. The legal counsel or representative ensures that all actions taken during an incident are compliant with applicable laws.

Answer

Technical Investigator

Answer

Incident Lead

Answer

Communications Officer

Question 9

You are handling a malware incident on a Windows server and need to determine whether the malware has established persistence. Which two registry locations should you inspect first because they are the most common autostart points used by malware? (Choose two.)

Accepted Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. The HKLM and HKCU Run keys are the most commonly abused registry autostart locations because they execute code at logon for all users or the current user respectively, require minimal effort to modify, and are widely used by commodity and targeted malware alike. Inspecting both ensures coverage of system-wide and per-user persistence.

Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

Answer

HKEY_CLASSES_ROOT\Installer\Products

Question 10

Which THREE components are typically involved in a web application's logging infrastructure that an incident responder should audit?

Accepted Answer

Web server access and error logs. Option A (Web server access and error logs) is correct because these logs record every HTTP request, response code, source IP, and server-side errors, which are essential for reconstructing how an attacker interacted with the web application. Option B (WAF audit logs) is correct because a Web Application Firewall logs blocked, allowed, and flagged requests, revealing attempted exploits such as SQL injection or XSS that may not appear in normal server logs. Option D (Application-level audit logs) is correct because they capture business-logic events like authentication, authorization changes, and user actions, providing the internal context that infrastructure logs lack. Option C (Printer spooler logs) is not relevant since print services are unrelated to web application request handling or attack surfaces. Option E (Hardware router logs) is not part of the web application's logging infrastructure, as routers operate at the network layer and do not record application-level activity.

Answer

Printer spooler logs

Answer

Hardware router logs

Question 11

A malware incident has been identified on a corporate workstation. The incident response team is following the containment, eradication, and recovery phases. Which TWO of the following actions are considered part of the eradication phase? (Choose two.)

Accepted Answer

Applying security patches to the operating system. Eradication involves removing the malware and its components from the infected system. Deleting malicious files and registry keys eliminates the malware's presence and persistence. Applying security patches addresses the vulnerability that allowed the infection, preventing future occurrences. Containment (disconnecting from network) and recovery (restoring from backup, monitoring) are separate phases.

Answer

Monitoring network traffic for signs of re-infection

Answer

Restoring the system from a known good backup

Answer

Disconnecting the infected workstation from the network

Question 12

You are the first responder to a Linux server that is suspected of being compromised. You need to collect volatile data in the order of volatility. Which command should you run first to capture the most volatile data?

Accepted Answer

netstat -antp. The order of volatility guides first responders to collect the most perishable data first. Network connections are extremely volatile and can be lost within seconds if an attacker disconnects or a timeout occurs. Capturing them with netstat -antp provides immediate insight into active sessions and listening services. Process lists and disk logs, while important, are less volatile and can be collected subsequently without as much risk of loss.

Answer

cat /var/log/auth.log

Answer

df -h

Answer

ps aux

Question 13

Which THREE of the following characterize potential lateral movement using RDP in a domain environment?

Accepted Answer

Unusual use of NTLM for RDP authentication. Option A is correct because in a domain environment RDP authentication normally uses Kerberos, so a shift to NTLM for RDP (e.g., via Restricted Admin mode or credential-based attacks) is a strong indicator of lateral movement attempts. Option D is correct because mstsc.exe is the native RDP client, and its use with unusual flags (such as /admin, /restrictedAdmin, or /v to non-standard hosts) can signal an attacker pivoting between systems. Option E is correct because RDP logins originating from workstations to servers are atypical in most domain environments, where administrative RDP typically flows from jump hosts or management stations, making such connections a hallmark of lateral movement. Option B is incorrect because SNMP is a network management protocol unrelated to RDP session behavior. Option C is incorrect because HTTPS traffic is encrypted web traffic and does not characterize RDP-based lateral movement.

Answer

Increased usage of SNMP

Answer

High volume of HTTPS traffic

Question 14

Which TWO actions are recommended for evidence preservation in a digital incident?

Accepted Answer

Calculate cryptographic hashes for all collected files.. Hashing ensures integrity, and chain of custody ensures legal admissibility.

Answer

Reboot the system to clear temporary files.

Answer

Modify file permissions to prevent further access.

Answer

Delete all temporary logs to save space.

Question 15

During an incident response engagement, a first responder is collecting volatile data from a compromised Windows server. The responder needs to capture the current network connections, including the process ID associated with each connection, without installing any third-party tools. Which native Windows command should the responder use?

Accepted Answer

netstat -ano. The netstat -ano command is a native Windows utility that lists all active network connections and listening ports along with the owning process ID. This allows a first responder to quickly identify which process is associated with a suspicious connection, enabling immediate containment or further analysis without introducing third-party tools that could alter the system.

Answer

net session

Answer

tasklist /svc

Answer

ipconfig /displaydns

Question 16

You are dealing with a legal hold request for data related to an investigation. How should you handle the data retention policy for this specific case?

Accepted Answer

Suspend the automatic deletion for the affected data. A legal hold overrides existing retention policies, preventing the automatic deletion of relevant data.

Answer

Export the data to a public cloud storage service

Answer

Follow the standard 90-day retention policy

Answer

Delete the data and generate an audit log

Question 17

Which THREE of the following are common indicators of a phishing email?

Accepted Answer

Urgent or threatening language requiring immediate action. Option A is correct because phishing emails frequently use urgent or threatening language, such as warnings of account suspension or legal action, to pressure recipients into acting quickly without verifying the message. Option B is correct because a mismatch between the display name and the actual sender address is a classic spoofing indicator, since attackers often set a trusted-looking display name while the underlying SMTP From or Return-Path domain is different. Option D is correct because when the visible URL text differs from the actual hyperlink target (for example, displayed as https://bank.example.com but linking to http://malicious.example.net), it indicates an attempt to deceive the recipient about the destination. Option C is not a reliable indicator, because legitimate emails commonly use standard corporate branding and attackers can easily replicate logos and templates. Option E is not a reliable indicator, since phishing messages can be sent at any time, including during business hours, and timing alone does not indicate malicious intent.

Answer

The email uses standard corporate branding

Answer

The email is sent during business hours

Question 18

An incident handler is reviewing a suspicious executable found on a compromised Windows system. The file has a double extension, such as 'invoice.pdf.exe'. Which type of malware delivery technique is this most likely an example of?

Accepted Answer

Masquerading. Masquerading is the technique of making a malicious file appear benign, such as using a double extension to disguise an executable as a PDF. This exploits hidden file extensions in Windows to trick users. Phishing is a delivery vector, social engineering is a broader category, and rootkits are a different type of malware. The double extension is a direct example of masquerading.

Answer

Social engineering

Answer

Rootkit

Answer

Phishing

Question 19

You are investigating a compromised Linux host. Using 'tcpdump' to capture traffic on interface eth0 to analyze C2 communication on port 443, which command is most efficient for saving the output to a file for later analysis in Wireshark?

Accepted Answer

tcpdump -i eth0 port 443 -w capture.pcap. The -w flag is used in tcpdump to write raw packets to a .pcap file.

Answer

tcpdump -c eth0 port 443

Answer

tcpdump -i eth0 port 443 > capture.txt

Answer

tcpdump -r capture.pcap port 443

Question 20

Which THREE of the following are key components of a network-based containment strategy?

Accepted Answer

Isolation of the compromised segment from the rest of the network. Option A is correct because isolating the compromised network segment (for example, by moving it to a quarantine VLAN or applying ACLs on the switch/router) prevents lateral movement of the attacker to other hosts while containment is underway. Option B is correct because forcibly terminating active sessions (resetting TCP connections, killing authenticated sessions, or invalidating tokens) cuts off the attacker's existing foothold and command-and-control channels. Option C is correct because egress filtering at the perimeter blocks outbound traffic to known malicious IPs/domains, stopping data exfiltration and C2 callbacks, which is a core part of containing a network-based incident. Option D is not a containment measure; extending DHCP lease times only affects address assignment duration and does nothing to stop an active intrusion. Option E is not a containment action either, since wholesale hardware replacement is a costly remediation/recovery step, not a strategy for limiting the spread of an ongoing network-based attack.

Answer

Increasing the DHCP lease time

Answer

Installing new hardware across the network