212-89 Practice Exam 2 — 20 Questions

Question 1

Which tool would you use to perform a live analysis of HTTP traffic and inspect for malicious payloads in real-time?

Accepted Answer

Wireshark. Wireshark is a protocol analyzer that captures and decodes live network traffic, allowing real-time inspection of HTTP requests and responses, including payload contents, headers, and body data. It can reassemble TCP streams and apply display filters (e.g., http.request) to isolate malicious payloads as they traverse the wire. This makes it the correct tool for live HTTP traffic analysis.

Answer

Nmap

Answer

Netstat

Answer

Syslog

Question 2

During an investigation into lateral movement, you notice an unusual RDP connection from a workstation to a domain controller. Which Wireshark filter would be most effective in isolating only the RDP traffic associated with that specific source IP to identify potential credential dumping activity?

Accepted Answer

tcp.port == 3389 && ip.src == 192.168.1.50. The filter 'tcp.port == 3389 && ip.src == 192.168.1.50' is correct because RDP operates over TCP port 3389, and the ip.src clause restricts capture to traffic originating from the specific workstation under investigation. This isolates the RDP session from that source to the domain controller, allowing the analyst to inspect the session for credential dumping artifacts or unusual keystroke patterns.

Answer

tcp.flags.syn == 1 && ip.src == 192.168.1.50

Answer

data.data == 3389

Answer

rdp.data && ip.dst == 192.168.1.50

Question 3

A web application is vulnerable to session fixation. What is the primary indicator of this attack in the logs?

Accepted Answer

A user session ID remains identical before and after a successful authentication event. Session fixation occurs when an attacker sets or knows a victim's session ID before authentication and the application fails to regenerate that ID after login. The primary log indicator is therefore a session ID that remains identical before and after a successful authentication event. This persistence of the pre-authentication session identifier is the defining signature of the vulnerability being exploited.

Answer

High volume of requests to the login page without POST data

Answer

The same session ID is associated with two different IP addresses within a short timeframe

Answer

A sudden spike in failed login attempts

Question 4

A web application is returning verbose error messages that include full stack traces and database query fragments to users. An attacker is using these messages to map the application's internal structure. Which remediation step should the incident handler recommend to the development team?

Accepted Answer

Configure the application to return generic error messages to users while logging detailed errors server-side.. Verbose error messages leak internal implementation details that aid attackers in mapping the application and crafting further attacks. The correct remediation is to return generic messages to users while retaining detailed error logging on the server for troubleshooting and forensic purposes. Disabling logging, enabling more verbose output, or migrating servers do not resolve the information disclosure.

Answer

Enable detailed error logging on the production server to capture more information about failures.

Answer

Disable all error logging to prevent attackers from accessing log files through the web server.

Answer

Move the application to a different server with a newer operating system to eliminate the errors.

Question 5

You suspect an incident involves an insider threat. Which step should be taken FIRST to preserve the integrity of the potential evidence while minimizing system downtime?

Accepted Answer

Capture a bit-stream image of the storage media. Creating a forensic image ensures that the current state is preserved before any volatile data is lost or system state changes.

Answer

Change the root password to lock out the attacker

Answer

Delete the suspicious user account

Answer

Reboot the compromised system to clear malicious memory

Question 6

Which THREE of the following tools would be most effective for performing live memory forensics on a compromised Windows workstation?

Accepted Answer

WinPmem. WinPmem (B) is a purpose-built, open-source memory acquisition driver for Windows that captures physical RAM to a raw image while preserving volatile evidence such as running processes, network connections, and injected code. Magnet RAM Capture (C) is a free forensic acquisition tool from Magnet Forensics that dumps physical memory on Windows systems into a .raw/.mem image suitable for later analysis. Volatility 3 (E) is the leading memory forensics framework that parses those acquired images to extract processes, handles, DLLs, registry hives, and malware artifacts, making it essential for the analysis phase of live memory forensics. CCleaner (A) is a system-cleaning utility that deletes temporary files and traces, which would destroy volatile evidence rather than preserve it. Windows Update (D) is a patching service with no forensic acquisition or analysis capability and is irrelevant to memory forensics.

Answer

CCleaner

Answer

Windows Update

Question 7

Which THREE pieces of information should be included in an incident triage report?

Accepted Answer

The date and time of the incident discovery.. Option A is correct because recording the date and time of incident discovery establishes the timeline anchor needed for triage prioritization, SLA tracking, and later forensic reconstruction of the event sequence. Option C is correct because identifying the systems and services impacted scopes the incident, enabling responders to determine business impact, prioritize containment, and decide whether escalation or isolation is required. Option D is correct because initial findings or indicators of compromise (IOCs) such as suspicious IP addresses, file hashes, or anomalous log entries give the triage team the technical evidence needed to classify the incident and guide the immediate response. Option B is not appropriate because private health records are sensitive PII/PHI that are irrelevant to triage and would introduce unnecessary privacy and compliance risk. Option E is not appropriate because a list of employees with building access is unrelated to the technical and operational facts needed to triage a security incident.

Answer

The private health records of the affected users.

Answer

The names of all employees who have access to the building.

Question 8

During a web application incident, an analyst discovers that an attacker is using SQL injection to extract data from a backend database. Which SQL injection technique involves the attacker inferring data by asking the database true/false questions and observing the application's response?

Accepted Answer

Blind SQL injection (boolean-based). Blind SQL injection (boolean-based) is characterized by the attacker asking the database true/false questions and observing changes in the application's behavior, such as different content or status codes. This technique is used when the application does not return direct query results or errors. The attacker can then systematically extract data by testing conditions.

Answer

Time-based SQL injection

Answer

Error-based SQL injection

Answer

Union-based SQL injection

Question 9

An employee receives a suspicious email asking to verify account details by clicking a link. What is the most effective user behavior to mitigate this?

Accepted Answer

Use the organization's 'Report Phishing' tool. Reporting the suspicious email through the provided 'Report Phishing' button is the most effective user action.

Answer

Reply to the sender to verify

Answer

Ignore and delete the email without reporting

Answer

Forward it to a friend for a second opinion

Question 10

You are choosing a destination for forensic image storage. What is the most critical characteristic of this storage?

Accepted Answer

Write-protection and tamper-evident logging. The storage must be write-blocked or read-only once data is written to ensure the evidence cannot be altered.

Answer

Fast read/write speeds

Answer

Cloud-based accessibility

Answer

High storage capacity

Question 11

During the lessons learned phase of a P1 incident, you notice that the incident handling policy failed to define clear 'Rules of Engagement' for containment, leading to accidental service disruption. Which document should be updated to address this deficiency?

Accepted Answer

The Incident Response Plan (IRP). The Incident Response Plan (IRP) contains the specific procedures and rules for containment, and it must be updated to prevent future operational failures.

Answer

The Corporate Acceptable Use Policy

Answer

The Network Topology Map

Answer

The Business Continuity Plan (BCP)

Question 12

An organization's CSIRT is activated for a suspected ransomware outbreak. The incident handler must decide whether to escalate the incident to management. According to the incident handling process, which factor is the MOST appropriate trigger for immediate escalation?

Accepted Answer

The incident affects a critical business system and has the potential to disrupt operations.. Escalation criteria in incident handling are based on business impact, scope, and urgency. A ransomware outbreak affecting a critical system with potential operational disruption clearly meets the threshold for immediate management notification. Technical details such as malware family or ticket status are secondary; the handler must focus on the potential harm to the organization and the need for management decisions.

Answer

The handler has completed the initial triage checklist.

Answer

The malware sample has been identified as a known ransomware family.

Answer

The incident has been assigned a ticket number in the incident tracking system.

Question 13

During a malware analysis, which TWO of the following indicators are typically used to identify persistence mechanisms in the Windows registry?

Accepted Answer

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services. Option C is correct because the HKLM\System\CurrentControlSet\Services key stores configuration for Windows services, including the ImagePath and Start values that malware commonly abuses to register a malicious service (for example, a kernel driver or auto-start service) so it launches at boot. Option E is correct because the HKLM\Software\Microsoft\Windows\CurrentVersion\Run key is a classic autostart location where entries execute programs at user logon, making it a primary persistence mechanism for malware. Option A is not a persistence indicator per se; HKCR\CLSID holds COM class registration data, which can be abused for hijacking but is not a standard auto-start persistence key. Option B is not a persistence mechanism; the Control Panel\Desktop key stores user interface settings such as wallpaper and screen saver configuration. Option D is not a persistence mechanism; MountPoints2 records per-user mounted volume information and is more relevant to forensic artifact tracking than to autostart persistence.

Answer

HKEY_CLASSES_ROOT\CLSID

Answer

HKEY_CURRENT_USER\Control Panel\Desktop

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Question 14

Which TWO of the following are common signs of a compromised switch in a local area network?

Accepted Answer

Unrecognized trunk ports enabled. Option A is correct because an unrecognized or unauthorized trunk port enabled on a switch is a classic indicator of compromise—attackers configure trunk links (e.g., 802.1Q) to carry traffic for multiple VLANs and perform VLAN hopping or intercept traffic that should remain segmented. Option D is correct because unexpected MAC address table growth indicates MAC flooding, where an attacker overwhelms the switch's CAM table with spoofed source MACs, forcing it into fail-open hub behavior so traffic is flooded to all ports for sniffing. The unmarked options do not belong: normal spanning-tree convergence (B) is expected healthy behavior, decreased CPU usage (C) is not a compromise sign (attacks typically raise CPU load), and a stable port security status (E) reflects normal, secure operation rather than an indicator of compromise.

Answer

Normal spanning-tree convergence

Answer

Decreased CPU usage on the switch

Answer

Stable port security status

Question 15

A security team is reviewing their incident handling process after a recent data breach. They want to ensure that their eradication phase is effective. Which TWO activities are essential during the eradication phase? (Choose two.)

Accepted Answer

Applying security patches to vulnerable systems. Eradication involves removing the threat and its root cause. Deleting malicious files eliminates the immediate malware, while applying patches closes the vulnerability that was exploited. These actions ensure the threat is fully removed and cannot easily recur. Other options are containment or recovery activities.

Answer

Blocking the attacker's IP address at the firewall

Answer

Restoring data from backups

Answer

Conducting a lessons learned meeting

Question 16

A user reports their Windows 10 workstation is running very slowly and displaying unexpected pop-up ads in the browser. The incident handler suspects an adware infection. After isolating the machine, which Windows tool should the handler use to identify the malicious process consuming CPU and its associated network connections?

Accepted Answer

Resource Monitor. Resource Monitor offers a granular view of per-process resource utilization and network activity, enabling the handler to pinpoint the adware process causing high CPU usage and pop-ups. It shows which process is making network connections, which is critical for understanding the adware's behavior. Task Manager lacks network details, Event Viewer lacks real-time process data, and Performance Monitor is not designed for quick per-process network correlation.

Answer

Task Manager

Answer

Performance Monitor

Answer

Event Viewer

Question 17

During a malware incident on a Windows 10 workstation, you observe that a scheduled task named "UpdaterSvc" executes a binary in C:\Users\Public\svchost.exe every 15 minutes and re-creates its own registry Run key if deleted. The user reports the malware reappears after each cleanup. Which containment action BEST addresses this persistence while preserving forensic evidence?

Accepted Answer

Disconnect the workstation from the network, capture a memory image, then delete the scheduled task and quarantine the binary.. Effective containment for self-healing malware requires isolating the host to stop external communication and preserving volatile evidence before making changes. Capturing memory first retains injected code and process artifacts, then removing the scheduled task and quarantining the binary eliminates the persistence that re-creates the Run key, preventing reinfection after cleanup.

Answer

Run a full antivirus scan on the workstation while it remains connected so the vendor cloud can identify the malware family.

Answer

Immediately reimage the workstation without collecting volatile data, because the malware will otherwise return.

Answer

Disable the user account, delete the C:\Users\Public\svchost.exe file, and reboot the workstation to clear the infection.

Question 18

During a malware incident, you observe that a compromised system is communicating with a known command-and-control (C2) server at 203.0.113.45 over TCP port 443. You need to block this communication at the network perimeter to prevent further data exfiltration. Which action should you take?

Accepted Answer

Create an outbound firewall rule to block traffic to 203.0.113.45 on port 443. The compromised system initiates outbound connections to the C2 server, so blocking outbound traffic to that specific IP and port is the most effective way to sever communication. This action prevents data exfiltration and further instructions from the attacker. It is targeted and minimizes disruption to legitimate traffic.

Answer

Add a static route to null0 for 203.0.113.45 on the internal router

Answer

Enable deep packet inspection (DPI) to block all HTTPS traffic

Answer

Create an inbound firewall rule to block traffic from 203.0.113.45

Question 19

What is the 'First Responder Toolkit' used for during an incident?

Accepted Answer

To collect forensic artifacts without modifying the target system.. A first responder toolkit provides pre-configured, trusted tools for incident triage and data collection.

Answer

To install new security software.

Answer

To permanently delete malicious files.

Answer

To provide remote access for the attacker.

Question 20

Which TWO criteria must a first responder satisfy when choosing a tool for a toolkit?

Accepted Answer

The tool must be known to have minimal impact on the target system.. Tools must be trusted and cause minimal impact on the subject system.

Answer

The tool must run on a cloud-based server.

Answer

The tool must be proprietary and expensive.

Answer

The tool must be able to delete the malware.