212-89 Practice Exam 3 — 20 Questions

Question 1

You have identified an infected machine and need to perform a memory dump before it is wiped. Which tool is the industry standard for acquiring a full memory dump on a Windows machine for incident response?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Magnet RAM Capture. Magnet RAM Capture or WinPmem are standard tools for acquiring full memory dumps in a forensic-sound manner.

Answer

Wireshark

Answer

Windows Task Manager

Answer

Event Viewer

Question 2

You suspect a malware incident caused unauthorized data exfiltration. Which log source is most useful to identify the destination IP of the exfiltrated data?

Accepted Answer

Firewall logs. Firewall logs provide a record of all outbound connections and are the most reliable source for identifying destination IP addresses in an exfiltration event.

Answer

Application logs

Answer

Local security policy settings

Answer

System event logs

Question 3

You suspect an incident involves an insider threat. Which step should be taken FIRST to preserve the integrity of the potential evidence while minimizing system downtime?

Accepted Answer

Capture a bit-stream image of the storage media. Creating a forensic image ensures that the current state is preserved before any volatile data is lost or system state changes.

Answer

Change the root password to lock out the attacker

Answer

Delete the suspicious user account

Answer

Reboot the compromised system to clear malicious memory

Question 4

You are analyzing a malware sample that uses Domain Generation Algorithms (DGA). What is the primary purpose of DGA in malware?

Accepted Answer

Evading static C2 blocklists. DGA is used to generate a large number of domain names daily, making it difficult for defenders to block the command-and-control server effectively.

Answer

Spreading via local network shares

Answer

Encrypting the malware payload

Answer

Hiding processes from Task Manager

Question 5

You are dealing with a legal hold request for data related to an investigation. How should you handle the data retention policy for this specific case?

Accepted Answer

Suspend the automatic deletion for the affected data. A legal hold overrides existing retention policies, preventing the automatic deletion of relevant data.

Answer

Export the data to a public cloud storage service

Answer

Follow the standard 90-day retention policy

Answer

Delete the data and generate an audit log

Question 6

Which TWO of the following are essential components of an effective Incident Communication Plan?

Accepted Answer

A list of internal and external stakeholder contact details. An effective communication plan must include defined points of contact (who to talk to) and escalation triggers (when to notify them).

Answer

A standard template for forensic report generation

Answer

A list of firewall rules for blocking malicious IPs

Answer

Scripts for resetting user passwords

Question 7

An incident handler is reviewing an alert from the Endpoint Detection and Response (EDR) system. What is the main goal of the 'Containment' phase?

Accepted Answer

To limit the scope and damage of the incident. The primary goal of containment is to stop the spread of the attack and prevent further damage.

Answer

To identify the attacker

Answer

To analyze the root cause

Answer

To recover normal operations

Question 8

During an incident, why is it important to keep the 'Incident Log' updated in real-time?

Accepted Answer

To provide an accurate, chronological record for the final report. A real-time log ensures an accurate, contemporaneous record of actions, which is vital for later analysis and legal defense.

Answer

To keep the team busy

Answer

To allow management to monitor the team's progress

Answer

To comply with IT service desk ticket requirements

Question 9

You are reviewing a failed incident case management report. The team failed to capture the 'Time of Detection' vs. 'Time of Occurrence'. Which metric is directly impacted by this lack of documentation?

Accepted Answer

Mean Time to Detect (MTTD). Mean Time to Detect (MTTD) is calculated by the difference between the actual occurrence and the detection time; failing to record these makes the metric impossible to compute.

Answer

False Positive Rate

Answer

Mean Time to Contain (MTTC)

Answer

Mean Time to Recover (MTTR)

Question 10

You are choosing a destination for forensic image storage. What is the most critical characteristic of this storage?

Accepted Answer

Write-protection and tamper-evident logging. The storage must be write-blocked or read-only once data is written to ensure the evidence cannot be altered.

Answer

Fast read/write speeds

Answer

Cloud-based accessibility

Answer

High storage capacity

Question 11

Which THREE of the following are legal considerations when handling an incident?

Accepted Answer

Compliance with regional data breach notification laws. Data privacy, regulatory reporting, and evidence admissibility are critical legal areas.

Answer

The cost of upgrading the company's hardware

Answer

The speed of the internet connection used for analysis

Question 12

While investigating a server compromise, you need to ensure the digital evidence collected from the RAID array is admissible in court. What is the most critical requirement for the chain of custody?

Accepted Answer

Maintaining a detailed log of every individual who accessed or transferred the evidence. Chain of custody requires a chronological log of who handled the evidence, where it was stored, and proof that it was not altered, typically via cryptographic hashes.

Answer

Deleting temporary files to prevent cross-contamination

Answer

Encrypting the collected evidence folder with AES-256

Answer

Creating a bit-stream image of the disk drive

Question 13

You are reviewing logs from an EDR and see an indicator of 'Living off the Land' (LotL). Which tool usage would be considered an LotL attack?

Accepted Answer

Executing encoded PowerShell scripts. Using 'PowerShell.exe' to execute base64-encoded scripts directly from memory is a quintessential LotL technique.

Answer

Running a commercial vulnerability scanner

Answer

Installing a custom rootkit driver

Answer

Downloading an EXE from an unknown site

Question 14

You have identified a malicious DLL that is being loaded by a legitimate process. Which tool allows you to view which DLLs are loaded by a specific process?

Accepted Answer

Process Explorer. Process Explorer's lower pane (when configured for DLLs) provides a clear list of all loaded modules/DLLs for any selected process.

Answer

Task Scheduler

Answer

Disk Cleanup

Answer

Device Manager

Question 15

Which TWO of the following are considered 'Legal Considerations' during the Incident Handling process that must be integrated into the response plan?

Accepted Answer

Ensuring compliance with data breach notification statutes. Legal considerations include adhering to privacy regulations (e.g., reporting requirements) and maintaining the integrity of the evidence for potential litigation.

Answer

Configuring automated IP blocking on the edge firewall

Answer

Updating the organizational server maintenance schedule

Answer

Running a vulnerability scan on the impacted systems

Question 16

Which document is essential to maintain during a malware incident to ensure accountability and track the actions taken by the incident response team?

Accepted Answer

Incident Log. An Incident Log (or Chain of Custody record) is critical for documenting every step, tool, and decision made during the response process.

Answer

User Manual

Answer

System Backup

Answer

Vulnerability Assessment Report

Question 17

You are using YARA to detect a specific strain of ransomware. You want to match a file if it contains a specific hex string OR a specific string value. How do you construct this in your rule?

Accepted Answer

condition: $a or $b. YARA uses the 'or' operator within the condition section to evaluate multiple criteria, allowing a match if either condition is met.

Answer

condition: $a + $b

Answer

condition: $a != $b

Answer

condition: $a && $b

Question 18

After eradicating a malware infection, you need to ensure the system is hardened against future occurrences. Which action is most effective against fileless malware?

Accepted Answer

Implement PowerShell Constrained Language Mode. Disabling PowerShell for non-administrative users or implementing Constrained Language Mode is a key defense against fileless script-based attacks.

Answer

Enable auto-updates for all applications

Answer

Install an extra antivirus

Answer

Enable full disk encryption

Question 19

Which THREE of the following tools would be most effective for performing live memory forensics on a compromised Windows workstation?

Accepted Answer

WinPmem. Volatility, WinPmem, and Magnet RAM Capture are all specialized tools for volatile memory acquisition and analysis.

Answer

CCleaner

Answer

Windows Update

Question 20

Which TWO of the following are common signs of a compromised switch in a local area network?

Accepted Answer

Unrecognized trunk ports enabled. MAC flooding and unauthorized trunking are common signs of layer 2 switch compromise.

Answer

Normal spanning-tree convergence

Answer

Decreased CPU usage on the switch

Answer

Stable port security status