212-89 Practice Exam 3 — 20 Questions

Question 1

A user's Windows 10 workstation is suspected of being infected with fileless malware that resides only in memory and executes PowerShell commands. The incident handler needs to capture volatile evidence from the system before it is powered off. Which tool is specifically designed for acquiring a memory dump from a Windows system?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

WinPmem. Fileless malware operates in memory, leaving little to no artifacts on disk. Capturing a memory dump is critical to preserve evidence such as injected code, running processes, and network connections. WinPmem is a dedicated memory acquisition tool for Windows, ensuring a forensically sound capture of volatile data before the system is powered off or rebooted.

Answer

Nmap

Answer

FTK Imager

Answer

Wireshark

Question 2

You are an incident handler assigned to a case involving a suspected insider threat. Before collecting evidence from an employee's workstation, you must ensure your actions are legally defensible and compliant with company policy. Which document should you consult FIRST to determine your authority to search and seize the workstation?

Accepted Answer

The incident response policy and its associated Rules of Engagement (RoE). The incident response policy and its Rules of Engagement establish the legal and procedural boundaries for an investigation. They define who may authorize searches, what actions are permitted, and how evidence must be handled. Consulting this document first ensures that the handler acts within granted authority and avoids actions that could invalidate evidence or expose the organization to liability.

Answer

The organization's Acceptable Use Policy (AUP)

Answer

The IT asset management database

Answer

The data retention and destruction schedule

Question 3

You are establishing an Incident Response Plan (IRP). Which document should prioritize the technical steps for restoring services after a ransomware attack?

Accepted Answer

Playbook. The Incident Response Plan focuses on the procedural steps for handling specific incident types, including recovery.

Answer

Business Continuity Plan

Answer

Communication Plan

Answer

Security Policy

Question 4

During an incident, why is it important to keep the 'Incident Log' updated in real-time?

Accepted Answer

To provide an accurate, chronological record for the final report. A real-time log ensures an accurate, contemporaneous record of actions, which is vital for later analysis and legal defense.

Answer

To keep the team busy

Answer

To allow management to monitor the team's progress

Answer

To comply with IT service desk ticket requirements

Question 5

A security analyst is investigating a suspected data exfiltration incident. The analyst reviews NetFlow records and notices a large outbound data transfer from an internal server to an external IP address over TCP port 53. Which of the following is the MOST likely explanation for this activity?

Accepted Answer

The server is using DNS tunneling to exfiltrate data.. The correct answer is DNS tunneling. A large outbound data transfer over TCP port 53 from an internal server to an external IP is highly suspicious because normal DNS traffic is small and usually UDP-based. Attackers use DNS tunneling to encode stolen data in DNS queries, exploiting the fact that DNS is often allowed through firewalls. This allows them to exfiltrate data stealthily.

Answer

The server is updating its DNS records dynamically.

Answer

The server is querying a large number of DNS records for a legitimate application.

Answer

The server is performing a legitimate DNS zone transfer.

Question 6

When reviewing firewall logs, you see many 'deny' events from an internal host to an external IP. What is the most likely cause?

Accepted Answer

Malware attempting to reach a C2 server. Internal hosts attempting to reach external IPs blocked by the egress policy are a common indicator of a malware beaconing attempt or an infected host trying to reach a C2.

Answer

IP address conflict

Answer

Normal user browsing activity

Answer

Hardware failure on the firewall

Question 7

A company's security team detects that a server is communicating with a known malicious IP address every hour. The traffic is encrypted and small in size. The incident handler suspects a malware infection with a beaconing mechanism. Which type of malware is most likely responsible for this behavior?

Accepted Answer

Remote Access Trojan (RAT). A Remote Access Trojan (RAT) is designed for stealthy, persistent access, often using regular beaconing to a command-and-control server. The small, encrypted, hourly traffic matches this pattern, allowing the attacker to maintain control without attracting attention. Ransomware, worms, and adware have different primary behaviors that do not align with the described stealthy beaconing.

Answer

Ransomware

Answer

Worm

Answer

Adware

Question 8

An incident handler is analyzing a malware sample that appears to be a ransomware variant. The sample encrypts files with a specific extension and drops a ransom note. The handler wants to determine the encryption algorithm used to potentially find weaknesses. Which artifact from the malware analysis is most directly useful to identify the encryption algorithm?

Accepted Answer

Disassembly of the encryption routine. Disassembling the encryption routine provides the most definitive identification of the encryption algorithm by revealing the specific cryptographic functions and constants used. The ransom note, file extension, and strings may offer clues but lack the technical precision required. For ransomware analysis, understanding the algorithm is crucial for potential decryption or identifying implementation flaws.

Answer

The ransom note text file

Answer

The file extension appended to encrypted files

Answer

Strings extracted from the malware binary

Question 9

During a malware incident investigation, you observe a Windows host establishing periodic outbound HTTPS connections to an unknown IP address every 60 seconds, with small, uniform packet sizes. Which two characteristics most strongly indicate this is command-and-control (C2) beaconing rather than legitimate traffic? (Choose two.)

Accepted Answer

The connections occur at regular, fixed intervals with consistent timing.. C2 beaconing is characterized by automated, periodic check-ins with consistent timing and small, uniform payloads. These behavioral patterns reflect the malware's sleep-and-callback logic rather than user-driven traffic. Neither the use of HTTPS, the cloud hosting provider, nor the presence of a valid certificate distinguishes malicious beaconing from legitimate encrypted web traffic, so those characteristics must not be treated as indicators on their own.

Answer

The host has a valid digital certificate for the destination domain.

Answer

The traffic uses HTTPS on port 443 to blend with normal web traffic.

Answer

The destination IP address belongs to a cloud hosting provider.

Question 10

During a malware incident investigation on a Windows 10 workstation, you discover a scheduled task named 'MicrosoftEdgeUpdateTaskMachineCore' that launches 'C:\Users\Public\updater.exe' every 15 minutes. Legitimate Edge update tasks do not execute binaries from the Public profile. Which containment action best preserves volatile evidence while stopping the recurring malicious execution?

Accepted Answer

Disable the scheduled task with 'schtasks /Change /TN "MicrosoftEdgeUpdateTaskMachineCore" /DISABLE', then capture a memory image of the running process. Disabling the malicious scheduled task halts reinfection while leaving the running process and its volatile state intact for memory acquisition, which is the priority during containment of a recurring execution mechanism. Deleting the task, rebooting, or removing the binary destroys evidence and prevents proper root-cause analysis and scoping.

Answer

Delete 'C:\Users\Public\updater.exe' and remove the scheduled task definition from the registry hive offline

Answer

Run 'schtasks /Delete /TN "MicrosoftEdgeUpdateTaskMachineCore" /F' and reboot the workstation to clear the infection

Answer

Quarantine the workstation from the network and leave the scheduled task running so the attacker's behavior can be observed

Question 11

While responding to a confirmed cross-site scripting (XSS) incident on a public web application, you need to determine whether the attacker exfiltrated session cookies. The application uses HTTPS and sets cookies without the HttpOnly flag. Which evidence source is MOST likely to reveal the stolen cookie values?

Accepted Answer

Outbound proxy or firewall logs showing requests to an attacker-controlled domain with cookie data in the URL. When an XSS payload reads a cookie that lacks the HttpOnly attribute and sends it to an external collector, the theft occurs over the network rather than in server-side application logs. Egress proxy or firewall logs capture the destination and full request URL, exposing the attacker-controlled endpoint and the encoded session token. This directly confirms exfiltration and supports containment actions such as blocking the collector domain and invalidating sessions.

Answer

The TLS certificate transparency log for the web application's domain

Answer

The database transaction log for the users table

Answer

The web server's access log entries showing HTTP 200 responses to /login

Question 12

An employee's Windows workstation is suspected of being infected with malware after clicking a link in a spam email. You need to identify which process is making outbound network connections to an external IP address. Which built-in Windows tool should you use to correlate active network connections with their owning processes?

Accepted Answer

netstat -ano. Correlating active network connections to the responsible processes requires a tool that exposes both the connection details and the owning process ID. The netstat -ano command provides numeric addresses, ports, and PIDs, which can then be matched to process names. This built-in utility is a standard first step in live malware investigations on Windows for identifying suspicious outbound communication.

Answer

Performance Monitor

Answer

Task Manager

Answer

Event Viewer

Question 13

A first responder arrives at a workstation where an employee is suspected of exfiltrating data via a USB device. The machine is powered on with a screensaver active. The responder must capture the current physical memory contents for later analysis. Which action should the responder take first?

Accepted Answer

Use a validated hardware-based memory acquisition device that captures RAM without altering the running system.. Capturing physical memory from a live system requires a method that does not significantly alter the system state. A hardware-based acquisition device reads RAM directly, preserving volatile evidence such as running processes and network connections. Other options either destroy memory or introduce changes that compromise the evidence, making them unsuitable for this scenario.

Answer

Perform a hard shutdown by holding the power button, then remove the drive for forensic imaging.

Answer

Document the screen contents with a photograph, then reboot into a forensic Linux distribution to capture memory.

Answer

Press Ctrl+Alt+Delete to unlock the session, then run a memory acquisition tool from a USB drive.

Question 14

During an incident involving a compromised web application, you review an Apache access.log entry that shows a request for /admin/config.php with a response code of 200, but the request originated from an external IP address never seen before. The application is configured to require authentication for that path. Which incident response action is MOST appropriate to determine the scope of the compromise?

Accepted Answer

Correlate the external IP with authentication logs to verify whether a valid session or credential was used.. The key to scoping this incident is determining whether the external request to a protected path was authenticated. Correlating the source IP with authentication logs reveals if a valid session or credential was used, which indicates whether credentials were compromised or an authentication bypass occurred. This directly informs containment and remediation efforts.

Answer

Immediately block the external IP at the firewall and consider the incident contained.

Answer

Review the web server error logs for any 500 errors that occurred around the same time.

Answer

Check the file integrity of config.php to see if it was modified recently.

Question 15

A user reports that Microsoft Word documents on a shared drive are suddenly opening with a prompt to enable macros, and a new file named '~$invoice.docx' appears in the same directory. Analysis shows the macro contains the string 'AutoOpen' and references a remote template URL. Which malware category and delivery technique best describe this incident?

Accepted Answer

Macro-based malware using remote template injection. An AutoOpen macro that references a remote template URL is the hallmark of remote template injection, a document-based malware delivery technique. The macro executes when the document is opened, and the remote template pulls the malicious payload from an external server, evading static detection that only inspects the original file.

Answer

Fileless malware delivered via PowerShell stager

Answer

Ransomware delivered through a malicious PDF reader exploit

Answer

Worm spreading via SMB by copying itself to shared directories

Question 16

A web application is experiencing an incident where attackers are injecting malicious JavaScript into stored user comments. The application reflects the input without proper sanitization. Which mitigation technique, when implemented correctly, is most effective at preventing this type of attack from executing in victims' browsers?

Accepted Answer

Context-aware output encoding. Context-aware output encoding is the most effective mitigation for XSS because it ensures that any user input is rendered as inert text in the appropriate context (HTML, attribute, JavaScript, etc.). This prevents the browser from executing injected scripts. While input validation and WAFs add layers of defense, they are not foolproof and do not address the root cause. HttpOnly protects cookies but not the XSS execution itself.

Answer

Web Application Firewall (WAF) signature blocking

Answer

Input validation using a allowlist of permitted characters

Answer

Setting the HttpOnly flag on session cookies

Question 17

Which documentation is required when transferring physical evidence from a responder to a forensic lab?

Accepted Answer

Chain of Custody form.. The Chain of Custody form is the mandatory documentation that records the chronological sequence of custody, control, transfer, and disposition of physical evidence. When evidence moves from a responder to a forensic lab, the form captures who had it, when, where, and for what purpose, ensuring the evidence's integrity is admissible in legal proceedings.

Answer

User access log.

Answer

Incident summary report.

Answer

Asset inventory list.

Question 18

A financial services firm has activated its incident response plan after detecting unauthorized access to an internal file server. The incident commander must decide which activities belong to the containment phase rather than recovery. (Choose two.)

Accepted Answer

Isolating the affected server from the production network by disabling its switch port.. Containment focuses on stopping the spread and limiting damage while preserving evidence, which isolation of the compromised host and blocking the attacker's command-and-control channels both accomplish. Restoring from backup, patching the exploited vulnerability, and re-enabling user access are recovery or eradication activities that occur only after the threat has been contained and removed from the environment.

Answer

Re-enabling user access to shared drives after verifying file integrity checksums.

Answer

Restoring the file server from the most recent clean backup and returning it to service.

Answer

Applying the vendor security patch that fixes the vulnerability used to gain initial access.

Question 19

During a web application incident, you review logs and find requests containing the string 'UNION SELECT username, password FROM users' in the id parameter. The database server log shows the corresponding query executed successfully and returned rows. Which type of web application attack does this evidence confirm?

Accepted Answer

SQL injection. The presence of SQL syntax in a user-supplied parameter, combined with a database log entry showing that injected statement executed and returned rows, confirms SQL injection. The attacker manipulated the query structure to append a UNION SELECT and retrieve credential data. This evidence supports immediate containment such as blocking the source, reviewing the vulnerable parameter, and assessing what data was exposed.

Answer

Cross-site scripting

Answer

Cross-site request forgery

Answer

Server-side request forgery

Question 20

A web application is under a distributed denial-of-service (DDoS) attack that is overwhelming the server with HTTP requests. As an incident handler, you need to identify the source of the attack and mitigate it. Which TWO log sources are most critical to analyze first to understand the attack pattern and its origin? (Choose two.)

Accepted Answer

Web server access logs. Web server access logs and firewall logs are the most critical for analyzing a DDoS attack. Access logs provide detailed HTTP request data, including source IPs and request patterns, while firewall logs show network-level connection attempts and blocked traffic. Together, they help identify the attack's source and characteristics. Other logs, such as database or OS logs, may show symptoms but not the direct attack traffic.

Answer

Application server error logs

Answer

Operating system event logs

Answer

Database server logs