212-89 Practice Exam 4 — 20 Questions

Question 1

A system has been infected by a worm that is spreading across the network. What is the most immediate action to stop the spread?

Accepted Answer

Block propagation ports at the network level. Isolating the affected segments or blocking the ports used for the worm's propagation (e.g., SMB/445) is essential to stop lateral movement.

Answer

Update the BIOS on all machines

Answer

Disable the internet gateway

Answer

Email all users to reboot

Question 2

Which THREE of the following represent critical log sources that should be correlated when investigating a potential network-based exfiltration incident?

Accepted Answer

DNS query logs for destination domain lookup. Firewall logs, NetFlow, and DNS logs provide the full picture of an outbound exfiltration event.

Answer

NTP server logs

Answer

Print server logs

Question 3

During the 'Recovery' phase of the malware incident, what must be done to ensure the environment is safe before reconnecting the restored systems?

Accepted Answer

Perform a vulnerability scan. Vulnerability scanning confirms that the original entry points or vulnerabilities used by the malware have been patched or mitigated.

Answer

Delete all user profiles

Answer

Upgrade the OS to the latest version

Answer

Reformat all external hard drives

Question 4

Which THREE of the following indicators are found in email-based malware delivery?

Accepted Answer

Hidden links pointing to malicious domains. Malicious emails often contain suspicious attachments, unexpected links (URLs) leading to malicious sites, and deceptive sender addresses to trick users.

Answer

The email has a standard company footer

Answer

The email was sent during business hours

Question 5

During a malware analysis, which TWO of the following indicators are typically used to identify persistence mechanisms in the Windows registry?

Accepted Answer

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services. The 'Run' keys and 'Services' keys are the most common locations malware uses to ensure automatic execution upon boot.

Answer

HKEY_CLASSES_ROOT\CLSID

Answer

HKEY_CURRENT_USER\Control Panel\Desktop

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Question 6

You are investigating a compromised Linux host. Using 'tcpdump' to capture traffic on interface eth0 to analyze C2 communication on port 443, which command is most efficient for saving the output to a file for later analysis in Wireshark?

Accepted Answer

tcpdump -i eth0 port 443 -w capture.pcap. The -w flag is used in tcpdump to write raw packets to a .pcap file.

Answer

tcpdump -c eth0 port 443

Answer

tcpdump -i eth0 port 443 > capture.txt

Answer

tcpdump -r capture.pcap port 443

Question 7

Which TWO of the following techniques would an attacker likely use to hide lateral movement traffic within a network?

Accepted Answer

Masquerading malicious traffic on common ports like 443. Encrypted tunnels (SSH/TLS) and protocol masquerading are the primary ways to hide lateral movement.

Answer

Using clear-text Telnet for all communication

Answer

Sending traffic exclusively during business hours

Answer

Disabling all logging on the source host

Question 8

An attacker is using a slow-rate HTTP POST request to exhaust server resources. Which ModSecurity directive should be adjusted to mitigate this behavior?

Accepted Answer

SecRequestBodyLimit. ModSecurity's 'SecRequestBodyLimit' and 'SecRequestBodyNoFilesLimit' manage the size and rate of incoming request bodies.

Answer

SecDataDir

Answer

SecRuleEngine DetectionOnly

Answer

SecResponseBodyLimit

Question 9

A web server log shows repeated '403 Forbidden' errors for a specific directory. What is the most likely cause during an incident?

Accepted Answer

Directory traversal or unauthorized access attempts are being blocked. Repeated 403 errors often indicate an attacker performing forced browsing or directory traversal attempts that are being blocked by server-side permission settings.

Answer

The user session has expired

Answer

The requested file does not exist

Answer

The server is offline

Question 10

Which TWO of the following activities are considered 'Eradication' steps in the incident response lifecycle?

Accepted Answer

Re-imaging infected workstations. Eradication involves removing the malicious components and restoring clean systems to normal operations.

Answer

Writing an incident report

Answer

Conducting a post-incident meeting

Answer

Notifying the news media

Question 11

You are performing log correlation in a SIEM. You want to match Windows Event ID 4624 (Logon) with network traffic. Which field is the primary 'join key' to correlate the event with a specific network flow?

Accepted Answer

Source IP Address. Source IP address is the common attribute between a Windows logon log and a network flow record.

Answer

Target Username

Answer

Process Name

Answer

Event Correlation ID

Question 12

Which technique should an incident responder use to prevent an infected host from spreading ransomware via SMB to other segments in the network?

Accepted Answer

Implement ACLs to block TCP 445 between segments. Blocking TCP 445 (SMB) at the boundary between network segments is the most effective way to stop worm-like lateral movement.

Answer

Disable DNS resolution on the host

Answer

Enable DHCP snooping

Answer

Flush the ARP cache

Question 13

When segmenting a network to contain an incident, what is the best practice for a 'Jump Server' in a DMZ to limit the attack surface?

Accepted Answer

Whitelisting source IPs that can access the jump server. Restricting access to the jump server to only known source IPs significantly reduces the risk of unauthorized access.

Answer

Enabling telnet for administrative flexibility

Answer

Disabling all logging to save space

Answer

Assigning the jump server a public IP address

Question 14

When reviewing firewall logs, you see many 'deny' events from an internal host to an external IP. What is the most likely cause?

Accepted Answer

Malware attempting to reach a C2 server. Internal hosts attempting to reach external IPs blocked by the egress policy are a common indicator of a malware beaconing attempt or an infected host trying to reach a C2.

Answer

IP address conflict

Answer

Normal user browsing activity

Answer

Hardware failure on the firewall

Question 15

You are using an IDS/IPS to detect lateral movement. You notice that your NIDS is not alerting on SSH brute force attempts. Which configuration check is most important to perform?

Accepted Answer

Verify if the IDS has visibility into the decrypted traffic. SSH brute force signatures often require the IDS to perform protocol decoding; if the traffic is encrypted and the IDS lacks the session keys, it can only see the handshake.

Answer

Check if the disk is full

Answer

Reboot the IDS appliance

Answer

Ensure NTP is synchronized

Question 16

During a Cross-Site Scripting (XSS) incident, you notice the WAF is blocking legitimate user sessions. What is the most effective tuning step to prevent false positives while maintaining protection?

Accepted Answer

Create a granular exclusion for the specific parameter triggering the alert. Creating a targeted exception for a specific URI or parameter prevents over-blocking while keeping the signature active for the rest of the application.

Answer

Disable the entire XSS protection rule set

Answer

Implement a negative security model

Answer

Switch the WAF from Blocking mode to Transparent mode

Question 17

You are performing incident response on a web server compromised via Directory Traversal. What command is most useful for identifying the specific files accessed in the logs?

Accepted Answer

grep -r "../" /var/log/apache2/access.log. Using grep to search for traversal sequences like '../' within the access logs is the standard method for finding these attempts.

Answer

grep -r "SELECT" /var/log/apache2/access.log

Answer

grep -r "<script>" /var/log/apache2/access.log

Answer

tail -f /var/log/auth.log

Question 18

You suspect a CSRF (Cross-Site Request Forgery) attack. What log entry pattern confirms this?

Accepted Answer

Referer header showing a domain different from the application's domain. CSRF attacks originate from a different site. Checking the 'Referer' header in the logs for unexpected domains is the primary method for detection.

Answer

Multiple POST requests without a corresponding GET request

Answer

High volume of 401 Unauthorized errors

Answer

A sudden change in the session cookie value

Question 19

Which TWO log file attributes are essential for identifying the source of an attack coming through a load balancer?

Accepted Answer

X-Forwarded-For header. Since a load balancer sits between the client and the server, preserving the client's IP and original request path is critical.

Answer

Server uptime count

Answer

Local time of the web server

Answer

The load balancer's internal management port

Question 20

An attacker uses a 'Homograph Attack' to spoof a domain. How does the analyst detect this?

Accepted Answer

Inspecting the Punycode representation of the domain. Homograph attacks use look-alike characters (like Cyrillic 'а' instead of Latin 'a') that are visible when inspecting the Punycode version of the domain.

Answer

Scanning the email for attachments

Answer

Checking the SPF record

Answer

Looking for a valid TLS certificate