212-89 Practice Exam 4 — 20 Questions

Question 1

You are a first responder called to a scene where a laptop is running and logged in. You need to preserve the most volatile evidence. What should you do first?

Accepted Answer

Capture a memory image using a forensic tool.. Volatile evidence such as RAM contents is lost when a system is powered down. Capturing a memory image first ensures that critical artifacts like running processes, network connections, and encryption keys are preserved. Other actions, like photographing the screen or removing the hard drive, are either less volatile or require powering down the system. Therefore, memory capture is the correct initial step in preserving the most perishable evidence.

Answer

Remove the hard drive and connect it to a write blocker.

Answer

Take photographs of the screen and surrounding area.

Answer

Shut down the laptop to prevent further damage.

Question 2

An analyst is investigating an email incident where several users received messages with a link to a legitimate file-sharing service. The link points to a document hosted on that service, and the document contains a macro that downloads a payload. The email gateway did not block the message because the link domain is reputable. Which technique is the attacker most likely using to evade email security controls?

Accepted Answer

Using a legitimate cloud service to host the malicious document, which bypasses reputation-based filtering.. Hosting malicious documents on legitimate cloud services is an effective evasion because email gateways often trust well-known domains. The gateway sees a reputable URL and allows the message, while the document itself contains the malicious macro. Incident handlers should treat links to trusted services with the same scrutiny as any other link, especially when the document requests macro enablement.

Answer

Domain fronting to hide the true destination behind a trusted CDN.

Answer

Encrypting the email with S/MIME so the gateway cannot inspect the content.

Answer

Sending the message from a compromised internal account to bypass SPF checks.

Question 3

You are investigating a cross-site scripting incident on a customer-facing web application. The attacker injected a persistent payload that executes in the browsers of users viewing a product review page. Which TWO actions should you take to contain the incident and protect users while preserving evidence? (Choose two.)

Accepted Answer

Capture the malicious review content and associated database records before removing or sanitizing them.. Containment of a stored XSS incident requires preserving the malicious content as evidence while preventing it from executing in users' browsers. Capturing the database records and applying output encoding on the affected page achieves both goals and allows the team to check other user-generated content fields for similar flaws. Deleting the content, shutting down the application, or applying crude perimeter filters either destroys evidence or provides ineffective protection.

Answer

Immediately delete the malicious review from the database to stop the payload from executing.

Answer

Block all inbound HTTP requests containing angle brackets at the perimeter firewall.

Answer

Disable the entire web application until the development team rewrites the review module.

Question 4

An incident handler is investigating a suspected email compromise and discovers a new inbox rule that automatically moves messages containing specific keywords to the Deleted Items folder. What is the most likely purpose of this rule?

Accepted Answer

To hide evidence of fraud or other malicious activity by suppressing related emails.. The presence of a hidden inbox rule that deletes messages containing specific keywords is a strong indicator of email compromise. Attackers use such rules to suppress notifications and replies that could reveal their fraudulent activities, allowing them to operate undetected.

Answer

To reduce mailbox clutter by automatically deleting spam messages.

Answer

To comply with data retention policies by removing old emails.

Answer

To automatically organize legitimate newsletters and promotional emails.

Question 5

A user reports that they received an email from 'IT Support' asking them to click a link to reset their password. The link goes to a domain that looks similar to the company's but has a different top-level domain. The user did not click the link. What is the FIRST action the incident handler should take?

Accepted Answer

Collect the email headers and the full message for analysis, and report the phishing attempt to the security team.. The first action should be to preserve the email and escalate to the security team. Collecting headers and the full message enables analysis of the sender, links, and potential scope without altering evidence. Premature containment steps like password resets or deletions can disrupt the investigation and may not address the actual threat if the user did not interact with the link.

Answer

Instruct the user to delete the email and then run a full antivirus scan on the workstation.

Answer

Immediately reset the user's password and revoke all active sessions.

Answer

Block the sender's email address at the gateway and close the incident.

Question 6

During initial triage, you identify that a system's time is significantly out of sync with the NTP server. Why is this critical to record during the first response?

Accepted Answer

To ensure that file system timestamps can be accurately correlated with other logs.. File system timestamps (MAC times — modify, access, change) are only meaningful when correlated against logs from other systems such as firewalls, IDS, and authentication servers. If the suspect host's clock is skewed, every timestamp it produces is offset by an unknown amount, making it impossible to build an accurate timeline of the intrusion. Recording the offset during first response lets investigators normalise the data later, preserving its evidentiary value.

Answer

It is a sign of an active buffer overflow attack.

Answer

Because it indicates the BIOS battery is failing.

Answer

It affects the ability of the system to join the Active Directory domain.

Question 7

During network forensics, you need to reconstruct an HTTP file transfer from a PCAP. Which Wireshark feature allows you to extract the file object directly from the stream?

Accepted Answer

File > Export Objects > HTTP. Wireshark's File > Export Objects > HTTP feature reconstructs and extracts files transferred over HTTP by reassembling TCP streams and parsing HTTP headers (Content-Type, Content-Length, Content-Disposition). It presents a list of all objects seen in the capture and allows saving them directly to disk, which is the standard method for recovering files from a PCAP during network forensics.

Answer

Statistics > HTTP > Reassemble

Answer

Edit > Follow > Stream Extract

Answer

Analyze > Extract File

Question 8

A first responder is called to a small office where an employee's laptop is suspected of being infected with malware. The laptop is powered on and the employee is logged in. The responder needs to preserve the most volatile evidence before any other action. Which of the following should the responder do first?

Accepted Answer

Capture the contents of RAM using a forensic tool.. The order of volatility requires that the most perishable evidence be collected first. RAM contains running processes, network connections, and encryption keys that are lost on shutdown. Capturing memory before any other action preserves this critical evidence. Photographs, antivirus scans, and shutdown all either fail to capture volatile data or actively destroy it. Therefore, memory acquisition is the correct first step for a live system suspected of malware infection.

Answer

Shut down the laptop and remove the hard drive.

Answer

Run a full antivirus scan to remove the malware.

Answer

Take photographs of the screen and surroundings.

Question 9

An attacker compromises a user's Microsoft 365 mailbox and creates a hidden inbox rule that moves any message containing 'wire transfer' to the RSS Feeds folder and marks it as read. The security team must determine which native artifact best proves the rule existed even after the attacker deletes it from Outlook on the web. What should the team review?

Accepted Answer

The mailbox audit log entries for the New-InboxRule and Set-InboxRule operations. Server-side inbox rules are created and modified through auditable operations, so the mailbox audit log retains the New-InboxRule and Set-InboxRule events with full parameters even after the rule is deleted. This makes it the reliable evidence source, whereas client caches, message trace, and connector settings do not capture rule creation or parameters.

Answer

The message trace log filtered to the user's primary SMTP address

Answer

The Exchange Online connector configuration for the affected tenant

Answer

The Outlook client-side rules (.rwz) file cached in the user's local profile

Question 10

A first responder is preparing to acquire a forensic image of a running Linux server's physical memory. The server has 64 GB of RAM and is critical to business operations. The responder must ensure the integrity of the memory image and minimize disruption. Which of the following is the most appropriate action?

Accepted Answer

Load a kernel module such as LiME to capture memory to an external drive.. For live memory acquisition on Linux, LiME is the preferred tool because it is a kernel module that captures physical memory in a forensically sound manner without rebooting. It handles large memory sizes and produces an image suitable for analysis. Using dd on /dev/mem is unreliable, rebooting destroys memory, and free only shows usage statistics. Therefore, loading LiME is the correct approach to preserve the 64 GB of RAM while minimizing disruption.

Answer

Run the free command to document memory usage and proceed with disk imaging.

Answer

Reboot the server into single-user mode and then capture memory.

Answer

Use the dd command to copy /dev/mem to an external drive.

Question 11

After containing a malware incident, the incident response team needs to remove the malware from infected systems and restore them to a trusted state. Which activity is part of the eradication phase?

Accepted Answer

Applying security patches and updating antivirus signatures.. Eradication focuses on eliminating the threat and the vulnerabilities that allowed it. Applying security patches and updating antivirus signatures directly removes malware and closes the door to reinfection. Reconnecting to the network, conducting lessons learned, and isolating the system belong to recovery, post-incident, and containment phases respectively. Thus, patching and updating signatures are the correct eradication activities.

Answer

Conducting a lessons learned meeting.

Answer

Reconnecting the system to the production network.

Answer

Isolating the infected system from the network.

Question 12

A web application is suspected of being compromised through a file inclusion vulnerability. The attacker used the vulnerability to read sensitive files on the server. Which web server log entry would provide the MOST direct evidence of the file inclusion attempt?

Accepted Answer

A request for a URL containing directory traversal sequences such as ../../etc/passwd.. File inclusion vulnerabilities are exploited by manipulating parameters to include local or remote files. Attackers often use directory traversal sequences to navigate the file system. Web server access logs that capture the request URI will show these sequences, providing direct evidence of the attempt. Other log entries may indicate scanning or other attacks but are less specific.

Answer

A POST request to a login page with a large number of parameters.

Answer

A request for a static image file that returns a 404 error.

Answer

A request with a User-Agent string that matches a known vulnerability scanner.

Question 13

You are reviewing a suspicious macro in a Word document attachment. Which tool is best suited for static analysis of the macro code?

Accepted Answer

Oledump. Oledump is a specialized tool for analyzing OLE (Object Linking and Embedding) files, including Word documents with VBA macros. It extracts and decompresses macro streams from the document, allowing static analysis of the macro code without executing it. This makes it the best choice for static analysis of a suspicious macro.

Answer

Nmap

Answer

Wireshark

Answer

Volatility

Question 14

What is the purpose of enabling 'Request Body Buffering' on a WAF during incident response?

Accepted Answer

To allow the WAF to inspect the full request body for malicious payloads. Request Body Buffering forces the WAF to buffer the entire HTTP request body before forwarding it to the backend, which is essential because many WAF inspection engines can only analyze the full payload once it has been completely received. Without buffering, the WAF may only inspect headers or the first chunk of a chunked/streamed body, allowing attackers to smuggle malicious payloads past inspection. During incident response, enabling this ensures payloads like SQLi, XSS, or file-upload exploits embedded deep in the body are actually evaluated against WAF rules.

Answer

To compress incoming traffic

Answer

To improve web server performance

Answer

To hide the web server version from attackers

Question 15

A financial institution's incident response team is investigating a suspected network intrusion. They observe anomalous traffic from an internal database server to an unknown external IP address. Which TWO of the following actions are appropriate for network-based containment in this scenario? (Choose two.)

Accepted Answer

Block the external IP address at the perimeter firewall.. Blocking the external IP at the firewall and applying an ACL on the internal router are both network-based containment actions that disrupt the malicious traffic while preserving the server's functionality and evidence. They are targeted and reversible, unlike disconnecting or shutting down the server, which cause unnecessary disruption.

Answer

Run a full malware scan on the database server.

Answer

Disconnect the database server from the network immediately.

Answer

Shut down the database service to prevent further data leakage.

Question 16

When an email incident is resolved, why is it necessary to update the organization's blocklist?

Accepted Answer

To prevent re-occurrence of the same campaign. Updating the blocklist after resolving an email incident is a proactive measure to prevent the same malicious campaign from affecting the organization again. By adding the identified malicious sender addresses, domains, or IPs to the blocklist, future emails from the same source are automatically blocked, thus breaking the attack chain. This directly reduces the risk of re-infection or re-compromise from the same threat actor. The other options do not address the primary security objective of incident response.

Answer

To comply with legal regulations

Answer

To improve system performance

Answer

To delete the user's account

Question 17

Which TWO types of evidence are considered 'volatile'?

Accepted Answer

System memory (RAM).. RAM and network connections are lost when power is removed or the system is reset.

Answer

Optical disc contents.

Answer

Hard drive data.

Answer

Printed log files.

Question 18

You are performing a post-incident review. Which action is the most important to ensure that the 'Lessons Learned' process effectively improves future response capabilities?

Accepted Answer

Documenting the root cause and defining specific, actionable process changes. The root cause analysis and resulting action items are what drive actual improvement in the IR lifecycle.

Answer

Updating the password policy

Answer

Archiving all forensic images for ten years

Answer

Assigning blame to the employee who made the error

Question 19

Which syslog facility would typically be configured on a network device to send audit logs to a central server?

Accepted Answer

local0. Syslog facilities local0 through local7 are reserved for local or custom use, and network devices (routers, switches, firewalls) conventionally use local0 (or another local facility) to tag audit and event logs sent to a central syslog server. This lets administrators separate device-generated audit logs from system daemons like kernel, cron, or mail in the central collector's configuration. Using local0 ensures the logs are routed and stored according to the organization's audit retention policy.

Answer

kernel

Answer

cron

Answer

mail

Question 20

When responding to a SQL injection incident, which TWO areas of the database server logs should be prioritized for review?

Accepted Answer

Database user activity/audit logs. Option C (database user activity/audit logs) is correct because audit logs record authentication events, privilege changes, and the specific accounts and source hosts involved in suspicious activity, which is essential for identifying who executed the injection and what they accessed. Option E (database query execution logs) is correct because they capture the actual SQL statements sent to the server, allowing responders to spot injected payloads such as UNION SELECT, OR 1=1, or stacked queries and to determine which tables or data were touched. Together these two log sources provide the attacker identity and the malicious query evidence needed for containment and forensic reconstruction. Option A (OS kernel logs) is not prioritized because it deals with hardware, driver, and system-level events rather than SQL activity. Option B (backup completion logs) only shows whether backup jobs succeeded and has no bearing on detecting or tracing an injection. Option D (network interface statistics) provides traffic counters and throughput data, not the application-layer SQL content or user context required for this investigation.

Answer

Operating system kernel logs

Answer

Database backup completion logs

Answer

Network interface statistics