212-89 Practice Test 21 — 15 Questions

Question 1

A first responder is called to investigate a suspected malware infection on a Windows workstation. The responder needs to quickly determine which processes are currently running and their associated command-line arguments. Which native Windows tool should the responder use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

wmic process get name,commandline. The wmic process get name,commandline command uses native Windows Management Instrumentation to list all running processes along with their full command-line arguments. This is a quick, scriptable method that does not require third-party tools, allowing a first responder to identify suspicious processes and their execution parameters efficiently.

Answer

Task Manager

Answer

msconfig

Answer

perfmon

Question 2

A web application is experiencing an incident where an attacker is manipulating HTTP headers to bypass IP-based access controls. The attacker sets the X-Forwarded-For header to a trusted internal IP address. Which mitigation should an incident handler recommend to prevent this bypass?

Accepted Answer

Configure the web server to trust the X-Forwarded-For header only from known proxy servers.. The vulnerability arises because the web server trusts the X-Forwarded-For header from any source, allowing attackers to spoof it. The proper mitigation is to configure the server to accept this header only from known, trusted proxy servers. This ensures that the header is set by a legitimate intermediary and cannot be manipulated by external clients to bypass IP-based controls.

Answer

Disable the use of X-Forwarded-For entirely and rely on the source IP address of the TCP connection.

Answer

Implement a Web Application Firewall (WAF) rule to block all requests containing an X-Forwarded-For header.

Answer

Encrypt the X-Forwarded-For header using TLS to prevent tampering.

Question 3

A network incident has been declared due to a suspected data exfiltration. You are reviewing network flow data to identify the exfiltration channel. Which TWO of the following characteristics are most indicative of data exfiltration over a covert channel? (Choose two.)

Accepted Answer

Regular, small outbound DNS queries to a single external domain. Data exfiltration over covert channels often manifests as large outbound transfers during off-hours or as regular, small DNS queries to a single external domain, which may indicate DNS tunneling. Both patterns deviate from normal business traffic and are designed to avoid detection. Incident handlers should prioritize these anomalies when analyzing flow data to identify the exfiltration channel.

Answer

High volume of inbound traffic from multiple external IPs

Answer

Outbound traffic to a known patch management server

Answer

Inbound email with large attachments from an unknown sender

Question 4

You have identified an infected machine and need to perform a memory dump before it is wiped. Which tool is the industry standard for acquiring a full memory dump on a Windows machine for incident response?

Accepted Answer

Magnet RAM Capture. Magnet RAM Capture or WinPmem are standard tools for acquiring full memory dumps in a forensic-sound manner.

Answer

Wireshark

Answer

Windows Task Manager

Answer

Event Viewer

Question 5

You are handling a web defacement incident on an internet-facing content management system. The page content was altered, and the attacker likely used a compromised administrative account. Which TWO artifacts should you collect FIRST to establish an accurate timeline and preserve evidence? (Choose two.)

Accepted Answer

A forensic copy of the deployed web application files and their file system timestamps. Defacement investigations hinge on linking an observed content change to the requests and files that produced it. Web server access and error logs provide the request timeline and source of the administrative actions, while a forensic copy of the application files preserves the modified content, webshells, and file timestamps. Together they establish when the change occurred, how it was made, and what persistence remains, which are prerequisites for scoping and remediation.

Answer

The public TLS certificate chain presented by the web server

Answer

A screenshot of the defaced page taken from the responder's workstation

Answer

The marketing team's content calendar for the affected site

Question 6

You are identifying a compromised host by checking for beaconing behavior. Which network metric is most indicative of heartbeat-style beaconing?

Accepted Answer

Consistent interval between connections. Heartbeat-style beaconing is characterized by malware 'calling home' at regular, predictable intervals (e.g., every 60 seconds) to receive commands or exfiltrate data. This consistent timing creates a recognizable pattern in network flow data that distinguishes C2 traffic from normal user-driven traffic, which is bursty and irregular. Connection speed, encryption, and packet size can all be manipulated or are common in legitimate traffic, so they are far weaker indicators.

Answer

High-speed connection speed

Answer

Use of HTTPS

Answer

Randomized packet size

Question 7

You are performing an investigation on a compromised mobile device. What is the primary risk of connecting the device to a standard workstation without a write blocker?

Accepted Answer

The workstation might write metadata or sync files, altering the original evidence.. Connecting a mobile device without a physical or software write blocker can lead to automatic synchronization or data modification by the host OS.

Answer

The battery will drain faster.

Answer

The workstation will be instantly infected.

Answer

The device will automatically wipe itself.

Question 8

An incident responder is investigating a web application breach and needs to determine the exact time an attacker uploaded a web shell. Which log source would most directly provide this information?

Accepted Answer

Web server access logs. Web server access logs are the most direct source because they capture the HTTP request that performed the upload, including the timestamp, source IP, and target URI. Other logs may provide supporting context but lack the specific detail needed to pinpoint the upload event. This makes access logs the primary resource for determining when a web shell was placed.

Answer

Database audit logs

Answer

Operating system security event logs

Answer

Firewall logs

Question 9

You are investigating a suspected rootkit. Which area of the operating system should you examine for unauthorized boot-time execution?

Accepted Answer

The Master Boot Record (MBR) or EFI partition.. The Master Boot Record (MBR) or EFI partition is the correct area to examine because rootkits often persist by modifying the boot process. The MBR (on BIOS systems) or EFI System Partition (on UEFI systems) contains the initial boot code that runs before the operating system loads, making it a prime location for bootkits—a type of rootkit that executes at boot time. By compromising these areas, malware can gain control early, hide its presence, and load before security defenses. Thus, examining the MBR/EFI partition is critical for detecting unauthorized boot-time execution.

Answer

The browser cache.

Answer

The user profile folder.

Answer

The temporary files directory.

Question 10

A web server log shows repeated '403 Forbidden' errors for a specific directory. What is the most likely cause during an incident?

Accepted Answer

Directory traversal or unauthorized access attempts are being blocked. Repeated 403 errors often indicate an attacker performing forced browsing or directory traversal attempts that are being blocked by server-side permission settings.

Answer

The user session has expired

Answer

The requested file does not exist

Answer

The server is offline

Question 11

A helpdesk technician reports that multiple users received an email with an attached PDF that, when opened, prompted them to enable macros. One user enabled macros and their workstation is now showing unusual outbound connections. As the incident handler, which action should you take FIRST according to the incident response lifecycle?

Accepted Answer

Contain the incident by isolating the affected workstation from the network and preserving its current state.. The incident response lifecycle places containment immediately after detection to limit damage and preserve evidence. Isolating the affected workstation stops outbound malicious traffic and prevents lateral spread, while preserving the system state allows investigators to determine scope and root cause before moving to eradication and recovery.

Answer

Eradicate the malware by running a full antivirus scan and removing the PDF from the email server.

Answer

Recover operations by restoring the user's files from the most recent backup and reconnecting the workstation.

Answer

Identify the malware family by submitting the PDF to a public sandbox and wait for the report.

Question 12

A web application's logs indicate an attacker successfully performed an XML External Entity (XXE) injection. What was likely the source of this vulnerability?

Accepted Answer

Insecure configuration of the XML parser. XXE injection occurs when an application parses XML input with a parser that has external entity resolution enabled. This allows an attacker to define custom entities that reference external resources (e.g., local files or remote URLs), leading to data disclosure, SSRF, or denial of service. The root cause is an insecure configuration of the XML parser, such as not disabling DTDs or external entities. Therefore, option C correctly identifies the source of the vulnerability.

Answer

Lack of CSRF tokens in POST requests

Answer

SQL injection in a login form

Answer

Missing input sanitization in a search field

Question 13

During a Cross-Site Scripting (XSS) incident, you notice the WAF is blocking legitimate user sessions. What is the most effective tuning step to prevent false positives while maintaining protection?

Accepted Answer

Create a granular exclusion for the specific parameter triggering the alert. Creating a targeted exception for a specific URI or parameter prevents over-blocking while keeping the signature active for the rest of the application.

Answer

Disable the entire XSS protection rule set

Answer

Implement a negative security model

Answer

Switch the WAF from Blocking mode to Transparent mode

Question 14

You are preparing a final report for an incident. Which element is mandatory for ensuring the report serves as a valid document for future insurance or legal claims?

Accepted Answer

Verification and sign-off by the relevant stakeholders and legal counsel. For an incident report to be admissible as evidence or usable in an insurance claim, it must be authenticated and shown to be a reliable, unaltered record of the investigation. Verification and sign-off by relevant stakeholders and legal counsel establishes the report's authenticity, chain of custody, and organizational authority, which is what courts and insurers require. Without this attestation, the report is just an internal narrative with no legal weight.

Answer

A copy of all emails sent by the attacker

Answer

A detailed technical guide on how to configure the firewall

Answer

A list of every employee's salary grade

Question 15

A security analyst is reviewing firewall logs and notices a large number of 'deny' events from an internal host to various external IP addresses on different ports. The internal host is a user workstation that should only access a limited set of external services. Which of the following is the MOST likely cause of these deny events?

Accepted Answer

The workstation is infected with malware performing port scanning.. The correct answer is malware performing port scanning. The workstation, which should only access a limited set of services, is generating a large number of deny events to various external IPs on different ports. This is a classic sign of port scanning, often performed by malware to find vulnerable targets. The firewall is blocking these unauthorized attempts, resulting in the deny events.

Answer

The workstation's firewall rules are misconfigured, blocking legitimate traffic.

Answer

The workstation is attempting to update its software from multiple sources.

Answer

The workstation is running a legitimate peer-to-peer application.