212-89 Practice Test 22 — 15 Questions

Question 1

During a live incident, an analyst needs to capture volatile data from a compromised Windows server before containment. The server has 32 GB of RAM and is still running. Which action should the analyst perform FIRST to preserve the most volatile evidence?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Capture the contents of RAM using a memory acquisition tool such as WinPmem.. The order of volatility dictates that the most perishable evidence be collected first. On a running system, RAM contents are lost upon shutdown or reboot, so memory acquisition precedes disk imaging, documentation, or containment. Capturing RAM preserves processes, network connections, and encryption keys that may not exist on disk, making it the essential first action in this scenario.

Answer

Document the system's serial number and asset tag for chain-of-custody records.

Answer

Disconnect the server from the network to prevent further spread.

Answer

Create a forensic image of the system drive using FTK Imager.

Question 2

A system has been infected by a worm that is spreading across the network. What is the most immediate action to stop the spread?

Accepted Answer

Block propagation ports at the network level. Isolating the affected segments or blocking the ports used for the worm's propagation (e.g., SMB/445) is essential to stop lateral movement.

Answer

Update the BIOS on all machines

Answer

Disable the internet gateway

Answer

Email all users to reboot

Question 3

An organization is responding to an email incident where a user's mailbox is suspected to be compromised and used to send internal phishing emails. Which two actions should the incident handler take to contain the compromise and prevent further spread? (Choose two.)

Accepted Answer

Review and remove any malicious inbox rules or forwarding rules created by the attacker.. Containing a compromised mailbox requires cutting off the attacker's access and removing any persistence mechanisms. Resetting the password and revoking sessions and tokens stops active access, while reviewing and removing malicious inbox or forwarding rules eliminates the attacker's ability to continue exfiltrating or hiding messages. These two actions together address both access and persistence.

Answer

Disable the user's mailbox and delete all email messages to eliminate any malicious content.

Answer

Block the user's IP address at the firewall to prevent further access.

Answer

Send a notification to all employees warning them about the phishing emails and instructing them not to click any links.

Question 4

You are triaging a Windows workstation suspected of a malware infection. Several indicators suggest the malware is using the Windows Registry for persistence. Which TWO registry locations should you examine first to identify autostart entries created by the malware? (Choose two.)

Accepted Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. Malware commonly establishes persistence on Windows through autostart registry locations. The Run key under CurrentVersion launches programs at user logon, while the Services key under CurrentControlSet configures services that start at boot, often with high privileges. Both are high-priority locations to inspect when hunting for registry-based persistence during malware triage.

Answer

HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Word\Recent

Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers

Answer

HKEY_CLASSES_ROOT\Installer\Products

Question 5

Which THREE of the following are effective methods for protecting backup systems from being encrypted by ransomware?

Accepted Answer

Restricting backup service account permissions. Option A (Restricting backup service account permissions) is correct because applying least-privilege to the backup service account prevents ransomware that has compromised a user or admin context from using those credentials to delete or overwrite backup repositories, since the backup process only needs write access to its target and not broad domain or filesystem rights. Option C (Using immutable storage solutions) is correct because immutability features such as S3 Object Lock in compliance mode, WORM storage, or immutable snapshots prevent any modification or deletion of backup data for a defined retention period, even if an attacker obtains administrative credentials. Option E (Implementing air-gapped backup storage) is correct because physically or logically isolating backups from the production network, such as offline tape, removable media, or a disconnected vault, means ransomware cannot reach the backup copies to encrypt them. Option B is incorrect because storing backups on the same server as the primary data exposes them to the same compromise and encryption event, defeating the purpose of a separate backup. Option D is incorrect because an easy-to-guess password weakens access control and makes it trivial for ransomware or an attacker to access and encrypt the backup drive.

Answer

Storing backups on the same server as the primary data

Answer

Using an easy-to-guess password for the backup drive

Question 6

Which technique should an incident responder use to prevent an infected host from spreading ransomware via SMB to other segments in the network?

Accepted Answer

Implement ACLs to block TCP 445 between segments. Blocking TCP 445 (SMB) at the boundary between network segments is the most effective way to stop worm-like lateral movement.

Answer

Disable DNS resolution on the host

Answer

Enable DHCP snooping

Answer

Flush the ARP cache

Question 7

A user reports an email that appears to come from the CFO but the message was sent from an external IP address. The message passed SPF but failed DMARC alignment. What should the incident handler do first?

Accepted Answer

Quarantine the email and verify the sender's identity through a separate communication channel.. The email passed SPF but failed DMARC alignment, meaning the sending IP is authorized for a domain but not the visible From domain. This indicates spoofing. Quarantining the message and verifying the request through a separate channel are critical first steps to prevent fraud and contain the incident.

Answer

Delete the email from the user's mailbox and take no further action.

Answer

Forward the email to all employees as a warning about phishing attempts.

Answer

Reply to the email asking for confirmation of the request.

Question 8

During an email incident investigation, you need to determine whether a message was altered in transit. You have the full email headers. Which header field should you examine to verify the cryptographic signature that validates the message content and ensures it was not modified after sending?

Accepted Answer

DKIM-Signature. The DKIM-Signature header holds the cryptographic signature that validates the message content and certain headers. By verifying this signature, an investigator can determine whether the message was altered in transit and whether it was authorized by the sending domain. The other headers provide routing or identification information but lack cryptographic integrity protection.

Answer

Return-Path

Answer

Received

Answer

Message-ID

Question 9

After an incident has been resolved, the incident handler is conducting a post-incident review. Which activity is the PRIMARY purpose of this phase?

Accepted Answer

Identifying lessons learned to improve future incident response.. The post-incident review, or lessons learned phase, is dedicated to analyzing the incident and the response to identify improvements. Its primary purpose is to enhance future incident handling by updating plans, procedures, and training. Blame, recovery, and ticket closure are either inappropriate or belong to other phases, making lessons learned the correct focus.

Answer

Assigning blame to the employees responsible for the incident.

Answer

Restoring affected systems to normal operations.

Answer

Closing the incident ticket in the tracking system.

Question 10

You are analyzing an email with a suspicious attachment. You notice the file name is 'invoice.pdf.exe'. What does this indicate?

Accepted Answer

The file is a double-extension obfuscation attempt. A filename like 'invoice.pdf.exe' uses a double extension to disguise an executable as a PDF. Windows hides known file extensions by default, so the file may appear as 'invoice.pdf' to the user, but it actually runs as an .exe. This is a classic social-engineering technique to trick users into executing malware.

Answer

The file is a legitimate script file

Answer

The file is encrypted with a password

Answer

The file is a genuine PDF that requires an executable

Question 11

A web application is experiencing a suspected cross-site scripting (XSS) incident. You are reviewing web server and application logs to identify the attack. Which TWO log sources are MOST likely to contain evidence of the XSS payload being submitted and executed? (Choose two.)

Accepted Answer

Application logs that record user input validation failures or sanitization events.. XSS payloads are submitted as part of HTTP requests and may be recorded in web server access logs if the request method or logging configuration captures them. Application logs can also record input validation failures or sanitization events related to the payload. Together, these sources help identify the injection point and whether the attack was blocked.

Answer

Firewall logs showing outbound connections to the attacker's command-and-control server.

Answer

Database logs showing SQL queries executed with the XSS payload.

Answer

Operating system audit logs showing process creation events for the web server user.

Question 12

You are investigating a suspected fileless malware incident on a Windows server. EDR telemetry shows that powershell.exe was spawned by winword.exe and executed an encoded command that downloaded a script from a remote host. The process has already exited. Which artifact is MOST likely to contain the decoded command and the URL contacted?

Accepted Answer

The PowerShell operational log, event ID 4104, which records script block content including the decoded command.. For fileless attacks using encoded PowerShell, the decoded script content is captured by PowerShell script block logging in event ID 4104 when that feature is enabled. Unlike process creation logs that preserve the obfuscated Base64 string, this event records the actual script text executed, exposing embedded URLs and commands even after the process has terminated.

Answer

The Sysmon event ID 1 log, which records process creation with hashes and parent process information.

Answer

The Windows Security event log, event ID 4688, which records process creation with full command lines.

Answer

The Windows Prefetch file for powershell.exe, which stores the last executed command line and remote URLs.

Question 13

A first responder is collecting evidence from a compromised Windows server. The server is still running, and the responder needs to preserve the current state of network connections and the associated processes. Which command should the responder use to capture this information?

Accepted Answer

netstat -ano. To capture current network connections and the associated processes on a Windows server, the responder should use netstat -ano. This command shows all connections, listening ports, and the owning process ID, allowing correlation between network activity and running processes. The other commands provide configuration, process list, or system information but do not capture the required network state. Therefore, netstat -ano is the correct choice for preserving this volatile evidence.

Answer

ipconfig /all

Answer

systeminfo

Answer

tasklist /v

Question 14

Which TWO of the following are common indicators that an incident should be declared?

Accepted Answer

Unusual or unauthorized system access patterns. Option B is correct because unusual or unauthorized system access patterns — such as logins from anomalous geolocations, off-hours authentication, or brute-force attempts — are classic indicators of a security incident requiring declaration and investigation. Option D is correct because an unexplained loss of service or system availability (e.g., unexpected downtime, DoS symptoms, or a crashed critical service) signals a potential incident that must be declared so response procedures can begin. Option A is not an indicator, since a scheduled software update is a planned, authorized change rather than an anomaly. Option C is not an indicator because elevated CPU usage during scheduled maintenance is expected and accounted for. Option E is not an indicator, as a routine password reset request is a normal helpdesk activity, not evidence of a security event.

Answer

A scheduled software update being pushed to clients

Answer

An increase in system CPU usage during scheduled maintenance

Answer

An employee requesting a password reset

Question 15

A helpdesk technician reports that a user's browser is redirecting searches to an unfamiliar site and displaying pop-up advertisements even when no browser is open. You suspect a potentially unwanted program or adware infection. Which initial step is most appropriate for an incident handler?

Accepted Answer

Capture volatile data such as running processes, network connections, and browser extensions before making changes. Capturing volatile data before any remediation preserves running processes, network connections, and browser extension details that would otherwise be lost. This evidence is essential for identifying the adware family, its persistence, and any broader compromise, enabling accurate scoping and complete eradication rather than a superficial cleanup.

Answer

Ask the user to clear browser cache and reset browser settings to default

Answer

Immediately reimage the workstation to guarantee complete removal

Answer

Run a full antivirus scan and delete everything it flags as malicious