212-89 Practice Test 23 — 15 Questions

Question 1

A network administrator notices a sudden spike in ICMP echo requests from an internal host to an external IP address. The payload size of these ICMP packets is consistently larger than normal ping requests. Which of the following is the MOST likely cause of this activity?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The host is infected with malware using ICMP tunneling for data exfiltration.. The correct answer is malware using ICMP tunneling. The scenario describes a sudden spike in ICMP echo requests with consistently large payloads to an external IP, which is a classic sign of ICMP tunneling. Attackers use this technique to exfiltrate data by embedding it in ICMP packets, often bypassing firewall restrictions that allow ping. This allows stealthy data transfer out of the network.

Answer

The host is experiencing a denial-of-service attack from the external IP.

Answer

The host is using a legitimate application that relies on ICMP for keep-alive messages.

Answer

The host is performing a network performance test using ping.

Question 2

During a malware incident response, you identify a suspicious process with PID 4452 using Sysinternals Process Explorer. You need to verify the file's reputation before isolation. Which action allows you to do this directly within the tool?

Accepted Answer

Select the process and click Options > Check VirusTotal. Sysinternals Process Explorer integrates directly with VirusTotal via Options > Check VirusTotal, which submits the selected process's file hash to VirusTotal and displays the multi-engine detection ratio in a new column. This lets an analyst assess file reputation without leaving the tool or manually uploading the binary. It is the fastest way to triage a suspicious PID during live malware response.

Answer

Use the 'Find Handle or DLL' search bar for the file name

Answer

Right-click the process and select 'Verify Signature'

Answer

Navigate to View > Lower Pane View > Handles

Question 3

Which TWO of the following are common sources for incident identification?

Accepted Answer

Alerts from IDS or SIEM systems. Option C is correct because IDS (Intrusion Detection System) and SIEM (Security Information and Event Management) systems are designed to continuously monitor network traffic, logs, and events, generating alerts that are primary technical sources for identifying security incidents. Option E is correct because internal users or employees often report suspicious activity, phishing emails, or anomalies they encounter, making user reports a valuable and common human source of incident identification. The remaining options do not belong: randomly checking employee browser history (A) is not a systematic or standard detection method and raises privacy concerns, cleaning the breakroom (B) and the daily lunch menu (D) are unrelated to security monitoring or incident detection.

Answer

Randomly checking employee browser history

Answer

Cleaning the office breakroom

Answer

The daily lunch menu

Question 4

You are performing forensic analysis on a suspicious file. You need to determine if it is a packed executable. Which tool is most effective for viewing the file's section headers to identify anomalies?

Accepted Answer

PEview. PEview is a Windows tool that parses the Portable Executable (PE) format and displays section headers, the import table, export table, and other structural metadata. Packed executables typically show anomalies such as section names like UPX0/UPX1, unusually high entropy, a tiny import table, or a section with raw size much larger than virtual size — all visible in PEview's section header view.

Answer

Wireshark

Answer

Process Explorer

Answer

Regedit

Question 5

A security analyst is investigating lateral movement using PowerShell Remoting (WinRM). Which Windows Event Log should be prioritized to confirm the execution of remote commands?

Accepted Answer

Microsoft-Windows-PowerShell/Operational. The Microsoft-Windows-PowerShell/Operational log records detailed PowerShell activity, including remote command execution via WinRM (PowerShell Remoting). When an analyst runs Invoke-Command or Enter-PSSession against a remote host, the remote endpoint writes events such as Event ID 4103 (module logging) and 4104 (script block logging) to this log, providing the actual command content executed. The Security log records authentication (4624/4625) but not the payload of remote commands, making the PowerShell Operational log the priority source for confirming execution.

Answer

Application Log

Answer

Security Log

Answer

System Log

Question 6

A user reports an email from a known vendor that asks them to confirm banking details by replying with a completed form attached as an HTML file. The message passed SPF, DKIM, and DMARC because it came from the vendor's legitimate mail server. As the incident handler, what is the most accurate conclusion about this email?

Accepted Answer

It may be a business email compromise sent from the vendor's compromised mailbox despite valid authentication. Authentication results confirm the sending domain, not the sender's intent. A compromised vendor mailbox produces messages that pass SPF, DKIM, and DMARC while carrying a fraudulent request, which matches the business email compromise pattern. The handler should verify the banking change through a known-good channel before acting on the attachment.

Answer

It is a legitimate message because all three authentication checks passed

Answer

It is a spoofed message and the authentication results must be incorrect

Answer

It should be quarantined automatically because HTML attachments are always malicious

Question 7

A developer reports that a specific user is receiving 500 Internal Server Errors. Where is the first place to look to determine if this is an incident?

Accepted Answer

Error logs. Error logs on the web server or application record 500 Internal Server Error events with stack traces, exception messages, and timestamps, making them the first place to determine whether the error is a benign bug or a sign of an incident (e.g., injection, resource exhaustion).

Answer

Firewall logs

Answer

DNS logs

Answer

Access logs

Question 8

An incident responder is investigating a suspected email-borne malware incident. The email contained a link that downloaded a file. The responder needs to determine the file's reputation and whether it has been seen in other campaigns. Which action should the responder take?

Accepted Answer

Submit the file hash to a threat intelligence platform or malware analysis service.. Submitting the file hash to a threat intelligence platform is the most direct way to obtain reputation data and determine if the file has been observed in other campaigns. This helps the responder understand the threat's prevalence and link it to known actors or malware families. Sandboxing, antivirus scans, and string extraction provide additional details but do not directly answer the reputation question.

Answer

Run a full antivirus scan on the affected endpoint.

Answer

Open the file in a sandbox and observe its behavior.

Answer

Extract the file's strings and review them manually.

Question 9

An attacker is using a specific User-Agent to scan your web application. How do you block them effectively?

Accepted Answer

Create a WAF rule to block requests with the specific User-Agent string. A WAF rule that matches the specific User-Agent string and blocks matching requests is the most direct and effective control, because it targets the exact signature the attacker is using. WAFs like AWS WAF, Cloudflare, or ModSecurity can match on the User-Agent header via string-match or regex conditions and return a 403 before the request reaches the origin. This stops the scanner without affecting legitimate traffic that uses different User-Agents.

Answer

Disable all directory indexing on the server

Answer

Change the web server listening port

Answer

Update the server's hosts file

Question 10

Which TWO of the following are primary objectives of the 'Lessons Learned' phase?

Accepted Answer

Updating policies and procedures to prevent recurrence. Option C is correct because the Lessons Learned phase exists to feed findings back into the organization's documentation, so updating policies, procedures, and controls to prevent recurrence of the incident is a primary objective. Option E is correct because a core purpose of the post-incident review is to identify security gaps and weaknesses in the current response process, such as missed detection opportunities or ineffective containment steps, so they can be remediated. The remaining options do not belong: A is wrong because incident records and evidence must be retained for legal, forensic, and compliance purposes rather than deleted, B is wrong because assigning financial bonuses is a human-resources matter unrelated to the review's objectives, and D is wrong because testing a building's backup power supply is a routine maintenance or contingency test, not an objective of the Lessons Learned phase.

Answer

Deleting all incident records to protect privacy

Answer

Assigning financial bonuses to the team

Answer

Testing the backup power supply of the building

Question 11

During a network incident, you capture traffic and notice a workstation repeatedly sending TCP SYN packets to a single external IP on port 443, but the external host never responds. The workstation then sends the same SYN to a different external IP on port 443. Which network artifact best characterizes this behavior?

Accepted Answer

TCP SYN scan targeting a single port across multiple hosts. The workstation is sending TCP SYN packets to a single port on multiple external IP addresses without completing the three-way handshake. This is characteristic of a TCP SYN scan, often used for reconnaissance to identify live hosts and open ports. The incident handler should recognize this as scanning activity, which may precede an attack and warrants further investigation.

Answer

TCP session hijacking attempt

Answer

Slowloris denial-of-service attack

Answer

UDP flood denial-of-service attack

Question 12

During the preparation phase, an organization is developing its incident response plan. Which TWO of the following are essential elements that should be included to ensure effective incident handling? (Choose two.)

Accepted Answer

Defined roles and responsibilities for the incident response team.. An effective incident response plan must define roles and responsibilities to ensure clear accountability and coordination. It also requires a robust communication plan to manage information flow to both internal and external stakeholders. These elements enable a swift and organized response. A full employee contact list, a complete software inventory, and a vulnerability scan schedule, while potentially useful, are not core components of the IR plan and do not directly facilitate incident handling.

Answer

A list of all software installed on every endpoint.

Answer

A detailed contact list of all employees in the organization.

Answer

A schedule for regular vulnerability scans.

Question 13

You are handling a confirmed email incident involving a malicious attachment that executed on several endpoints. Which TWO actions should you take to scope the incident and prevent further execution across the organization? (Choose two.)

Accepted Answer

Search mail logs and the security portal for the message hash, subject, and sender to identify all recipients. Scoping requires finding every recipient through mail logs and the security portal, and prevention requires blocking the known-bad hash and sender domain at the gateway and endpoint layers. Together these actions identify affected endpoints and close the delivery path, while broad notifications, premature restores, and tenant-wide outbound blocks are either ineffective or disproportionate.

Answer

Disable all outbound email for the tenant until the sender is identified

Answer

Send a company-wide email describing the incident and asking users to delete any matching message

Answer

Restore the affected endpoints from the most recent backup before analyzing the payload

Question 14

Which TWO log file attributes are essential for identifying the source of an attack coming through a load balancer?

Accepted Answer

X-Forwarded-For header. The X-Forwarded-For header (B) is essential because a load balancer typically terminates the client connection and proxies the request, so the web server's own logs would only show the load balancer's IP; X-Forwarded-For preserves the original client IP address needed to trace the attack source. The Original Request-URI (E) is also essential because it records exactly which resource or path the attacker requested, allowing correlation of the malicious request across the load balancer and backend server logs. Server uptime count (A) is irrelevant to attack attribution, as it only indicates how long the server has been running. Local time of the web server (C) is useful for correlating events but does not by itself identify the source of the attack. The load balancer's internal management port (D) is unrelated to client request tracing and would not reveal the attacker's origin.

Answer

Server uptime count

Answer

Local time of the web server

Answer

The load balancer's internal management port

Question 15

During an incident, a responder needs to capture the ARP cache to identify potential local spoofing. Which tool provides this information?

Accepted Answer

arp -a. The 'arp -a' command shows the current Address Resolution Protocol cache on a Windows or Linux system.

Answer

ipconfig /displaydns

Answer

route print

Answer

netstat -s