212-89 Practice Test 24 — 15 Questions

Question 1

During the triage of a Linux server, you suspect a rootkit is intercepting system calls. Which THREE actions are appropriate for the first responder to perform to gather evidence of the rootkit?

Accepted Answer

Compare the md5sum of critical binaries against a known-good baseline.. Option A is correct because comparing md5sum hashes of critical binaries (e.g., /bin/ls, /bin/ps) against a known-good baseline detects trojanized executables that a rootkit may have replaced. Option B is correct because a rootkit intercepting system calls often resides in kernel memory, and capturing a full memory dump for offline analysis with Volatility preserves volatile evidence such as hidden processes, hooks, and loaded modules. Option E is correct because running 'lsmod' lists loaded kernel modules, allowing the responder to spot suspicious or unsigned modules that could implement the system-call interception. Option C is not appropriate because reinstalling the OS destroys evidence and is a remediation step, not evidence gathering. Option D is not appropriate because 'chkdsk' is a Windows utility for file-system errors and is irrelevant on Linux, where fsck would be used and would not reveal a rootkit.

Answer

Reinstall the OS immediately to ensure cleanliness.

Answer

Run 'chkdsk' to look for file system errors.

Question 2

During a network incident, your IDS alerts on a series of TCP packets with the SYN flag set and a source IP of 10.20.5.14, but packet captures on the internal switch show that the actual Ethernet source MAC address belongs to a workstation in the finance VLAN, while the IP 10.20.5.14 is assigned to a server in the DMZ. The workstation's ARP cache lists the DMZ server's IP as being at the workstation's own MAC address. Which network-based attack technique is the workstation most likely performing?

Accepted Answer

ARP cache poisoning. The workstation is poisoning ARP caches to redirect traffic intended for the DMZ server to itself. The telltale sign is that the Ethernet source MAC belongs to the finance workstation while the IP source is the DMZ server's address, and the workstation's ARP cache incorrectly maps that IP to its own MAC. This man-in-the-middle positioning allows the attacker to intercept or alter traffic before forwarding it.

Answer

MAC flooding

Answer

VLAN hopping

Answer

DHCP starvation

Question 3

During an investigation of a compromised e-commerce web application, you observe that the attacker sent a single HTTP request containing a serialized object in the 'cart' cookie. The application deserialized the data and subsequently spawned a shell process on the server. Which web application vulnerability was exploited?

Accepted Answer

Insecure Deserialization. The attacker exploited insecure deserialization by sending a malicious serialized object in a cookie. When the application deserialized it, the payload executed arbitrary code, spawning a shell. This is a direct indicator of insecure deserialization, often leading to remote code execution. Other vulnerabilities like XXE, XSS, or SSRF do not match the observed behavior of deserialization leading to shell execution.

Answer

Server-Side Request Forgery (SSRF)

Answer

Cross-Site Scripting (XSS)

Answer

XML External Entity (XXE) Injection

Question 4

A healthcare provider's incident response team is notified that a clinical workstation is repeatedly re-infecting with ransomware 20 minutes after each cleanup. Volatile evidence has been preserved, and the business owner has authorized taking the endpoint offline. The team suspects a persistent mechanism that re-establishes the payload. Which action BEST aligns with the Containment phase of the incident handling process while preserving the ability to identify the persistence mechanism?

Accepted Answer

Isolate the workstation at the network level while keeping it powered on, then acquire a forensic image and examine startup and scheduled task locations for the persistence mechanism.. Containment should stop the spread and limit damage without destroying evidence required to determine root cause. Network isolation keeps the host running so memory and persistence artifacts can be collected, while disconnecting only the network path prevents re-infection and lateral movement. Reimaging or account-only actions skip the analysis needed to find how the ransomware persists, and deliberately leaving the host connected contradicts the containment objective.

Answer

Leave the workstation connected to allow the attacker to reveal additional command-and-control infrastructure, and monitor traffic passively for 24 hours.

Answer

Immediately reimage the workstation from the standard clinical image and return it to service to minimize patient-care downtime.

Answer

Disable the user's Active Directory account, reset the password, and require multi-factor authentication re-enrollment before restoring the workstation.

Question 5

A first responder arrives at a workstation that is suspected of being compromised by a Remote Access Trojan (RAT). The user reports the machine has been running slowly and the network activity LED is constantly blinking. The responder decides to capture volatile network connection data before any other action. Which of the following commands should the responder use to display active network connections and the associated process IDs on a Windows system?

Accepted Answer

netstat -ano. The responder needs to capture volatile network connection data with process attribution. The netstat -ano command combines all connections, numeric output, and process IDs, providing a snapshot of active network activity and the processes responsible. This is essential for identifying a RAT that maintains a persistent connection. Other commands either show different network information or lack process mapping, making them unsuitable for this specific first response task.

Answer

net view

Answer

nbtstat -c

Answer

ipconfig /displaydns

Question 6

A security analyst is reviewing a packet capture from a suspected compromised workstation. The analyst notices a series of DNS queries for random-looking subdomains such as 'a1b2c3d4.evil.com', 'e5f6g7h8.evil.com', and 'i9j0k1l2.evil.com'. Each query is followed by a TXT record response containing long base64-encoded strings. The analyst suspects data exfiltration. Which network forensic technique would best confirm and extract the exfiltrated data from this traffic?

Accepted Answer

Reconstruct the DNS TXT record responses and decode the base64 payloads to recover the exfiltrated data.. The correct answer is to reconstruct the DNS TXT record responses and decode the base64 payloads. DNS tunneling for data exfiltration often uses TXT records to carry encoded data. By extracting and decoding these records from the packet capture, the analyst can recover the exfiltrated information and confirm the incident. Other methods either do not extract data or are not forensic analysis techniques for existing captures.

Answer

Use a DNS sinkhole to redirect the malicious domain to a controlled server and observe subsequent connections.

Answer

Analyze the frequency and timing of DNS queries to determine if they match a known exfiltration pattern.

Answer

Correlate the DNS queries with NetFlow records to identify the volume of data transferred.

Question 7

A junior SOC analyst receives an alert at 03:00 showing a workstation contacting a known command-and-control (C2) IP address. The analyst is unsure whether this is a true incident or a false positive and wants guidance before waking the on-call incident handler. According to the incident handling process, what should the analyst do FIRST?

Accepted Answer

Perform triage by validating the alert against available telemetry to determine whether it is a true or false positive.. Triage is the validation step that separates genuine incidents from false positives before escalation. The analyst should correlate the C2 alert with other telemetry to confirm malicious activity, then classify and escalate if warranted. This preserves incident handler time and ensures real incidents are handled promptly.

Answer

Immediately isolate the workstation from the network to prevent potential lateral movement.

Answer

Escalate the alert to the on-call incident handler immediately without performing any validation.

Answer

Close the alert as a false positive because the IP address may be shared infrastructure.

Question 8

An incident handler is reviewing a suspicious email reported by a finance employee. The message appears to come from a known vendor, requests an urgent wire transfer, and contains a PDF attachment. The handler wants to determine whether the sender's domain was authorized to send on behalf of the vendor. Which email authentication result should the handler check FIRST to make this determination?

Accepted Answer

The DMARC alignment result for the vendor's domain. DMARC is the only mechanism that ties SPF and DKIM results to the visible From domain through alignment. In a business email compromise scenario where the display name and From domain matter, the DMARC result gives the clearest signal of whether the vendor's domain actually authorized the message. Checking DKIM, SPF, or the gateway's Received-SPF header in isolation does not answer the authorization question with the same confidence.

Answer

The DKIM signature result for the vendor's domain

Answer

The Received-SPF header added by the recipient gateway

Answer

The SPF authentication result for the vendor's domain

Question 9

During an email incident investigation, an analyst extracts a suspicious macro-enabled document from a reported message. The document contains obfuscated VBA code that downloads a payload from a remote host. The analyst wants to safely determine the payload's network behavior without allowing execution on a production workstation. Which approach BEST supports this goal?

Accepted Answer

Submit the document to a sandboxed malware analysis service and review the network indicators it reports. Submitting the sample to a sandboxed malware analysis service provides a controlled environment where the document's macro can execute and its network activity can be observed without endangering production systems. The service captures DNS queries, HTTP requests, and other indicators that the analyst can use for blocking and scoping. Manual static decoding and production execution either miss runtime behavior or introduce unacceptable risk.

Answer

Open the document on an isolated virtual machine with macros enabled and monitor outbound connections

Answer

Use a static analysis tool to extract the VBA code and manually decode the obfuscated strings

Answer

Run the document in a production virtual desktop with endpoint detection enabled and collect alerts

Question 10

An incident handler is analyzing a malware sample that uses process hollowing. The handler observes that a legitimate process, such as svchost.exe, is running but its memory contains malicious code. Which Windows API sequence is most characteristic of process hollowing?

Accepted Answer

CreateProcess, ZwUnmapViewOfSection, VirtualAllocEx, WriteProcessMemory, SetThreadContext, ResumeThread. Process hollowing is a technique where a legitimate process is created in a suspended state, its memory is unmapped, malicious code is written into the freed space, and the thread context is updated to execute the malicious code. The API sequence involving ZwUnmapViewOfSection, VirtualAllocEx, WriteProcessMemory, SetThreadContext, and ResumeThread is highly indicative of this technique.

Answer

SetWindowsHookEx, CallNextHookEx, UnhookWindowsHookEx

Answer

CreateProcess, WriteProcessMemory, CreateRemoteThread, ResumeThread

Answer

OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread

Question 11

You are a first responder dispatched to a compromised Windows 10 workstation. The system is still powered on and the user is logged in. Before isolating the machine from the network, you need to capture the current state of active network connections and the processes that own them. Which command should you run first?

Accepted Answer

netstat -anob. Capturing active network connections with their owning processes is a high-priority volatile data collection step. The netstat command with all, numeric, owner, and binary switches reveals listening ports, established sessions, and the executables behind them. Doing this before isolating the host preserves evidence that disappears the moment connections are reset or the interface is disabled.

Answer

netsh interface set interface "Ethernet" disable

Answer

ipconfig /release

Answer

arp -a

Question 12

An incident handler is analyzing a reported email that appears to come from a trusted partner. The message passed SPF and DKIM for the partner's domain, but the handler notices the display name matches the partner while the actual From address uses a look-alike domain with a single character difference. The message also contains a link to a document-sharing site. Which conclusion is MOST accurate?

Accepted Answer

The message is a look-alike domain spoofing attempt and should be treated as suspicious. The look-alike From domain with a single-character difference is the decisive indicator of a spoofing attempt. SPF and DKIM passes for the partner's domain do not validate the look-alike domain, and display names and document-sharing links are not reliable trust signals. The handler should treat the message as suspicious, inspect the link safely, and verify DMARC alignment for the look-alike domain to confirm the deception.

Answer

The message is legitimate because SPF and DKIM passed for the partner's domain

Answer

The message is a false positive because the display name matches the partner

Answer

The message should be allowed because the document-sharing link is from a reputable service

Question 13

A web application is experiencing a denial-of-service attack characterized by a flood of HTTP requests from a large number of distributed IP addresses. Which type of attack is this most likely to be?

Accepted Answer

Distributed Denial-of-Service (DDoS). A Distributed Denial-of-Service (DDoS) attack floods a target with traffic from multiple sources, overwhelming its resources and causing service disruption. The scenario describes a flood of HTTP requests from many distributed IP addresses, which is the classic signature of a DDoS attack. Other attack types like SQL injection, XSS, or CSRF do not involve volumetric flooding.

Answer

SQL Injection

Answer

Cross-Site Scripting (XSS)

Answer

Cross-Site Request Forgery (CSRF)

Question 14

An organization's incident response plan defines a communication protocol for notifying stakeholders during an incident. A major security breach has just been confirmed, and the incident handler must decide who to notify and how. Which of the following is the PRIMARY factor that should guide the notification process?

Accepted Answer

The predefined communication and escalation matrix in the incident response plan.. The incident response plan's communication and escalation matrix is the authoritative guide for notifications during a confirmed breach. It specifies stakeholders, order, timing, and channels, ensuring legal and regulatory requirements are met and the right people are informed. Personal preference, severity alone, or media coverage should not drive the notification process.

Answer

The severity rating assigned by the security operations center (SOC) analyst who detected the breach.

Answer

The personal preference of the incident handler regarding which stakeholders to inform.

Answer

The amount of media coverage the breach is likely to receive.

Question 15

During a network incident, you observe that an internal host is communicating with an external IP address on TCP port 8080. The traffic is HTTP and contains periodic GET requests to '/update.php' with a custom User-Agent string 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' but the response body is encrypted binary data. You suspect this is command-and-control (C2) communication. Which network forensic artifact would most directly reveal the C2 protocol structure and commands being sent?

Accepted Answer

The decrypted payload of the HTTP response body after applying the malware's decryption routine.. The correct answer is to decrypt the HTTP response body using the malware's decryption routine. Since the C2 commands are transmitted in an encrypted binary payload, only decryption can reveal the protocol structure and commands. Other artifacts like headers, TCP metadata, or DNS queries do not contain the encrypted command data and thus cannot provide the necessary insight.

Answer

The HTTP request headers and URI parameters in the packet capture.

Answer

The DNS queries made by the host to resolve the external IP address.

Answer

The TCP sequence numbers and window sizes in the packet capture.