212-89 Practice Test 2 — 25 Questions

Question 1

You discover a suspicious scheduled task on a server. Which Windows tool allows you to export this task for analysis without relying on the GUI?

Accepted Answer

schtasks /query /v. The 'schtasks' command-line tool is the standard way to query and manage tasks in Windows without triggering GUI-based auditing changes.

Answer

regedit.exe

Answer

netsh

Answer

Task Scheduler GUI.

Question 2

While investigating a breach, you need to verify the integrity of a system file. Which process is correct to ensure the file has not been altered?

Accepted Answer

Generate a SHA-256 hash and compare to a trusted baseline.. Generating a cryptographic hash (SHA-256) of the file and comparing it to a known good baseline is the standard process for integrity verification.

Answer

Compare the file size with the original.

Answer

Check the 'Date Modified' timestamp.

Answer

Open the file in a text editor to look for changes.

Question 3

Which THREE pieces of information should be recorded on a Chain of Custody (CoC) form when collecting a device?

Accepted Answer

Detailed physical description and identifiers (e.g., serial number).. CoC must track who collected it, when, and where it came from.

Answer

The social media passwords of the owner.

Answer

The home address of the user.

Question 4

During the lessons learned phase of a P1 incident, you notice that the incident handling policy failed to define clear 'Rules of Engagement' for containment, leading to accidental service disruption. Which document should be updated to address this deficiency?

Accepted Answer

The Incident Response Plan (IRP). The Incident Response Plan (IRP) contains the specific procedures and rules for containment, and it must be updated to prevent future operational failures.

Answer

The Corporate Acceptable Use Policy

Answer

The Network Topology Map

Answer

The Business Continuity Plan (BCP)

Question 5

You are performing an incident investigation involving a suspected insider threat. Under GDPR compliance, you must ensure that your data collection methods adhere to the 'data minimization' principle. Which action best aligns with this requirement?

Accepted Answer

Collect only specific log entries and application artifacts related to the suspicious activity. Data minimization requires collecting only what is necessary for the investigation, avoiding the wholesale harvesting of unrelated user traffic or personal files.

Answer

Perform a full disk image of the suspect's entire workstation and cloud storage account

Answer

Install a keylogger on the workstation to monitor all user activity indefinitely

Answer

Request a full dump of the company-wide SQL database to search for activity

Question 6

During a suspected ransomware incident, you are using EnCase Endpoint to perform remote triage. You need to collect volatile data without triggering the ransomware's anti-forensic triggers. Which action should you take first to ensure the integrity of evidence?

Accepted Answer

Capture the RAM using a trusted forensic tool like DumpIt.. Capturing volatile data (RAM) before any other forensic action is standard practice as it is the most fragile evidence.

Answer

Review the Windows Event Logs for unauthorized access.

Answer

Perform a bit-stream image of the physical hard drive.

Answer

Shut down the computer to prevent further encryption.

Question 7

Which role in the Incident Response Team is primarily responsible for ensuring that the incident handling activities remain aligned with organizational legal and privacy requirements?

Accepted Answer

Legal Counsel. The legal counsel or representative ensures that all actions taken during an incident are compliant with applicable laws.

Answer

Technical Investigator

Answer

Incident Lead

Answer

Communications Officer

Question 8

You have identified a potential Advanced Persistent Threat (APT) in your network. Which evidence preservation strategy is required to maintain the validity of the logs found in a SIEM?

Accepted Answer

Applying a cryptographic hash to the exported logs. Generating cryptographic hashes for log files ensures they can be verified as untampered during later analysis.

Answer

Moving the logs to a backup server

Answer

Printing the logs to a secure PDF

Answer

Taking a screenshot of the SIEM dashboard

Question 9

During an investigation, you need to verify the integrity of a system configuration file. You have the original known-good hash. What does it mean if the hash of the current file matches the known-good hash?

Accepted Answer

The file contents are identical to the known-good state. If the hashes match, the file content has not changed, ensuring the file's integrity.

Answer

The system is definitely not compromised

Answer

The file was recently updated by an administrator

Answer

The file is free of malware

Question 10

You have identified an active C2 beacon on a corporate server. You are instructed to implement 'Containment' via network segmentation. Which configuration change on a Cisco ASA firewall provides the most effective containment while still allowing for remote forensic forensic analysis?

Accepted Answer

Apply an ACL to the ingress interface that permits traffic only from the IR forensic workstation IP.. Creating a restrictive ACL that allows only the IR team's management IP to access the compromised server while blocking all other traffic is the best practice for controlled containment.

Answer

Disable the interface in the server's OS.

Answer

Change the server's default gateway to a null route.

Answer

Shut down the switch port connected to the server.

Question 11

Which TWO of the following are recommended when creating a forensic copy of a hard drive?

Accepted Answer

Using a physical write-blocker. Integrity is ensured by hashing and using write-blockers.

Answer

Copying only the files that seem important

Answer

Reformatting the drive before imaging

Answer

Installing new drivers on the drive

Question 12

You are establishing an Incident Response Plan (IRP). Which document should prioritize the technical steps for restoring services after a ransomware attack?

Accepted Answer

Playbook. The Incident Response Plan focuses on the procedural steps for handling specific incident types, including recovery.

Answer

Business Continuity Plan

Answer

Communication Plan

Answer

Security Policy

Question 13

You are setting up a secure communication channel for the IR team during a major incident. Why is it recommended to use an out-of-band communication method?

Accepted Answer

To prevent the attacker from monitoring team communications. If the primary network is compromised, internal communication (email/Slack) may be monitored by the attacker.

Answer

To comply with the Acceptable Use Policy

Answer

To simplify documentation for the final report

Answer

To increase bandwidth for file transfers

Question 14

During the identification phase, you notice a high volume of traffic from an unknown IP to your web server. What is the most appropriate action to take first?

Accepted Answer

Analyze the traffic logs to determine the nature of the activity. Analyzing the traffic confirms whether it is an attack or benign activity before taking disruptive action.

Answer

Block the IP at the firewall immediately

Answer

Notify the local law enforcement

Answer

Shut down the web server

Question 15

An organization is establishing an Incident Response (IR) team. According to NIST, which team structure is most suitable for a large, globally distributed organization that requires localized response capability with centralized oversight?

Accepted Answer

Distributed IR Team. A distributed team structure allows local teams to respond quickly to regional incidents while reporting to a centralized hub for unified policy enforcement.

Answer

Centralized IR Team

Answer

Virtual IR Team

Answer

Outsourced IR Team

Question 16

You have identified an infected machine and need to perform a memory dump before it is wiped. Which tool is the industry standard for acquiring a full memory dump on a Windows machine for incident response?

Accepted Answer

Magnet RAM Capture. Magnet RAM Capture or WinPmem are standard tools for acquiring full memory dumps in a forensic-sound manner.

Answer

Wireshark

Answer

Windows Task Manager

Answer

Event Viewer

Question 17

You suspect a malware incident caused unauthorized data exfiltration. Which log source is most useful to identify the destination IP of the exfiltrated data?

Accepted Answer

Firewall logs. Firewall logs provide a record of all outbound connections and are the most reliable source for identifying destination IP addresses in an exfiltration event.

Answer

Application logs

Answer

Local security policy settings

Answer

System event logs

Question 18

You suspect an incident involves an insider threat. Which step should be taken FIRST to preserve the integrity of the potential evidence while minimizing system downtime?

Accepted Answer

Capture a bit-stream image of the storage media. Creating a forensic image ensures that the current state is preserved before any volatile data is lost or system state changes.

Answer

Change the root password to lock out the attacker

Answer

Delete the suspicious user account

Answer

Reboot the compromised system to clear malicious memory

Question 19

You are analyzing a malware sample that uses Domain Generation Algorithms (DGA). What is the primary purpose of DGA in malware?

Accepted Answer

Evading static C2 blocklists. DGA is used to generate a large number of domain names daily, making it difficult for defenders to block the command-and-control server effectively.

Answer

Spreading via local network shares

Answer

Encrypting the malware payload

Answer

Hiding processes from Task Manager

Question 20

You are dealing with a legal hold request for data related to an investigation. How should you handle the data retention policy for this specific case?

Accepted Answer

Suspend the automatic deletion for the affected data. A legal hold overrides existing retention policies, preventing the automatic deletion of relevant data.

Answer

Export the data to a public cloud storage service

Answer

Follow the standard 90-day retention policy

Answer

Delete the data and generate an audit log