212-89 Practice Test 3 — 25 Questions

Question 1

Which THREE of the following are legal considerations when handling an incident?

Accepted Answer

Compliance with regional data breach notification laws. Data privacy, regulatory reporting, and evidence admissibility are critical legal areas.

Answer

The cost of upgrading the company's hardware

Answer

The speed of the internet connection used for analysis

Question 2

While investigating a server compromise, you need to ensure the digital evidence collected from the RAID array is admissible in court. What is the most critical requirement for the chain of custody?

Accepted Answer

Maintaining a detailed log of every individual who accessed or transferred the evidence. Chain of custody requires a chronological log of who handled the evidence, where it was stored, and proof that it was not altered, typically via cryptographic hashes.

Answer

Deleting temporary files to prevent cross-contamination

Answer

Encrypting the collected evidence folder with AES-256

Answer

Creating a bit-stream image of the disk drive

Question 3

You are reviewing logs from an EDR and see an indicator of 'Living off the Land' (LotL). Which tool usage would be considered an LotL attack?

Accepted Answer

Executing encoded PowerShell scripts. Using 'PowerShell.exe' to execute base64-encoded scripts directly from memory is a quintessential LotL technique.

Answer

Running a commercial vulnerability scanner

Answer

Installing a custom rootkit driver

Answer

Downloading an EXE from an unknown site

Question 4

You have identified a malicious DLL that is being loaded by a legitimate process. Which tool allows you to view which DLLs are loaded by a specific process?

Accepted Answer

Process Explorer. Process Explorer's lower pane (when configured for DLLs) provides a clear list of all loaded modules/DLLs for any selected process.

Answer

Task Scheduler

Answer

Disk Cleanup

Answer

Device Manager

Question 5

Which TWO of the following are considered 'Legal Considerations' during the Incident Handling process that must be integrated into the response plan?

Accepted Answer

Ensuring compliance with data breach notification statutes. Legal considerations include adhering to privacy regulations (e.g., reporting requirements) and maintaining the integrity of the evidence for potential litigation.

Answer

Configuring automated IP blocking on the edge firewall

Answer

Updating the organizational server maintenance schedule

Answer

Running a vulnerability scan on the impacted systems

Question 6

Which document is essential to maintain during a malware incident to ensure accountability and track the actions taken by the incident response team?

Accepted Answer

Incident Log. An Incident Log (or Chain of Custody record) is critical for documenting every step, tool, and decision made during the response process.

Answer

User Manual

Answer

System Backup

Answer

Vulnerability Assessment Report

Question 7

You are using YARA to detect a specific strain of ransomware. You want to match a file if it contains a specific hex string OR a specific string value. How do you construct this in your rule?

Accepted Answer

condition: $a or $b. YARA uses the 'or' operator within the condition section to evaluate multiple criteria, allowing a match if either condition is met.

Answer

condition: $a + $b

Answer

condition: $a != $b

Answer

condition: $a && $b

Question 8

After eradicating a malware infection, you need to ensure the system is hardened against future occurrences. Which action is most effective against fileless malware?

Accepted Answer

Implement PowerShell Constrained Language Mode. Disabling PowerShell for non-administrative users or implementing Constrained Language Mode is a key defense against fileless script-based attacks.

Answer

Enable auto-updates for all applications

Answer

Install an extra antivirus

Answer

Enable full disk encryption

Question 9

Which THREE of the following tools would be most effective for performing live memory forensics on a compromised Windows workstation?

Accepted Answer

WinPmem. Volatility, WinPmem, and Magnet RAM Capture are all specialized tools for volatile memory acquisition and analysis.

Answer

CCleaner

Answer

Windows Update

Question 10

Which TWO of the following are common signs of a compromised switch in a local area network?

Accepted Answer

Unrecognized trunk ports enabled. MAC flooding and unauthorized trunking are common signs of layer 2 switch compromise.

Answer

Normal spanning-tree convergence

Answer

Decreased CPU usage on the switch

Answer

Stable port security status

Question 11

A system has been infected by a worm that is spreading across the network. What is the most immediate action to stop the spread?

Accepted Answer

Block propagation ports at the network level. Isolating the affected segments or blocking the ports used for the worm's propagation (e.g., SMB/445) is essential to stop lateral movement.

Answer

Update the BIOS on all machines

Answer

Disable the internet gateway

Answer

Email all users to reboot

Question 12

Which THREE of the following represent critical log sources that should be correlated when investigating a potential network-based exfiltration incident?

Accepted Answer

DNS query logs for destination domain lookup. Firewall logs, NetFlow, and DNS logs provide the full picture of an outbound exfiltration event.

Answer

NTP server logs

Answer

Print server logs

Question 13

During the 'Recovery' phase of the malware incident, what must be done to ensure the environment is safe before reconnecting the restored systems?

Accepted Answer

Perform a vulnerability scan. Vulnerability scanning confirms that the original entry points or vulnerabilities used by the malware have been patched or mitigated.

Answer

Delete all user profiles

Answer

Upgrade the OS to the latest version

Answer

Reformat all external hard drives

Question 14

Which THREE of the following indicators are found in email-based malware delivery?

Accepted Answer

Hidden links pointing to malicious domains. Malicious emails often contain suspicious attachments, unexpected links (URLs) leading to malicious sites, and deceptive sender addresses to trick users.

Answer

The email has a standard company footer

Answer

The email was sent during business hours

Question 15

During a malware analysis, which TWO of the following indicators are typically used to identify persistence mechanisms in the Windows registry?

Accepted Answer

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services. The 'Run' keys and 'Services' keys are the most common locations malware uses to ensure automatic execution upon boot.

Answer

HKEY_CLASSES_ROOT\CLSID

Answer

HKEY_CURRENT_USER\Control Panel\Desktop

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Question 16

You are investigating a compromised Linux host. Using 'tcpdump' to capture traffic on interface eth0 to analyze C2 communication on port 443, which command is most efficient for saving the output to a file for later analysis in Wireshark?

Accepted Answer

tcpdump -i eth0 port 443 -w capture.pcap. The -w flag is used in tcpdump to write raw packets to a .pcap file.

Answer

tcpdump -c eth0 port 443

Answer

tcpdump -i eth0 port 443 > capture.txt

Answer

tcpdump -r capture.pcap port 443

Question 17

Which TWO of the following techniques would an attacker likely use to hide lateral movement traffic within a network?

Accepted Answer

Masquerading malicious traffic on common ports like 443. Encrypted tunnels (SSH/TLS) and protocol masquerading are the primary ways to hide lateral movement.

Answer

Using clear-text Telnet for all communication

Answer

Sending traffic exclusively during business hours

Answer

Disabling all logging on the source host

Question 18

An attacker is using a slow-rate HTTP POST request to exhaust server resources. Which ModSecurity directive should be adjusted to mitigate this behavior?

Accepted Answer

SecRequestBodyLimit. ModSecurity's 'SecRequestBodyLimit' and 'SecRequestBodyNoFilesLimit' manage the size and rate of incoming request bodies.

Answer

SecDataDir

Answer

SecRuleEngine DetectionOnly

Answer

SecResponseBodyLimit

Question 19

A web server log shows repeated '403 Forbidden' errors for a specific directory. What is the most likely cause during an incident?

Accepted Answer

Directory traversal or unauthorized access attempts are being blocked. Repeated 403 errors often indicate an attacker performing forced browsing or directory traversal attempts that are being blocked by server-side permission settings.

Answer

The user session has expired

Answer

The requested file does not exist

Answer

The server is offline

Question 20

Which TWO of the following activities are considered 'Eradication' steps in the incident response lifecycle?

Accepted Answer

Re-imaging infected workstations. Eradication involves removing the malicious components and restoring clean systems to normal operations.

Answer

Writing an incident report

Answer

Conducting a post-incident meeting

Answer

Notifying the news media