212-89 Practice Test 4 — 25 Questions

Question 1

During a Cross-Site Scripting (XSS) incident, you notice the WAF is blocking legitimate user sessions. What is the most effective tuning step to prevent false positives while maintaining protection?

Accepted Answer

Create a granular exclusion for the specific parameter triggering the alert. Creating a targeted exception for a specific URI or parameter prevents over-blocking while keeping the signature active for the rest of the application.

Answer

Disable the entire XSS protection rule set

Answer

Implement a negative security model

Answer

Switch the WAF from Blocking mode to Transparent mode

Question 2

You are performing incident response on a web server compromised via Directory Traversal. What command is most useful for identifying the specific files accessed in the logs?

Accepted Answer

grep -r "../" /var/log/apache2/access.log. Using grep to search for traversal sequences like '../' within the access logs is the standard method for finding these attempts.

Answer

grep -r "SELECT" /var/log/apache2/access.log

Answer

grep -r "<script>" /var/log/apache2/access.log

Answer

tail -f /var/log/auth.log

Question 3

You suspect a CSRF (Cross-Site Request Forgery) attack. What log entry pattern confirms this?

Accepted Answer

Referer header showing a domain different from the application's domain. CSRF attacks originate from a different site. Checking the 'Referer' header in the logs for unexpected domains is the primary method for detection.

Answer

Multiple POST requests without a corresponding GET request

Answer

High volume of 401 Unauthorized errors

Answer

A sudden change in the session cookie value

Question 4

Which TWO log file attributes are essential for identifying the source of an attack coming through a load balancer?

Accepted Answer

X-Forwarded-For header. Since a load balancer sits between the client and the server, preserving the client's IP and original request path is critical.

Answer

Server uptime count

Answer

Local time of the web server

Answer

The load balancer's internal management port

Question 5

An attacker uses a 'Homograph Attack' to spoof a domain. How does the analyst detect this?

Accepted Answer

Inspecting the Punycode representation of the domain. Homograph attacks use look-alike characters (like Cyrillic 'а' instead of Latin 'a') that are visible when inspecting the Punycode version of the domain.

Answer

Scanning the email for attachments

Answer

Checking the SPF record

Answer

Looking for a valid TLS certificate

Question 6

An analyst identifies that an email originated from an unauthorized IP address despite passing SPF. What is the most likely cause?

Accepted Answer

The SPF record is too broad. If SPF passes but the IP is wrong, it is likely the attacker is using an email service that is part of the same SPF-authorized infrastructure (like a shared cloud provider).

Answer

The user's computer is infected

Answer

The domain has no DMARC record

Answer

The mail server was misconfigured

Question 7

If a user receives an email with an attachment that is a 'compressed password-protected file', why is this a red flag?

Accepted Answer

It prevents security gateways from scanning the contents. Password protection hides the file contents from automated antivirus scanners.

Answer

It requires too much storage space

Answer

It is a sign of high security

Answer

It violates corporate policy

Question 8

Which action should be taken after an email incident is contained and the indicators are identified?

Accepted Answer

Update security controls and user awareness programs. Post-incident activities include updating policies and procedures to prevent recurrence.

Answer

Ignore the event to focus on the next

Answer

Decommission the email server

Answer

Immediately delete all logs

Question 9

A stakeholder asks you to prioritize the recovery of a compromised system. According to incident response best practices, what is your first responsibility?

Accepted Answer

Identify and confirm the security incident.. Triage and identification must occur before any recovery or containment steps to ensure the scope is understood.

Answer

Notify legal counsel.

Answer

Update firewall rules.

Answer

Rebuild the system from backup.

Question 10

An organization uses Microsoft 365. Which feature should an admin use to globally remove a malicious phishing email from all user mailboxes?

Accepted Answer

Search and Purge in Microsoft 365 Defender. Search and Purge within the Microsoft 365 Defender portal is the standard tool for post-delivery removal.

Answer

Conditional Access policies

Answer

Exchange Transport Rules

Answer

Mail Flow Connector configuration

Question 11

An analyst is drafting an email to a user who reported a phishing attempt. What is the most important tone to maintain?

Accepted Answer

Professional, calm, and informative. The tone should be professional, reassuring, and helpful to encourage future reporting.

Answer

Accusatory, to discourage clicking

Answer

Technical and jargon-heavy

Answer

Alarmist, to ensure they remain scared

Question 12

When an email incident is resolved, why is it necessary to update the organization's blocklist?

Accepted Answer

To prevent re-occurrence of the same campaign. Updating the blocklist prevents future delivery of emails from the same source or with the same malicious artifacts.

Answer

To comply with legal regulations

Answer

To improve system performance

Answer

To delete the user's account

Question 13

Which THREE of the following are common indicators of a phishing email?

Accepted Answer

Urgent or threatening language requiring immediate action. Suspicious sender domains, mismatched URLs, and sense of urgency are primary phishing indicators.

Answer

The email uses standard corporate branding

Answer

The email is sent during business hours

Question 14

If a phishing email bypassed the perimeter email gateway, what is the next logical step in the incident response process?

Accepted Answer

Attempt to contain the threat by removing the email. After detection, containment is the critical priority to prevent further impact.

Answer

Document the incident in the SIEM

Answer

Update the firewall blocklist

Answer

Wait for the user to report it again

Question 15

What is the purpose of 'Sandboxing' in email security?

Accepted Answer

To safely execute and observe file behavior. Sandboxing executes a file in a controlled, virtual environment to observe its behavior before allowing it to reach the end user.

Answer

To provide a backup of the email

Answer

To store malicious emails for future reference

Answer

To encrypt the email body

Question 16

When performing manual phishing triage, which action should an analyst perform first after identifying a suspicious URL in an email body?

Accepted Answer

Run the URL against an automated sandbox analysis tool. Before interaction, you must detonate in a sandbox to ensure safety.

Answer

Click the URL to inspect the landing page

Answer

Block the sender domain immediately

Answer

Forward the email to the user for confirmation

Question 17

Which TWO of the following steps are required when performing a post-mortem analysis of an email incident?

Accepted Answer

Evaluating the performance of security controls. Reviewing incident logs and evaluating the effectiveness of security controls are critical post-mortem steps.

Answer

Promoting the security analyst involved

Answer

Contacting the local law enforcement authorities

Answer

Deleting all evidence to maintain privacy

Question 18

Which THREE of the following could be considered 'indicators of compromise' (IOCs) for an email incident?

Accepted Answer

Malicious URL within the email body. Sender IP addresses, malicious URLs, and file hashes are standard IOCs.

Answer

The name of the email service provider

Answer

The user's password

Question 19

You are responding to a web-based attack. Which log source is most critical for identifying the origin of a SQL injection attempt?

Accepted Answer

Web server access logs.. Web server access logs contain the request methods and query strings used to deliver the attack payload.

Answer

DHCP logs.

Answer

Windows System Event log.

Answer

Application crash dumps.

Question 20

Which protocol is used in conjunction with SPF and DKIM to provide instructions to the receiver on how to handle emails that fail authentication?

Accepted Answer

DMARC. DMARC provides the policy instructions for SPF and DKIM failures.

Answer

SMTPS

Answer

IMAP

Answer

POP3