212-89 Practice Test 4 — 25 Questions

Question 1

When an email incident is resolved, why is it necessary to update the organization's blocklist?

Accepted Answer

To prevent re-occurrence of the same campaign. Updating the blocklist after resolving an email incident is a proactive measure to prevent the same malicious campaign from affecting the organization again. By adding the identified malicious sender addresses, domains, or IPs to the blocklist, future emails from the same source are automatically blocked, thus breaking the attack chain. This directly reduces the risk of re-infection or re-compromise from the same threat actor. The other options do not address the primary security objective of incident response.

Answer

To comply with legal regulations

Answer

To improve system performance

Answer

To delete the user's account

Question 2

Which TWO types of evidence are considered 'volatile'?

Accepted Answer

System memory (RAM).. RAM and network connections are lost when power is removed or the system is reset.

Answer

Optical disc contents.

Answer

Hard drive data.

Answer

Printed log files.

Question 3

You are performing a post-incident review. Which action is the most important to ensure that the 'Lessons Learned' process effectively improves future response capabilities?

Accepted Answer

Documenting the root cause and defining specific, actionable process changes. The root cause analysis and resulting action items are what drive actual improvement in the IR lifecycle.

Answer

Updating the password policy

Answer

Archiving all forensic images for ten years

Answer

Assigning blame to the employee who made the error

Question 4

Which syslog facility would typically be configured on a network device to send audit logs to a central server?

Accepted Answer

local0. Syslog facilities local0 through local7 are reserved for local or custom use, and network devices (routers, switches, firewalls) conventionally use local0 (or another local facility) to tag audit and event logs sent to a central syslog server. This lets administrators separate device-generated audit logs from system daemons like kernel, cron, or mail in the central collector's configuration. Using local0 ensures the logs are routed and stored according to the organization's audit retention policy.

Answer

kernel

Answer

cron

Answer

mail

Question 5

When responding to a SQL injection incident, which TWO areas of the database server logs should be prioritized for review?

Accepted Answer

Database user activity/audit logs. Option C (database user activity/audit logs) is correct because audit logs record authentication events, privilege changes, and the specific accounts and source hosts involved in suspicious activity, which is essential for identifying who executed the injection and what they accessed. Option E (database query execution logs) is correct because they capture the actual SQL statements sent to the server, allowing responders to spot injected payloads such as UNION SELECT, OR 1=1, or stacked queries and to determine which tables or data were touched. Together these two log sources provide the attacker identity and the malicious query evidence needed for containment and forensic reconstruction. Option A (OS kernel logs) is not prioritized because it deals with hardware, driver, and system-level events rather than SQL activity. Option B (backup completion logs) only shows whether backup jobs succeeded and has no bearing on detecting or tracing an injection. Option D (network interface statistics) provides traffic counters and throughput data, not the application-layer SQL content or user context required for this investigation.

Answer

Operating system kernel logs

Answer

Database backup completion logs

Answer

Network interface statistics

Question 6

A first responder is using a 'Live Response' toolkit. What is the main characteristic of these tools?

Accepted Answer

They are designed to run from a USB drive to minimize impact on the target disk.. Live response tools are designed to collect data from a running system with minimal impact on the target environment.

Answer

They provide permanent remote access to the attacker.

Answer

They require the computer to be turned off.

Answer

They automatically delete evidence after collection.

Question 7

Which TWO of the following are essential components of an effective Incident Response (IR) plan?

Accepted Answer

List of key stakeholders and their contact details. Option C is correct because an effective IR plan must include a current list of key stakeholders — such as the CISO, legal counsel, IT operations, HR, communications, and possibly law enforcement or external forensics contacts — along with their contact details, so they can be reached immediately during an incident. Option D is correct because clearly defined roles and responsibilities (for example, incident commander, communications lead, forensics analyst, and remediation owner) ensure each team member knows exactly what to do, preventing confusion and duplicated effort during a high-pressure event. The remaining options do not belong: a full backup of financial records (A) is a data protection/recovery measure rather than an IR plan component, HR time-tracking instructions (B) are unrelated to incident handling, and a list of employees' social security numbers (E) is sensitive PII that would create a serious security and privacy risk if stored in an IR plan.

Answer

Full backup of the company's financial records

Answer

Detailed instructions on how to use the HR time-tracking system

Answer

A list of all employees' social security numbers

Question 8

A first responder arrives at a scene where a laptop is suspected to contain evidence of a data breach. The laptop is powered on and logged in. What is the first step the responder should take to preserve volatile evidence?

Accepted Answer

Take photographs of the screen and connected peripherals.. The first step in preserving volatile evidence is to document the current state without altering it. Photographing the screen and peripherals captures visual information that may be lost if the system is powered down or the user interacts with it. This non-invasive action supports later analysis and maintains the integrity of the scene. Other actions like removing power or running tools should come after documentation.

Answer

Run a live forensic tool to capture RAM and then shut down the system.

Answer

Ask the user to close all applications and log off to preserve the system state.

Answer

Immediately remove the laptop's battery to prevent remote wipe.

Question 9

During an investigation, you need to verify the integrity of a system configuration file. You have the original known-good hash. What does it mean if the hash of the current file matches the known-good hash?

Accepted Answer

The file contents are identical to the known-good state. If the hashes match, the file content has not changed, ensuring the file's integrity.

Answer

The system is definitely not compromised

Answer

The file was recently updated by an administrator

Answer

The file is free of malware

Question 10

You are configuring a SIEM for long-term storage of investigation logs. Which feature is most important to prevent evidence tampering?

Accepted Answer

WORM (Write Once, Read Many) storage media. WORM (Write Once, Read Many) storage ensures that once log data is written, it cannot be modified or deleted for a defined retention period, providing immutable evidence that satisfies chain-of-custody and regulatory requirements. This is the most important feature for preventing evidence tampering in long-term investigation log storage.

Answer

Automatic log compression

Answer

Log deduplication

Answer

Real-time log alerting

Question 11

Which TWO of the following activities are considered 'Eradication' steps in the incident response lifecycle?

Accepted Answer

Re-imaging infected workstations. In the incident response lifecycle, Eradication focuses on eliminating the threat from the environment, so option B (Re-imaging infected workstations) is correct because rebuilding a compromised host from a known-good image removes any residual malware, backdoors, or persistence mechanisms that cannot be reliably cleaned. Option C (Removing malicious files and registry keys) is also correct because deleting identified malware artifacts and associated persistence entries (e.g., Run keys, services, scheduled tasks) directly eliminates the adversary's foothold. Option A (Writing an incident report) belongs to the post-incident/lessons-learned phase, not eradication. Option D (Conducting a post-incident meeting) is part of the post-incident activity/lessons-learned stage. Option E (Notifying the news media) is a communications/PR action and is not an eradication step.

Answer

Writing an incident report

Answer

Conducting a post-incident meeting

Answer

Notifying the news media

Question 12

A financial institution's SOC detects anomalous SMB traffic from a workstation to multiple servers, including attempts to access ADMIN$ shares. Which TWO of the following artifacts should an incident responder prioritize to confirm lateral movement via SMB? (Choose two.)

Accepted Answer

Windows Security Event ID 5140 for network share access. To confirm SMB lateral movement, focus on events that show network logons and share access. Event ID 4624 with Logon Type 3 records network logons, which are used when connecting to SMB shares. Event ID 5140 logs access to network shares, including administrative shares. Together, they provide evidence of an attacker using compromised credentials to access remote systems via SMB. Other events either lack specificity or do not directly indicate SMB share access.

Answer

Windows Security Event ID 4776 for credential validation

Answer

Windows Security Event ID 4688 with process name psexec.exe

Answer

Windows Security Event ID 5156 for Windows Filtering Platform connection

Question 13

You are analyzing a malware sample that uses Domain Generation Algorithms (DGA). What is the primary purpose of DGA in malware?

Accepted Answer

Evading static C2 blocklists. DGA is used to generate a large number of domain names daily, making it difficult for defenders to block the command-and-control server effectively.

Answer

Spreading via local network shares

Answer

Encrypting the malware payload

Answer

Hiding processes from Task Manager

Question 14

During an email incident investigation, you need to analyze a malicious macro embedded in a Word document without executing it. Which tool is most appropriate for extracting and examining the macro code?

Accepted Answer

olevba from the oletools suite. olevba is designed specifically for static analysis of VBA macros in Office documents. It extracts macro code, highlights suspicious keywords, and helps analysts understand the macro's behavior without executing it, which is critical for safe incident response.

Answer

Volatility

Answer

Wireshark

Answer

Nmap

Question 15

What is the purpose of 'Sandboxing' in email security?

Accepted Answer

To safely execute and observe file behavior. Sandboxing in email security involves detonating suspicious attachments or URLs in an isolated, instrumented environment to observe their runtime behavior—such as file system changes, network callbacks, or process injections—without risking the production network. This dynamic analysis catches zero-day malware and evasive threats that static signatures miss, because the sandbox watches what the code actually does rather than what it looks like. The option 'safely execute and observe file behavior' precisely captures this controlled detonation and behavioral monitoring purpose.

Answer

To provide a backup of the email

Answer

To store malicious emails for future reference

Answer

To encrypt the email body

Question 16

An analyst receives a report of a phishing email. Which email header field is most reliable for verifying the path taken by the email through intermediate mail transfer agents?

Accepted Answer

Received. The 'Received' header field is added by each mail transfer agent (MTA) as the message passes through it, creating a chronological list of hops. It is the most reliable field for tracing the path an email took, including originating IP and intermediate servers. Analysts read Received headers from bottom to top to follow the actual delivery chain.

Answer

X-Originating-IP

Answer

Return-Path

Answer

X-Mailer

Question 17

You have identified a potential Advanced Persistent Threat (APT) in your network. Which evidence preservation strategy is required to maintain the validity of the logs found in a SIEM?

Accepted Answer

Applying a cryptographic hash to the exported logs. Generating cryptographic hashes for log files ensures they can be verified as untampered during later analysis.

Answer

Moving the logs to a backup server

Answer

Printing the logs to a secure PDF

Answer

Taking a screenshot of the SIEM dashboard

Question 18

You suspect a file on a Linux server is malicious. What command can you use to obtain the MD5 hash of the file?

Accepted Answer

md5sum [filename]. The md5sum utility is the standard Linux command-line tool for computing and verifying MD5 message digests. Running 'md5sum [filename]' outputs the 128-bit MD5 hash followed by the filename, which is exactly what an incident responder needs to fingerprint a suspected malicious file. It is part of GNU coreutils and is present on virtually every Linux distribution by default.

Answer

checkhash [filename]

Answer

hash -md5 [filename]

Answer

echo md5 [filename]

Question 19

A malware incident has been contained and eradicated on an infected Windows server. Before returning the server to production, you need to verify that no malicious processes or unauthorized autostart entries remain. Which action best supports this validation?

Accepted Answer

Compare current autoruns, services, scheduled tasks, and running processes against a known-good baseline.. Validation after eradication requires confirming that no malicious persistence or processes remain. Comparing autoruns, services, scheduled tasks, and running processes against a known-good baseline exposes unauthorized changes that signature-based scans might overlook. This approach directly verifies the eradication was complete and supports a defensible decision to return the server to production.

Answer

Restore the server from a backup taken before the incident.

Answer

Reboot the server and confirm it boots successfully.

Answer

Run a full antivirus scan and review the scan report.

Question 20

You are managing chain of custody for a physical server seized during an investigation. What is the most critical action to ensure the evidence remains admissible in court?

Accepted Answer

Logging every individual who accessed, transported, or stored the device. Maintaining a verifiable, gapless log of every person who touched the evidence is the core requirement of chain of custody.

Answer

Taking photographs of the server location

Answer

Using an anti-static bag for transport

Answer

Hashing the drive contents immediately