212-89 Practice Test 5 — 25 Questions

Question 1

Which THREE of the following indicators are found in email-based malware delivery?

Accepted Answer

Hidden links pointing to malicious domains. Option A is correct because email-based malware delivery commonly relies on hidden or obfuscated hyperlinks (e.g., HTML anchor text or URL shorteners) that redirect victims to malicious domains hosting exploit kits or credential-phishing pages. Option B is correct because a sender address that does not match the organization's legitimate domain is a classic spoofing/impersonation indicator, often revealed by failed SPF, DKIM, or DMARC alignment checks. Option E is correct because suspicious attachments such as .zip archives or macro-enabled .docm files are frequent malware carriers used to deliver droppers, ransomware, or trojans when opened. Option C does not belong because a standard company footer is a normal, legitimate branding element and is not by itself an indicator of malicious delivery. Option D does not belong because the time of day an email is sent (business hours) is not a reliable technical indicator of malware delivery, since attackers can send messages at any time.

Answer

The email has a standard company footer

Answer

The email was sent during business hours

Question 2

When classifying the severity of an incident, which factor should carry the most weight in your decision-making process?

Accepted Answer

The potential impact on business availability and data integrity. The impact on business operations is the most significant factor in determining the urgency and scope of the response.

Answer

The number of security tools that flagged the alert

Answer

The time of day the incident occurred

Answer

The technical complexity of the exploit

Question 3

A stakeholder asks you to prioritize the recovery of a compromised system. According to incident response best practices, what is your first responsibility?

Accepted Answer

Identify and confirm the security incident.. According to incident response best practices (e.g., NIST SP 800-61), the first phase is preparation, but once an event is detected, the immediate responsibility is to identify and confirm whether a security incident has actually occurred. This involves validating alerts, scoping the event, and determining if it meets the organization's incident criteria. Only after confirmation should containment, eradication, and recovery actions (like rebuilding from backup) be taken. Notifying legal counsel or updating firewall rules are subsequent steps that depend on the confirmed incident.

Answer

Notify legal counsel.

Answer

Update firewall rules.

Answer

Rebuild the system from backup.

Question 4

In the context of the NIST Incident Response Life Cycle, which phase immediately follows the 'Detection and Analysis' phase, specifically focusing on limiting the scope of the compromise?

Accepted Answer

Containment. Containment is the phase where the responder takes action to stop the spread or further damage of the incident.

Answer

Recovery

Answer

Lessons Learned

Answer

Eradication

Question 5

An analyst identifies that an email originated from an unauthorized IP address despite passing SPF. What is the most likely cause?

Accepted Answer

The SPF record is too broad. SPF authorizes sending IPs via DNS TXT records. If the record uses an overly broad mechanism such as 'include' of a large third-party range, '+all', or a wide CIDR, an unauthorized IP inside that range will still pass SPF. The most likely cause is therefore an SPF record that is too permissive, allowing the spoofed source to authenticate.

Answer

The user's computer is infected

Answer

The domain has no DMARC record

Answer

The mail server was misconfigured

Question 6

What is the primary purpose of the 'Preparation' phase in the incident response lifecycle?

Accepted Answer

To establish the capabilities and resources for response. The Preparation phase in the incident response lifecycle exists to build the capabilities, tools, communication paths, and resources needed before an incident occurs, so the organization can respond effectively when one does. It covers establishing the IR team, acquiring tooling, defining policies and playbooks, and conducting training and exercises. This is distinct from the reactive phases (detection, containment, eradication, recovery) that only execute once an incident is underway.

Answer

To contain the threat

Answer

To analyze the incident after it happens

Answer

To provide training to end users

Question 7

Which THREE of the following roles are typically included in an IR team?

Accepted Answer

Human Resources Representative. The three roles marked correct are B, C, and E. Human Resources Representative (B) is typically included because HR manages employee-related aspects of an incident, such as insider threat investigations, disciplinary actions, and coordination of personnel communications. Incident Handler/Lead (C) is the core role that directs the technical response, triages alerts, contains and eradicates threats, and coordinates the overall IR lifecycle. Legal Counsel (E) is essential for advising on regulatory notification requirements, preserving evidence and chain of custody, managing liability, and ensuring compliance with laws such as GDPR or HIPAA. The unmarked options do not belong: the company's primary janitor (A) and web designer (D) have no defined IR responsibilities, authority, or technical/legal expertise relevant to incident response.

Answer

The company's primary janitor

Answer

The company's web designer

Question 8

A web application is behind a reverse proxy that forwards client requests. During an incident, you need to identify the true source IP of an attacker who is sending malicious requests. The web server logs show the IP of the reverse proxy instead of the client. Which HTTP header should you inspect in the web server logs to find the original client IP?

Accepted Answer

X-Forwarded-For. When a reverse proxy forwards requests, it typically adds the X-Forwarded-For header containing the original client IP. Web server logs must be configured to capture this header. Inspecting it allows incident responders to identify the true source IP of the attacker, which is essential for blocking, geolocation, and further investigation.

Answer

Host

Answer

User-Agent

Answer

Referer

Question 9

During a first response to a compromised server, you need to capture the contents of RAM. The server is a critical production system that cannot be taken offline. Which factor is most important to consider when selecting a memory acquisition tool for this scenario?

Accepted Answer

The tool must be able to acquire memory without causing a system crash or requiring a reboot.. When dealing with a critical production server that cannot be taken offline, the overriding concern is that the memory acquisition tool must not cause a system crash or require a reboot. A crash would disrupt services and destroy the volatile evidence you are trying to capture. Other factors like speed, disk writes, or remote capability are secondary to ensuring the system remains stable and operational during the acquisition process.

Answer

The tool must be able to acquire memory without any writes to the target system's disk.

Answer

The tool must be able to acquire memory from a remote location over the network.

Answer

The tool must be able to acquire memory at the fastest possible speed, regardless of system impact.

Question 10

An incident handler is analyzing a malware incident that used a phishing email. What is the most important field to check in the email header to determine the true origin of the email?

Accepted Answer

Received header. The Received header is the most important field because each mail server that handles a message prepends its own Received header, creating a chronological chain that traces the message's path from origin to destination. By reading the headers bottom-up (oldest first), an investigator can identify the originating IP address and mail server, which is essential for determining the true source of a phishing email. Subject, Message-ID, and Content-Type can all be trivially spoofed or fabricated by the sender and carry no routing information.

Answer

Subject line

Answer

Message-ID

Answer

Content-Type

Question 11

If a user receives an email with an attachment that is a 'compressed password-protected file', why is this a red flag?

Accepted Answer

It prevents security gateways from scanning the contents. Password-protected compressed archives (e.g., ZIP, RAR, 7z) cannot be inspected by email security gateways because the contents are encrypted. Attackers use this to smuggle malware past antivirus and sandbox scanning, since the gateway cannot decrypt the archive without the password, which is typically provided in the email body.

Answer

It requires too much storage space

Answer

It is a sign of high security

Answer

It violates corporate policy

Question 12

During an incident involving a compromised e-commerce web application, you need to determine whether an attacker used a stolen session cookie to access a user's account. Which HTTP header should you examine first in the web server access logs to identify the session token used in the malicious requests?

Accepted Answer

Cookie. The Cookie header is the only HTTP header that directly carries the session identifier used for authentication in cookie-based web applications. During a session hijacking investigation, correlating the Cookie value across requests allows you to confirm that an attacker used a stolen token. Other headers provide contextual information but lack the session token required to prove hijacking.

Answer

Referer

Answer

User-Agent

Answer

Authorization

Question 13

Which action should be taken after an email incident is contained and the indicators are identified?

Accepted Answer

Update security controls and user awareness programs. After containment and identification of indicators of compromise (IOCs), the post-incident phase requires updating security controls (e.g., email filters, blocklists, detection rules) and strengthening user awareness training to prevent recurrence. This aligns with the lessons-learned step of the incident response lifecycle.

Answer

Ignore the event to focus on the next

Answer

Decommission the email server

Answer

Immediately delete all logs

Question 14

Which TWO of the following are valid methods to identify a malicious attachment?

Accepted Answer

Performing behavioral analysis in a sandbox. Option B is correct because executing a suspicious attachment in an isolated sandbox lets analysts observe its runtime behavior—such as file system changes, registry modifications, network callbacks, and process creation—which reliably reveals malicious intent without risking production systems. Option C is correct because computing the file's cryptographic hash (e.g., MD5, SHA-1, or SHA-256) and comparing it to threat intelligence databases like VirusTotal or an internal IOC repository quickly determines whether the sample matches known malware. Option A is wrong because forwarding a potentially malicious attachment to the entire company propagates the threat and can trigger widespread compromise. Option D is wrong because opening the attachment on a personal device exposes that device and its data to infection and provides no controlled analysis. Option E is wrong because file size is not an indicator of maliciousness, so deleting based on size alone would both miss real threats and remove benign files.

Answer

Forwarding the email to the entire company

Answer

Opening the attachment on a personal device

Answer

Deleting the attachment based on its size

Question 15

During a network intrusion investigation, a first responder needs to capture volatile network configuration data from a compromised Windows server before it is rebooted. Which command should be used to display the current ARP cache?

Accepted Answer

arp -a. The ARP cache is a volatile artifact that maps IP addresses to MAC addresses and can reveal attacker presence or network topology. On Windows, the arp -a command lists these entries. Other commands like netstat, ipconfig, and route print provide different network information and do not display the ARP cache, so they are not suitable for this task.

Answer

ipconfig /all

Answer

route print

Answer

netstat -ano

Question 16

A first responder is documenting a compromised Linux server that is still running. The responder needs to record the system's current network state to later identify unauthorized connections and potential data exfiltration. Which two commands should the responder use to capture this volatile information? (Choose two.)

Accepted Answer

netstat -antp. To capture current network state on a live Linux server, the responder must use commands that display active connections, listening ports, and associated processes. Both netstat -antp and ss -tulpn provide this information; ss is the modern replacement for netstat. These outputs are volatile and must be saved to external media. The other commands address disk usage, kernel modules, or process lists, which do not fulfil the requirement to record network connections. Thus, the two network-focused commands are the correct choices.

Answer

ps aux

Answer

lsmod

Answer

df -h

Question 17

A junior responder arrives at a compromised Windows 10 workstation. Before touching the keyboard, they photograph the screen. The system is still powered on and a suspicious process is visible in Task Manager. The responder's supervisor asks them to capture the most volatile evidence first. Which action should the responder take next?

Accepted Answer

Capture the contents of RAM using a forensic memory acquisition tool.. The order of volatility dictates that the most perishable evidence must be collected first. RAM contains running processes, network connections, and encryption keys that are lost on shutdown or reboot. Capturing memory before any other action preserves this critical evidence. Antivirus scanning, shutdown, or network isolation would alter or destroy volatile data, so they are inappropriate as the immediate next step. Only memory acquisition aligns with the supervisor's instruction and standard first response practice.

Answer

Shut down the system and remove the hard drive for imaging.

Answer

Disconnect the network cable to isolate the workstation from the network.

Answer

Run a full antivirus scan to identify and remove the malicious process.

Question 18

An incident responder is examining a suspected business email compromise (BEC) message. The message passed SPF, DKIM, and DMARC alignment checks. The From display name is the CEO's name, but the actual envelope sender is a lookalike domain registered two days ago. Which characteristic of this message most directly explains why the authentication checks succeeded while the message is still malicious?

Accepted Answer

The lookalike domain published its own SPF, DKIM, and DMARC records that align with its own domain, so authentication passes for that domain even though it impersonates the CEO's display name.. Email authentication validates the domain that sent the message, not the display name shown to the user. A lookalike domain can publish its own SPF, DKIM, and DMARC records and pass all checks for itself, allowing a BEC message to appear legitimate. Incident handlers must inspect the actual envelope sender and domain age, not rely solely on authentication results.

Answer

The message used a compromised internal mailbox with a valid SPF record, so the sending IP passed SPF.

Answer

The receiving gateway disabled DMARC enforcement for executive names, which is why the checks passed.

Answer

The message was sent through a reputable bulk email service, which automatically signs all outbound mail with the recipient's domain keys.

Question 19

Which TWO actions are recommended for secure evidence storage?

Accepted Answer

Storing in a locked cabinet with access control.. Option B is correct because storing evidence in a locked cabinet with access control enforces physical security and restricts custody to authorized personnel, satisfying chain-of-custody requirements for secure evidence storage. Option E is correct because keeping a digital log of who accesses the storage creates an auditable access record that documents each individual's interaction with the evidence, which is essential for maintaining chain of custody and detecting unauthorized access. Options A, C, and D do not belong: mailing evidence without tracking breaks the chain of custody and provides no delivery confirmation, leaving evidence on a public desk exposes it to theft or tampering, and copying evidence to a public server for sharing violates confidentiality and integrity controls by allowing uncontrolled access.

Answer

Mailing evidence without tracking.

Answer

Leaving the evidence on a public desk.

Answer

Copying evidence to a public server for sharing.

Question 20

Which of the following is a symptom of an 'Email Forwarding Rule' attack?

Accepted Answer

Emails are being forwarded to an external address. Attackers set up auto-forwarding rules to intercept sensitive business communications without the user's knowledge.

Answer

The user's inbox is empty

Answer

The mailbox reached its size limit

Answer

The password was changed