212-89 Practice Test 3 — 10 Questions

Question 1

Which tool would you use to perform a live analysis of HTTP traffic and inspect for malicious payloads in real-time?

Accepted Answer

Wireshark. Wireshark is a protocol analyzer that captures and decodes live network traffic, allowing real-time inspection of HTTP requests and responses, including payload contents, headers, and body data. It can reassemble TCP streams and apply display filters (e.g., http.request) to isolate malicious payloads as they traverse the wire. This makes it the correct tool for live HTTP traffic analysis.

Answer

Nmap

Answer

Netstat

Answer

Syslog

Question 2

During an investigation into lateral movement, you notice an unusual RDP connection from a workstation to a domain controller. Which Wireshark filter would be most effective in isolating only the RDP traffic associated with that specific source IP to identify potential credential dumping activity?

Accepted Answer

tcp.port == 3389 && ip.src == 192.168.1.50. The filter 'tcp.port == 3389 && ip.src == 192.168.1.50' is correct because RDP operates over TCP port 3389, and the ip.src clause restricts capture to traffic originating from the specific workstation under investigation. This isolates the RDP session from that source to the domain controller, allowing the analyst to inspect the session for credential dumping artifacts or unusual keystroke patterns.

Answer

tcp.flags.syn == 1 && ip.src == 192.168.1.50

Answer

data.data == 3389

Answer

rdp.data && ip.dst == 192.168.1.50

Question 3

A web application is vulnerable to session fixation. What is the primary indicator of this attack in the logs?

Accepted Answer

A user session ID remains identical before and after a successful authentication event. Session fixation occurs when an attacker sets or knows a victim's session ID before authentication and the application fails to regenerate that ID after login. The primary log indicator is therefore a session ID that remains identical before and after a successful authentication event. This persistence of the pre-authentication session identifier is the defining signature of the vulnerability being exploited.

Answer

High volume of requests to the login page without POST data

Answer

The same session ID is associated with two different IP addresses within a short timeframe

Answer

A sudden spike in failed login attempts

Question 4

A web application is returning verbose error messages that include full stack traces and database query fragments to users. An attacker is using these messages to map the application's internal structure. Which remediation step should the incident handler recommend to the development team?

Accepted Answer

Configure the application to return generic error messages to users while logging detailed errors server-side.. Verbose error messages leak internal implementation details that aid attackers in mapping the application and crafting further attacks. The correct remediation is to return generic messages to users while retaining detailed error logging on the server for troubleshooting and forensic purposes. Disabling logging, enabling more verbose output, or migrating servers do not resolve the information disclosure.

Answer

Enable detailed error logging on the production server to capture more information about failures.

Answer

Disable all error logging to prevent attackers from accessing log files through the web server.

Answer

Move the application to a different server with a newer operating system to eliminate the errors.

Question 5

You suspect an incident involves an insider threat. Which step should be taken FIRST to preserve the integrity of the potential evidence while minimizing system downtime?

Accepted Answer

Capture a bit-stream image of the storage media. Creating a forensic image ensures that the current state is preserved before any volatile data is lost or system state changes.

Answer

Change the root password to lock out the attacker

Answer

Delete the suspicious user account

Answer

Reboot the compromised system to clear malicious memory

Question 6

Which THREE of the following tools would be most effective for performing live memory forensics on a compromised Windows workstation?

Accepted Answer

WinPmem. WinPmem (B) is a purpose-built, open-source memory acquisition driver for Windows that captures physical RAM to a raw image while preserving volatile evidence such as running processes, network connections, and injected code. Magnet RAM Capture (C) is a free forensic acquisition tool from Magnet Forensics that dumps physical memory on Windows systems into a .raw/.mem image suitable for later analysis. Volatility 3 (E) is the leading memory forensics framework that parses those acquired images to extract processes, handles, DLLs, registry hives, and malware artifacts, making it essential for the analysis phase of live memory forensics. CCleaner (A) is a system-cleaning utility that deletes temporary files and traces, which would destroy volatile evidence rather than preserve it. Windows Update (D) is a patching service with no forensic acquisition or analysis capability and is irrelevant to memory forensics.

Answer

CCleaner

Answer

Windows Update

Question 7

Which THREE pieces of information should be included in an incident triage report?

Accepted Answer

The date and time of the incident discovery.. Option A is correct because recording the date and time of incident discovery establishes the timeline anchor needed for triage prioritization, SLA tracking, and later forensic reconstruction of the event sequence. Option C is correct because identifying the systems and services impacted scopes the incident, enabling responders to determine business impact, prioritize containment, and decide whether escalation or isolation is required. Option D is correct because initial findings or indicators of compromise (IOCs) such as suspicious IP addresses, file hashes, or anomalous log entries give the triage team the technical evidence needed to classify the incident and guide the immediate response. Option B is not appropriate because private health records are sensitive PII/PHI that are irrelevant to triage and would introduce unnecessary privacy and compliance risk. Option E is not appropriate because a list of employees with building access is unrelated to the technical and operational facts needed to triage a security incident.

Answer

The private health records of the affected users.

Answer

The names of all employees who have access to the building.

Question 8

During a web application incident, an analyst discovers that an attacker is using SQL injection to extract data from a backend database. Which SQL injection technique involves the attacker inferring data by asking the database true/false questions and observing the application's response?

Accepted Answer

Blind SQL injection (boolean-based). Blind SQL injection (boolean-based) is characterized by the attacker asking the database true/false questions and observing changes in the application's behavior, such as different content or status codes. This technique is used when the application does not return direct query results or errors. The attacker can then systematically extract data by testing conditions.

Answer

Time-based SQL injection

Answer

Error-based SQL injection

Answer

Union-based SQL injection

Question 9

An employee receives a suspicious email asking to verify account details by clicking a link. What is the most effective user behavior to mitigate this?

Accepted Answer

Use the organization's 'Report Phishing' tool. Reporting the suspicious email through the provided 'Report Phishing' button is the most effective user action.

Answer

Reply to the sender to verify

Answer

Ignore and delete the email without reporting

Answer

Forward it to a friend for a second opinion

Question 10

You are choosing a destination for forensic image storage. What is the most critical characteristic of this storage?

Accepted Answer

Write-protection and tamper-evident logging. The storage must be write-blocked or read-only once data is written to ensure the evidence cannot be altered.

Answer

Fast read/write speeds

Answer

Cloud-based accessibility

Answer

High storage capacity