212-89 Practice Test 2 — 30 Questions

Question 1

During the lessons learned phase of a P1 incident, you notice that the incident handling policy failed to define clear 'Rules of Engagement' for containment, leading to accidental service disruption. Which document should be updated to address this deficiency?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Incident Response Plan (IRP). The Incident Response Plan (IRP) contains the specific procedures and rules for containment, and it must be updated to prevent future operational failures.

Answer

The Corporate Acceptable Use Policy

Answer

The Network Topology Map

Answer

The Business Continuity Plan (BCP)

Question 2

An organization's CSIRT is activated for a suspected ransomware outbreak. The incident handler must decide whether to escalate the incident to management. According to the incident handling process, which factor is the MOST appropriate trigger for immediate escalation?

Accepted Answer

The incident affects a critical business system and has the potential to disrupt operations.. Escalation criteria in incident handling are based on business impact, scope, and urgency. A ransomware outbreak affecting a critical system with potential operational disruption clearly meets the threshold for immediate management notification. Technical details such as malware family or ticket status are secondary; the handler must focus on the potential harm to the organization and the need for management decisions.

Answer

The handler has completed the initial triage checklist.

Answer

The malware sample has been identified as a known ransomware family.

Answer

The incident has been assigned a ticket number in the incident tracking system.

Question 3

During a malware analysis, which TWO of the following indicators are typically used to identify persistence mechanisms in the Windows registry?

Accepted Answer

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services. Option C is correct because the HKLM\System\CurrentControlSet\Services key stores configuration for Windows services, including the ImagePath and Start values that malware commonly abuses to register a malicious service (for example, a kernel driver or auto-start service) so it launches at boot. Option E is correct because the HKLM\Software\Microsoft\Windows\CurrentVersion\Run key is a classic autostart location where entries execute programs at user logon, making it a primary persistence mechanism for malware. Option A is not a persistence indicator per se; HKCR\CLSID holds COM class registration data, which can be abused for hijacking but is not a standard auto-start persistence key. Option B is not a persistence mechanism; the Control Panel\Desktop key stores user interface settings such as wallpaper and screen saver configuration. Option D is not a persistence mechanism; MountPoints2 records per-user mounted volume information and is more relevant to forensic artifact tracking than to autostart persistence.

Answer

HKEY_CLASSES_ROOT\CLSID

Answer

HKEY_CURRENT_USER\Control Panel\Desktop

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Question 4

Which TWO of the following are common signs of a compromised switch in a local area network?

Accepted Answer

Unrecognized trunk ports enabled. Option A is correct because an unrecognized or unauthorized trunk port enabled on a switch is a classic indicator of compromise—attackers configure trunk links (e.g., 802.1Q) to carry traffic for multiple VLANs and perform VLAN hopping or intercept traffic that should remain segmented. Option D is correct because unexpected MAC address table growth indicates MAC flooding, where an attacker overwhelms the switch's CAM table with spoofed source MACs, forcing it into fail-open hub behavior so traffic is flooded to all ports for sniffing. The unmarked options do not belong: normal spanning-tree convergence (B) is expected healthy behavior, decreased CPU usage (C) is not a compromise sign (attacks typically raise CPU load), and a stable port security status (E) reflects normal, secure operation rather than an indicator of compromise.

Answer

Normal spanning-tree convergence

Answer

Decreased CPU usage on the switch

Answer

Stable port security status

Question 5

A security team is reviewing their incident handling process after a recent data breach. They want to ensure that their eradication phase is effective. Which TWO activities are essential during the eradication phase? (Choose two.)

Accepted Answer

Applying security patches to vulnerable systems. Eradication involves removing the threat and its root cause. Deleting malicious files eliminates the immediate malware, while applying patches closes the vulnerability that was exploited. These actions ensure the threat is fully removed and cannot easily recur. Other options are containment or recovery activities.

Answer

Blocking the attacker's IP address at the firewall

Answer

Restoring data from backups

Answer

Conducting a lessons learned meeting

Question 6

A user reports their Windows 10 workstation is running very slowly and displaying unexpected pop-up ads in the browser. The incident handler suspects an adware infection. After isolating the machine, which Windows tool should the handler use to identify the malicious process consuming CPU and its associated network connections?

Accepted Answer

Resource Monitor. Resource Monitor offers a granular view of per-process resource utilization and network activity, enabling the handler to pinpoint the adware process causing high CPU usage and pop-ups. It shows which process is making network connections, which is critical for understanding the adware's behavior. Task Manager lacks network details, Event Viewer lacks real-time process data, and Performance Monitor is not designed for quick per-process network correlation.

Answer

Task Manager

Answer

Performance Monitor

Answer

Event Viewer

Question 7

During a malware incident on a Windows 10 workstation, you observe that a scheduled task named "UpdaterSvc" executes a binary in C:\Users\Public\svchost.exe every 15 minutes and re-creates its own registry Run key if deleted. The user reports the malware reappears after each cleanup. Which containment action BEST addresses this persistence while preserving forensic evidence?

Accepted Answer

Disconnect the workstation from the network, capture a memory image, then delete the scheduled task and quarantine the binary.. Effective containment for self-healing malware requires isolating the host to stop external communication and preserving volatile evidence before making changes. Capturing memory first retains injected code and process artifacts, then removing the scheduled task and quarantining the binary eliminates the persistence that re-creates the Run key, preventing reinfection after cleanup.

Answer

Run a full antivirus scan on the workstation while it remains connected so the vendor cloud can identify the malware family.

Answer

Immediately reimage the workstation without collecting volatile data, because the malware will otherwise return.

Answer

Disable the user account, delete the C:\Users\Public\svchost.exe file, and reboot the workstation to clear the infection.

Question 8

During a malware incident, you observe that a compromised system is communicating with a known command-and-control (C2) server at 203.0.113.45 over TCP port 443. You need to block this communication at the network perimeter to prevent further data exfiltration. Which action should you take?

Accepted Answer

Create an outbound firewall rule to block traffic to 203.0.113.45 on port 443. The compromised system initiates outbound connections to the C2 server, so blocking outbound traffic to that specific IP and port is the most effective way to sever communication. This action prevents data exfiltration and further instructions from the attacker. It is targeted and minimizes disruption to legitimate traffic.

Answer

Add a static route to null0 for 203.0.113.45 on the internal router

Answer

Enable deep packet inspection (DPI) to block all HTTPS traffic

Answer

Create an inbound firewall rule to block traffic from 203.0.113.45

Question 9

What is the 'First Responder Toolkit' used for during an incident?

Accepted Answer

To collect forensic artifacts without modifying the target system.. A first responder toolkit provides pre-configured, trusted tools for incident triage and data collection.

Answer

To install new security software.

Answer

To permanently delete malicious files.

Answer

To provide remote access for the attacker.

Question 10

Which TWO criteria must a first responder satisfy when choosing a tool for a toolkit?

Accepted Answer

The tool must be known to have minimal impact on the target system.. Tools must be trusted and cause minimal impact on the subject system.

Answer

The tool must run on a cloud-based server.

Answer

The tool must be proprietary and expensive.

Answer

The tool must be able to delete the malware.

Question 11

A user's Windows 10 workstation is suspected of being infected with fileless malware that resides only in memory and executes PowerShell commands. The incident handler needs to capture volatile evidence from the system before it is powered off. Which tool is specifically designed for acquiring a memory dump from a Windows system?

Accepted Answer

WinPmem. Fileless malware operates in memory, leaving little to no artifacts on disk. Capturing a memory dump is critical to preserve evidence such as injected code, running processes, and network connections. WinPmem is a dedicated memory acquisition tool for Windows, ensuring a forensically sound capture of volatile data before the system is powered off or rebooted.

Answer

Nmap

Answer

FTK Imager

Answer

Wireshark

Question 12

You are an incident handler assigned to a case involving a suspected insider threat. Before collecting evidence from an employee's workstation, you must ensure your actions are legally defensible and compliant with company policy. Which document should you consult FIRST to determine your authority to search and seize the workstation?

Accepted Answer

The incident response policy and its associated Rules of Engagement (RoE). The incident response policy and its Rules of Engagement establish the legal and procedural boundaries for an investigation. They define who may authorize searches, what actions are permitted, and how evidence must be handled. Consulting this document first ensures that the handler acts within granted authority and avoids actions that could invalidate evidence or expose the organization to liability.

Answer

The organization's Acceptable Use Policy (AUP)

Answer

The IT asset management database

Answer

The data retention and destruction schedule

Question 13

You are establishing an Incident Response Plan (IRP). Which document should prioritize the technical steps for restoring services after a ransomware attack?

Accepted Answer

Playbook. The Incident Response Plan focuses on the procedural steps for handling specific incident types, including recovery.

Answer

Business Continuity Plan

Answer

Communication Plan

Answer

Security Policy

Question 14

During an incident, why is it important to keep the 'Incident Log' updated in real-time?

Accepted Answer

To provide an accurate, chronological record for the final report. A real-time log ensures an accurate, contemporaneous record of actions, which is vital for later analysis and legal defense.

Answer

To keep the team busy

Answer

To allow management to monitor the team's progress

Answer

To comply with IT service desk ticket requirements

Question 15

A security analyst is investigating a suspected data exfiltration incident. The analyst reviews NetFlow records and notices a large outbound data transfer from an internal server to an external IP address over TCP port 53. Which of the following is the MOST likely explanation for this activity?

Accepted Answer

The server is using DNS tunneling to exfiltrate data.. The correct answer is DNS tunneling. A large outbound data transfer over TCP port 53 from an internal server to an external IP is highly suspicious because normal DNS traffic is small and usually UDP-based. Attackers use DNS tunneling to encode stolen data in DNS queries, exploiting the fact that DNS is often allowed through firewalls. This allows them to exfiltrate data stealthily.

Answer

The server is updating its DNS records dynamically.

Answer

The server is querying a large number of DNS records for a legitimate application.

Answer

The server is performing a legitimate DNS zone transfer.

Question 16

When reviewing firewall logs, you see many 'deny' events from an internal host to an external IP. What is the most likely cause?

Accepted Answer

Malware attempting to reach a C2 server. Internal hosts attempting to reach external IPs blocked by the egress policy are a common indicator of a malware beaconing attempt or an infected host trying to reach a C2.

Answer

IP address conflict

Answer

Normal user browsing activity

Answer

Hardware failure on the firewall

Question 17

A company's security team detects that a server is communicating with a known malicious IP address every hour. The traffic is encrypted and small in size. The incident handler suspects a malware infection with a beaconing mechanism. Which type of malware is most likely responsible for this behavior?

Accepted Answer

Remote Access Trojan (RAT). A Remote Access Trojan (RAT) is designed for stealthy, persistent access, often using regular beaconing to a command-and-control server. The small, encrypted, hourly traffic matches this pattern, allowing the attacker to maintain control without attracting attention. Ransomware, worms, and adware have different primary behaviors that do not align with the described stealthy beaconing.

Answer

Ransomware

Answer

Worm

Answer

Adware

Question 18

An incident handler is analyzing a malware sample that appears to be a ransomware variant. The sample encrypts files with a specific extension and drops a ransom note. The handler wants to determine the encryption algorithm used to potentially find weaknesses. Which artifact from the malware analysis is most directly useful to identify the encryption algorithm?

Accepted Answer

Disassembly of the encryption routine. Disassembling the encryption routine provides the most definitive identification of the encryption algorithm by revealing the specific cryptographic functions and constants used. The ransom note, file extension, and strings may offer clues but lack the technical precision required. For ransomware analysis, understanding the algorithm is crucial for potential decryption or identifying implementation flaws.

Answer

The ransom note text file

Answer

The file extension appended to encrypted files

Answer

Strings extracted from the malware binary

Question 19

During a malware incident investigation, you observe a Windows host establishing periodic outbound HTTPS connections to an unknown IP address every 60 seconds, with small, uniform packet sizes. Which two characteristics most strongly indicate this is command-and-control (C2) beaconing rather than legitimate traffic? (Choose two.)

Accepted Answer

The connections occur at regular, fixed intervals with consistent timing.. C2 beaconing is characterized by automated, periodic check-ins with consistent timing and small, uniform payloads. These behavioral patterns reflect the malware's sleep-and-callback logic rather than user-driven traffic. Neither the use of HTTPS, the cloud hosting provider, nor the presence of a valid certificate distinguishes malicious beaconing from legitimate encrypted web traffic, so those characteristics must not be treated as indicators on their own.

Answer

The host has a valid digital certificate for the destination domain.

Answer

The traffic uses HTTPS on port 443 to blend with normal web traffic.

Answer

The destination IP address belongs to a cloud hosting provider.

Question 20

During a malware incident investigation on a Windows 10 workstation, you discover a scheduled task named 'MicrosoftEdgeUpdateTaskMachineCore' that launches 'C:\Users\Public\updater.exe' every 15 minutes. Legitimate Edge update tasks do not execute binaries from the Public profile. Which containment action best preserves volatile evidence while stopping the recurring malicious execution?

Accepted Answer

Disable the scheduled task with 'schtasks /Change /TN "MicrosoftEdgeUpdateTaskMachineCore" /DISABLE', then capture a memory image of the running process. Disabling the malicious scheduled task halts reinfection while leaving the running process and its volatile state intact for memory acquisition, which is the priority during containment of a recurring execution mechanism. Deleting the task, rebooting, or removing the binary destroys evidence and prevents proper root-cause analysis and scoping.

Answer

Delete 'C:\Users\Public\updater.exe' and remove the scheduled task definition from the registry hive offline

Answer

Run 'schtasks /Delete /TN "MicrosoftEdgeUpdateTaskMachineCore" /F' and reboot the workstation to clear the infection

Answer

Quarantine the workstation from the network and leave the scheduled task running so the attacker's behavior can be observed