212-89 Practice Test 4 — 10 Questions

Question 1

During a suspected ransomware incident, you are using EnCase Endpoint to perform remote triage. You need to collect volatile data without triggering the ransomware's anti-forensic triggers. Which action should you take first to ensure the integrity of evidence?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Capture the RAM using a trusted forensic tool like DumpIt.. Capturing volatile data (RAM) before any other forensic action is standard practice as it is the most fragile evidence.

Answer

Review the Windows Event Logs for unauthorized access.

Answer

Perform a bit-stream image of the physical hard drive.

Answer

Shut down the computer to prevent further encryption.

Question 2

Which role in the Incident Response Team is primarily responsible for ensuring that the incident handling activities remain aligned with organizational legal and privacy requirements?

Accepted Answer

Legal Counsel. The legal counsel or representative ensures that all actions taken during an incident are compliant with applicable laws.

Answer

Technical Investigator

Answer

Incident Lead

Answer

Communications Officer

Question 3

You have identified a potential Advanced Persistent Threat (APT) in your network. Which evidence preservation strategy is required to maintain the validity of the logs found in a SIEM?

Accepted Answer

Applying a cryptographic hash to the exported logs. Generating cryptographic hashes for log files ensures they can be verified as untampered during later analysis.

Answer

Moving the logs to a backup server

Answer

Printing the logs to a secure PDF

Answer

Taking a screenshot of the SIEM dashboard

Question 4

During an investigation, you need to verify the integrity of a system configuration file. You have the original known-good hash. What does it mean if the hash of the current file matches the known-good hash?

Accepted Answer

The file contents are identical to the known-good state. If the hashes match, the file content has not changed, ensuring the file's integrity.

Answer

The system is definitely not compromised

Answer

The file was recently updated by an administrator

Answer

The file is free of malware

Question 5

You have identified an active C2 beacon on a corporate server. You are instructed to implement 'Containment' via network segmentation. Which configuration change on a Cisco ASA firewall provides the most effective containment while still allowing for remote forensic forensic analysis?

Accepted Answer

Apply an ACL to the ingress interface that permits traffic only from the IR forensic workstation IP.. Creating a restrictive ACL that allows only the IR team's management IP to access the compromised server while blocking all other traffic is the best practice for controlled containment.

Answer

Disable the interface in the server's OS.

Answer

Change the server's default gateway to a null route.

Answer

Shut down the switch port connected to the server.

Question 6

Which TWO of the following are recommended when creating a forensic copy of a hard drive?

Accepted Answer

Using a physical write-blocker. Integrity is ensured by hashing and using write-blockers.

Answer

Copying only the files that seem important

Answer

Reformatting the drive before imaging

Answer

Installing new drivers on the drive

Question 7

You are establishing an Incident Response Plan (IRP). Which document should prioritize the technical steps for restoring services after a ransomware attack?

Accepted Answer

Playbook. The Incident Response Plan focuses on the procedural steps for handling specific incident types, including recovery.

Answer

Business Continuity Plan

Answer

Communication Plan

Answer

Security Policy

Question 8

You are setting up a secure communication channel for the IR team during a major incident. Why is it recommended to use an out-of-band communication method?

Accepted Answer

To prevent the attacker from monitoring team communications. If the primary network is compromised, internal communication (email/Slack) may be monitored by the attacker.

Answer

To comply with the Acceptable Use Policy

Answer

To simplify documentation for the final report

Answer

To increase bandwidth for file transfers

Question 9

During the identification phase, you notice a high volume of traffic from an unknown IP to your web server. What is the most appropriate action to take first?

Accepted Answer

Analyze the traffic logs to determine the nature of the activity. Analyzing the traffic confirms whether it is an attack or benign activity before taking disruptive action.

Answer

Block the IP at the firewall immediately

Answer

Notify the local law enforcement

Answer

Shut down the web server

Question 10

An organization is establishing an Incident Response (IR) team. According to NIST, which team structure is most suitable for a large, globally distributed organization that requires localized response capability with centralized oversight?

Accepted Answer

Distributed IR Team. A distributed team structure allows local teams to respond quickly to regional incidents while reporting to a centralized hub for unified policy enforcement.

Answer

Centralized IR Team

Answer

Virtual IR Team

Answer

Outsourced IR Team