212-89 Practice Test 6 — 10 Questions

Question 1

Which THREE of the following are legal considerations when handling an incident?

Accepted Answer

Compliance with regional data breach notification laws. Data privacy, regulatory reporting, and evidence admissibility are critical legal areas.

Answer

The cost of upgrading the company's hardware

Answer

The speed of the internet connection used for analysis

Question 2

While investigating a server compromise, you need to ensure the digital evidence collected from the RAID array is admissible in court. What is the most critical requirement for the chain of custody?

Accepted Answer

Maintaining a detailed log of every individual who accessed or transferred the evidence. Chain of custody requires a chronological log of who handled the evidence, where it was stored, and proof that it was not altered, typically via cryptographic hashes.

Answer

Deleting temporary files to prevent cross-contamination

Answer

Encrypting the collected evidence folder with AES-256

Answer

Creating a bit-stream image of the disk drive

Question 3

You are reviewing logs from an EDR and see an indicator of 'Living off the Land' (LotL). Which tool usage would be considered an LotL attack?

Accepted Answer

Executing encoded PowerShell scripts. Using 'PowerShell.exe' to execute base64-encoded scripts directly from memory is a quintessential LotL technique.

Answer

Running a commercial vulnerability scanner

Answer

Installing a custom rootkit driver

Answer

Downloading an EXE from an unknown site

Question 4

You have identified a malicious DLL that is being loaded by a legitimate process. Which tool allows you to view which DLLs are loaded by a specific process?

Accepted Answer

Process Explorer. Process Explorer's lower pane (when configured for DLLs) provides a clear list of all loaded modules/DLLs for any selected process.

Answer

Task Scheduler

Answer

Disk Cleanup

Answer

Device Manager

Question 5

Which TWO of the following are considered 'Legal Considerations' during the Incident Handling process that must be integrated into the response plan?

Accepted Answer

Ensuring compliance with data breach notification statutes. Legal considerations include adhering to privacy regulations (e.g., reporting requirements) and maintaining the integrity of the evidence for potential litigation.

Answer

Configuring automated IP blocking on the edge firewall

Answer

Updating the organizational server maintenance schedule

Answer

Running a vulnerability scan on the impacted systems

Question 6

Which document is essential to maintain during a malware incident to ensure accountability and track the actions taken by the incident response team?

Accepted Answer

Incident Log. An Incident Log (or Chain of Custody record) is critical for documenting every step, tool, and decision made during the response process.

Answer

User Manual

Answer

System Backup

Answer

Vulnerability Assessment Report

Question 7

You are using YARA to detect a specific strain of ransomware. You want to match a file if it contains a specific hex string OR a specific string value. How do you construct this in your rule?

Accepted Answer

condition: $a or $b. YARA uses the 'or' operator within the condition section to evaluate multiple criteria, allowing a match if either condition is met.

Answer

condition: $a + $b

Answer

condition: $a != $b

Answer

condition: $a && $b

Question 8

After eradicating a malware infection, you need to ensure the system is hardened against future occurrences. Which action is most effective against fileless malware?

Accepted Answer

Implement PowerShell Constrained Language Mode. Disabling PowerShell for non-administrative users or implementing Constrained Language Mode is a key defense against fileless script-based attacks.

Answer

Enable auto-updates for all applications

Answer

Install an extra antivirus

Answer

Enable full disk encryption

Question 9

Which THREE of the following tools would be most effective for performing live memory forensics on a compromised Windows workstation?

Accepted Answer

WinPmem. Volatility, WinPmem, and Magnet RAM Capture are all specialized tools for volatile memory acquisition and analysis.

Answer

CCleaner

Answer

Windows Update

Question 10

Which TWO of the following are common signs of a compromised switch in a local area network?

Accepted Answer

Unrecognized trunk ports enabled. MAC flooding and unauthorized trunking are common signs of layer 2 switch compromise.

Answer

Normal spanning-tree convergence

Answer

Decreased CPU usage on the switch

Answer

Stable port security status