212-89 Practice Test 6 — 10 Questions

Question 1

While responding to a confirmed cross-site scripting (XSS) incident on a public web application, you need to determine whether the attacker exfiltrated session cookies. The application uses HTTPS and sets cookies without the HttpOnly flag. Which evidence source is MOST likely to reveal the stolen cookie values?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Outbound proxy or firewall logs showing requests to an attacker-controlled domain with cookie data in the URL. When an XSS payload reads a cookie that lacks the HttpOnly attribute and sends it to an external collector, the theft occurs over the network rather than in server-side application logs. Egress proxy or firewall logs capture the destination and full request URL, exposing the attacker-controlled endpoint and the encoded session token. This directly confirms exfiltration and supports containment actions such as blocking the collector domain and invalidating sessions.

Answer

The TLS certificate transparency log for the web application's domain

Answer

The database transaction log for the users table

Answer

The web server's access log entries showing HTTP 200 responses to /login

Question 2

An employee's Windows workstation is suspected of being infected with malware after clicking a link in a spam email. You need to identify which process is making outbound network connections to an external IP address. Which built-in Windows tool should you use to correlate active network connections with their owning processes?

Accepted Answer

netstat -ano. Correlating active network connections to the responsible processes requires a tool that exposes both the connection details and the owning process ID. The netstat -ano command provides numeric addresses, ports, and PIDs, which can then be matched to process names. This built-in utility is a standard first step in live malware investigations on Windows for identifying suspicious outbound communication.

Answer

Performance Monitor

Answer

Task Manager

Answer

Event Viewer

Question 3

A first responder arrives at a workstation where an employee is suspected of exfiltrating data via a USB device. The machine is powered on with a screensaver active. The responder must capture the current physical memory contents for later analysis. Which action should the responder take first?

Accepted Answer

Use a validated hardware-based memory acquisition device that captures RAM without altering the running system.. Capturing physical memory from a live system requires a method that does not significantly alter the system state. A hardware-based acquisition device reads RAM directly, preserving volatile evidence such as running processes and network connections. Other options either destroy memory or introduce changes that compromise the evidence, making them unsuitable for this scenario.

Answer

Perform a hard shutdown by holding the power button, then remove the drive for forensic imaging.

Answer

Document the screen contents with a photograph, then reboot into a forensic Linux distribution to capture memory.

Answer

Press Ctrl+Alt+Delete to unlock the session, then run a memory acquisition tool from a USB drive.

Question 4

During an incident involving a compromised web application, you review an Apache access.log entry that shows a request for /admin/config.php with a response code of 200, but the request originated from an external IP address never seen before. The application is configured to require authentication for that path. Which incident response action is MOST appropriate to determine the scope of the compromise?

Accepted Answer

Correlate the external IP with authentication logs to verify whether a valid session or credential was used.. The key to scoping this incident is determining whether the external request to a protected path was authenticated. Correlating the source IP with authentication logs reveals if a valid session or credential was used, which indicates whether credentials were compromised or an authentication bypass occurred. This directly informs containment and remediation efforts.

Answer

Immediately block the external IP at the firewall and consider the incident contained.

Answer

Review the web server error logs for any 500 errors that occurred around the same time.

Answer

Check the file integrity of config.php to see if it was modified recently.

Question 5

A user reports that Microsoft Word documents on a shared drive are suddenly opening with a prompt to enable macros, and a new file named '~$invoice.docx' appears in the same directory. Analysis shows the macro contains the string 'AutoOpen' and references a remote template URL. Which malware category and delivery technique best describe this incident?

Accepted Answer

Macro-based malware using remote template injection. An AutoOpen macro that references a remote template URL is the hallmark of remote template injection, a document-based malware delivery technique. The macro executes when the document is opened, and the remote template pulls the malicious payload from an external server, evading static detection that only inspects the original file.

Answer

Fileless malware delivered via PowerShell stager

Answer

Ransomware delivered through a malicious PDF reader exploit

Answer

Worm spreading via SMB by copying itself to shared directories

Question 6

A web application is experiencing an incident where attackers are injecting malicious JavaScript into stored user comments. The application reflects the input without proper sanitization. Which mitigation technique, when implemented correctly, is most effective at preventing this type of attack from executing in victims' browsers?

Accepted Answer

Context-aware output encoding. Context-aware output encoding is the most effective mitigation for XSS because it ensures that any user input is rendered as inert text in the appropriate context (HTML, attribute, JavaScript, etc.). This prevents the browser from executing injected scripts. While input validation and WAFs add layers of defense, they are not foolproof and do not address the root cause. HttpOnly protects cookies but not the XSS execution itself.

Answer

Web Application Firewall (WAF) signature blocking

Answer

Input validation using a allowlist of permitted characters

Answer

Setting the HttpOnly flag on session cookies

Question 7

Which documentation is required when transferring physical evidence from a responder to a forensic lab?

Accepted Answer

Chain of Custody form.. The Chain of Custody form is the mandatory documentation that records the chronological sequence of custody, control, transfer, and disposition of physical evidence. When evidence moves from a responder to a forensic lab, the form captures who had it, when, where, and for what purpose, ensuring the evidence's integrity is admissible in legal proceedings.

Answer

User access log.

Answer

Incident summary report.

Answer

Asset inventory list.

Question 8

A financial services firm has activated its incident response plan after detecting unauthorized access to an internal file server. The incident commander must decide which activities belong to the containment phase rather than recovery. (Choose two.)

Accepted Answer

Isolating the affected server from the production network by disabling its switch port.. Containment focuses on stopping the spread and limiting damage while preserving evidence, which isolation of the compromised host and blocking the attacker's command-and-control channels both accomplish. Restoring from backup, patching the exploited vulnerability, and re-enabling user access are recovery or eradication activities that occur only after the threat has been contained and removed from the environment.

Answer

Re-enabling user access to shared drives after verifying file integrity checksums.

Answer

Restoring the file server from the most recent clean backup and returning it to service.

Answer

Applying the vendor security patch that fixes the vulnerability used to gain initial access.

Question 9

During a web application incident, you review logs and find requests containing the string 'UNION SELECT username, password FROM users' in the id parameter. The database server log shows the corresponding query executed successfully and returned rows. Which type of web application attack does this evidence confirm?

Accepted Answer

SQL injection. The presence of SQL syntax in a user-supplied parameter, combined with a database log entry showing that injected statement executed and returned rows, confirms SQL injection. The attacker manipulated the query structure to append a UNION SELECT and retrieve credential data. This evidence supports immediate containment such as blocking the source, reviewing the vulnerable parameter, and assessing what data was exposed.

Answer

Cross-site scripting

Answer

Cross-site request forgery

Answer

Server-side request forgery

Question 10

A web application is under a distributed denial-of-service (DDoS) attack that is overwhelming the server with HTTP requests. As an incident handler, you need to identify the source of the attack and mitigate it. Which TWO log sources are most critical to analyze first to understand the attack pattern and its origin? (Choose two.)

Accepted Answer

Web server access logs. Web server access logs and firewall logs are the most critical for analyzing a DDoS attack. Access logs provide detailed HTTP request data, including source IPs and request patterns, while firewall logs show network-level connection attempts and blocked traffic. Together, they help identify the attack's source and characteristics. Other logs, such as database or OS logs, may show symptoms but not the direct attack traffic.

Answer

Application server error logs

Answer

Operating system event logs

Answer

Database server logs