212-89 Practice Test 7 — 10 Questions

Question 1

A system has been infected by a worm that is spreading across the network. What is the most immediate action to stop the spread?

Accepted Answer

Block propagation ports at the network level. Isolating the affected segments or blocking the ports used for the worm's propagation (e.g., SMB/445) is essential to stop lateral movement.

Answer

Update the BIOS on all machines

Answer

Disable the internet gateway

Answer

Email all users to reboot

Question 2

Which THREE of the following represent critical log sources that should be correlated when investigating a potential network-based exfiltration incident?

Accepted Answer

DNS query logs for destination domain lookup. Firewall logs, NetFlow, and DNS logs provide the full picture of an outbound exfiltration event.

Answer

NTP server logs

Answer

Print server logs

Question 3

During the 'Recovery' phase of the malware incident, what must be done to ensure the environment is safe before reconnecting the restored systems?

Accepted Answer

Perform a vulnerability scan. Vulnerability scanning confirms that the original entry points or vulnerabilities used by the malware have been patched or mitigated.

Answer

Delete all user profiles

Answer

Upgrade the OS to the latest version

Answer

Reformat all external hard drives

Question 4

Which THREE of the following indicators are found in email-based malware delivery?

Accepted Answer

Hidden links pointing to malicious domains. Malicious emails often contain suspicious attachments, unexpected links (URLs) leading to malicious sites, and deceptive sender addresses to trick users.

Answer

The email has a standard company footer

Answer

The email was sent during business hours

Question 5

During a malware analysis, which TWO of the following indicators are typically used to identify persistence mechanisms in the Windows registry?

Accepted Answer

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services. The 'Run' keys and 'Services' keys are the most common locations malware uses to ensure automatic execution upon boot.

Answer

HKEY_CLASSES_ROOT\CLSID

Answer

HKEY_CURRENT_USER\Control Panel\Desktop

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Question 6

You are investigating a compromised Linux host. Using 'tcpdump' to capture traffic on interface eth0 to analyze C2 communication on port 443, which command is most efficient for saving the output to a file for later analysis in Wireshark?

Accepted Answer

tcpdump -i eth0 port 443 -w capture.pcap. The -w flag is used in tcpdump to write raw packets to a .pcap file.

Answer

tcpdump -c eth0 port 443

Answer

tcpdump -i eth0 port 443 > capture.txt

Answer

tcpdump -r capture.pcap port 443

Question 7

Which TWO of the following techniques would an attacker likely use to hide lateral movement traffic within a network?

Accepted Answer

Masquerading malicious traffic on common ports like 443. Encrypted tunnels (SSH/TLS) and protocol masquerading are the primary ways to hide lateral movement.

Answer

Using clear-text Telnet for all communication

Answer

Sending traffic exclusively during business hours

Answer

Disabling all logging on the source host

Question 8

An attacker is using a slow-rate HTTP POST request to exhaust server resources. Which ModSecurity directive should be adjusted to mitigate this behavior?

Accepted Answer

SecRequestBodyLimit. ModSecurity's 'SecRequestBodyLimit' and 'SecRequestBodyNoFilesLimit' manage the size and rate of incoming request bodies.

Answer

SecDataDir

Answer

SecRuleEngine DetectionOnly

Answer

SecResponseBodyLimit

Question 9

A web server log shows repeated '403 Forbidden' errors for a specific directory. What is the most likely cause during an incident?

Accepted Answer

Directory traversal or unauthorized access attempts are being blocked. Repeated 403 errors often indicate an attacker performing forced browsing or directory traversal attempts that are being blocked by server-side permission settings.

Answer

The user session has expired

Answer

The requested file does not exist

Answer

The server is offline

Question 10

Which TWO of the following activities are considered 'Eradication' steps in the incident response lifecycle?

Accepted Answer

Re-imaging infected workstations. Eradication involves removing the malicious components and restoring clean systems to normal operations.

Answer

Writing an incident report

Answer

Conducting a post-incident meeting

Answer

Notifying the news media