212-89 Practice Test 7 — 10 Questions

Question 1

You are a first responder called to a scene where a laptop is running and logged in. You need to preserve the most volatile evidence. What should you do first?

Accepted Answer

Capture a memory image using a forensic tool.. Volatile evidence such as RAM contents is lost when a system is powered down. Capturing a memory image first ensures that critical artifacts like running processes, network connections, and encryption keys are preserved. Other actions, like photographing the screen or removing the hard drive, are either less volatile or require powering down the system. Therefore, memory capture is the correct initial step in preserving the most perishable evidence.

Answer

Remove the hard drive and connect it to a write blocker.

Answer

Take photographs of the screen and surrounding area.

Answer

Shut down the laptop to prevent further damage.

Question 2

An analyst is investigating an email incident where several users received messages with a link to a legitimate file-sharing service. The link points to a document hosted on that service, and the document contains a macro that downloads a payload. The email gateway did not block the message because the link domain is reputable. Which technique is the attacker most likely using to evade email security controls?

Accepted Answer

Using a legitimate cloud service to host the malicious document, which bypasses reputation-based filtering.. Hosting malicious documents on legitimate cloud services is an effective evasion because email gateways often trust well-known domains. The gateway sees a reputable URL and allows the message, while the document itself contains the malicious macro. Incident handlers should treat links to trusted services with the same scrutiny as any other link, especially when the document requests macro enablement.

Answer

Domain fronting to hide the true destination behind a trusted CDN.

Answer

Encrypting the email with S/MIME so the gateway cannot inspect the content.

Answer

Sending the message from a compromised internal account to bypass SPF checks.

Question 3

You are investigating a cross-site scripting incident on a customer-facing web application. The attacker injected a persistent payload that executes in the browsers of users viewing a product review page. Which TWO actions should you take to contain the incident and protect users while preserving evidence? (Choose two.)

Accepted Answer

Capture the malicious review content and associated database records before removing or sanitizing them.. Containment of a stored XSS incident requires preserving the malicious content as evidence while preventing it from executing in users' browsers. Capturing the database records and applying output encoding on the affected page achieves both goals and allows the team to check other user-generated content fields for similar flaws. Deleting the content, shutting down the application, or applying crude perimeter filters either destroys evidence or provides ineffective protection.

Answer

Immediately delete the malicious review from the database to stop the payload from executing.

Answer

Block all inbound HTTP requests containing angle brackets at the perimeter firewall.

Answer

Disable the entire web application until the development team rewrites the review module.

Question 4

An incident handler is investigating a suspected email compromise and discovers a new inbox rule that automatically moves messages containing specific keywords to the Deleted Items folder. What is the most likely purpose of this rule?

Accepted Answer

To hide evidence of fraud or other malicious activity by suppressing related emails.. The presence of a hidden inbox rule that deletes messages containing specific keywords is a strong indicator of email compromise. Attackers use such rules to suppress notifications and replies that could reveal their fraudulent activities, allowing them to operate undetected.

Answer

To reduce mailbox clutter by automatically deleting spam messages.

Answer

To comply with data retention policies by removing old emails.

Answer

To automatically organize legitimate newsletters and promotional emails.

Question 5

A user reports that they received an email from 'IT Support' asking them to click a link to reset their password. The link goes to a domain that looks similar to the company's but has a different top-level domain. The user did not click the link. What is the FIRST action the incident handler should take?

Accepted Answer

Collect the email headers and the full message for analysis, and report the phishing attempt to the security team.. The first action should be to preserve the email and escalate to the security team. Collecting headers and the full message enables analysis of the sender, links, and potential scope without altering evidence. Premature containment steps like password resets or deletions can disrupt the investigation and may not address the actual threat if the user did not interact with the link.

Answer

Instruct the user to delete the email and then run a full antivirus scan on the workstation.

Answer

Immediately reset the user's password and revoke all active sessions.

Answer

Block the sender's email address at the gateway and close the incident.

Question 6

During initial triage, you identify that a system's time is significantly out of sync with the NTP server. Why is this critical to record during the first response?

Accepted Answer

To ensure that file system timestamps can be accurately correlated with other logs.. File system timestamps (MAC times — modify, access, change) are only meaningful when correlated against logs from other systems such as firewalls, IDS, and authentication servers. If the suspect host's clock is skewed, every timestamp it produces is offset by an unknown amount, making it impossible to build an accurate timeline of the intrusion. Recording the offset during first response lets investigators normalise the data later, preserving its evidentiary value.

Answer

It is a sign of an active buffer overflow attack.

Answer

Because it indicates the BIOS battery is failing.

Answer

It affects the ability of the system to join the Active Directory domain.

Question 7

During network forensics, you need to reconstruct an HTTP file transfer from a PCAP. Which Wireshark feature allows you to extract the file object directly from the stream?

Accepted Answer

File > Export Objects > HTTP. Wireshark's File > Export Objects > HTTP feature reconstructs and extracts files transferred over HTTP by reassembling TCP streams and parsing HTTP headers (Content-Type, Content-Length, Content-Disposition). It presents a list of all objects seen in the capture and allows saving them directly to disk, which is the standard method for recovering files from a PCAP during network forensics.

Answer

Statistics > HTTP > Reassemble

Answer

Edit > Follow > Stream Extract

Answer

Analyze > Extract File

Question 8

A first responder is called to a small office where an employee's laptop is suspected of being infected with malware. The laptop is powered on and the employee is logged in. The responder needs to preserve the most volatile evidence before any other action. Which of the following should the responder do first?

Accepted Answer

Capture the contents of RAM using a forensic tool.. The order of volatility requires that the most perishable evidence be collected first. RAM contains running processes, network connections, and encryption keys that are lost on shutdown. Capturing memory before any other action preserves this critical evidence. Photographs, antivirus scans, and shutdown all either fail to capture volatile data or actively destroy it. Therefore, memory acquisition is the correct first step for a live system suspected of malware infection.

Answer

Shut down the laptop and remove the hard drive.

Answer

Run a full antivirus scan to remove the malware.

Answer

Take photographs of the screen and surroundings.

Question 9

An attacker compromises a user's Microsoft 365 mailbox and creates a hidden inbox rule that moves any message containing 'wire transfer' to the RSS Feeds folder and marks it as read. The security team must determine which native artifact best proves the rule existed even after the attacker deletes it from Outlook on the web. What should the team review?

Accepted Answer

The mailbox audit log entries for the New-InboxRule and Set-InboxRule operations. Server-side inbox rules are created and modified through auditable operations, so the mailbox audit log retains the New-InboxRule and Set-InboxRule events with full parameters even after the rule is deleted. This makes it the reliable evidence source, whereas client caches, message trace, and connector settings do not capture rule creation or parameters.

Answer

The message trace log filtered to the user's primary SMTP address

Answer

The Exchange Online connector configuration for the affected tenant

Answer

The Outlook client-side rules (.rwz) file cached in the user's local profile

Question 10

A first responder is preparing to acquire a forensic image of a running Linux server's physical memory. The server has 64 GB of RAM and is critical to business operations. The responder must ensure the integrity of the memory image and minimize disruption. Which of the following is the most appropriate action?

Accepted Answer

Load a kernel module such as LiME to capture memory to an external drive.. For live memory acquisition on Linux, LiME is the preferred tool because it is a kernel module that captures physical memory in a forensically sound manner without rebooting. It handles large memory sizes and produces an image suitable for analysis. Using dd on /dev/mem is unreliable, rebooting destroys memory, and free only shows usage statistics. Therefore, loading LiME is the correct approach to preserve the 64 GB of RAM while minimizing disruption.

Answer

Run the free command to document memory usage and proceed with disk imaging.

Answer

Reboot the server into single-user mode and then capture memory.

Answer

Use the dd command to copy /dev/mem to an external drive.