212-89 Practice Test 8 — 10 Questions

Question 1

You are performing log correlation in a SIEM. You want to match Windows Event ID 4624 (Logon) with network traffic. Which field is the primary 'join key' to correlate the event with a specific network flow?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Source IP Address. Source IP address is the common attribute between a Windows logon log and a network flow record.

Answer

Target Username

Answer

Process Name

Answer

Event Correlation ID

Question 2

Which technique should an incident responder use to prevent an infected host from spreading ransomware via SMB to other segments in the network?

Accepted Answer

Implement ACLs to block TCP 445 between segments. Blocking TCP 445 (SMB) at the boundary between network segments is the most effective way to stop worm-like lateral movement.

Answer

Disable DNS resolution on the host

Answer

Enable DHCP snooping

Answer

Flush the ARP cache

Question 3

When segmenting a network to contain an incident, what is the best practice for a 'Jump Server' in a DMZ to limit the attack surface?

Accepted Answer

Whitelisting source IPs that can access the jump server. Restricting access to the jump server to only known source IPs significantly reduces the risk of unauthorized access.

Answer

Enabling telnet for administrative flexibility

Answer

Disabling all logging to save space

Answer

Assigning the jump server a public IP address

Question 4

When reviewing firewall logs, you see many 'deny' events from an internal host to an external IP. What is the most likely cause?

Accepted Answer

Malware attempting to reach a C2 server. Internal hosts attempting to reach external IPs blocked by the egress policy are a common indicator of a malware beaconing attempt or an infected host trying to reach a C2.

Answer

IP address conflict

Answer

Normal user browsing activity

Answer

Hardware failure on the firewall

Question 5

You are using an IDS/IPS to detect lateral movement. You notice that your NIDS is not alerting on SSH brute force attempts. Which configuration check is most important to perform?

Accepted Answer

Verify if the IDS has visibility into the decrypted traffic. SSH brute force signatures often require the IDS to perform protocol decoding; if the traffic is encrypted and the IDS lacks the session keys, it can only see the handshake.

Answer

Check if the disk is full

Answer

Reboot the IDS appliance

Answer

Ensure NTP is synchronized

Question 6

During a Cross-Site Scripting (XSS) incident, you notice the WAF is blocking legitimate user sessions. What is the most effective tuning step to prevent false positives while maintaining protection?

Accepted Answer

Create a granular exclusion for the specific parameter triggering the alert. Creating a targeted exception for a specific URI or parameter prevents over-blocking while keeping the signature active for the rest of the application.

Answer

Disable the entire XSS protection rule set

Answer

Implement a negative security model

Answer

Switch the WAF from Blocking mode to Transparent mode

Question 7

You are performing incident response on a web server compromised via Directory Traversal. What command is most useful for identifying the specific files accessed in the logs?

Accepted Answer

grep -r "../" /var/log/apache2/access.log. Using grep to search for traversal sequences like '../' within the access logs is the standard method for finding these attempts.

Answer

grep -r "SELECT" /var/log/apache2/access.log

Answer

grep -r "<script>" /var/log/apache2/access.log

Answer

tail -f /var/log/auth.log

Question 8

You suspect a CSRF (Cross-Site Request Forgery) attack. What log entry pattern confirms this?

Accepted Answer

Referer header showing a domain different from the application's domain. CSRF attacks originate from a different site. Checking the 'Referer' header in the logs for unexpected domains is the primary method for detection.

Answer

Multiple POST requests without a corresponding GET request

Answer

High volume of 401 Unauthorized errors

Answer

A sudden change in the session cookie value

Question 9

Which TWO log file attributes are essential for identifying the source of an attack coming through a load balancer?

Accepted Answer

X-Forwarded-For header. Since a load balancer sits between the client and the server, preserving the client's IP and original request path is critical.

Answer

Server uptime count

Answer

Local time of the web server

Answer

The load balancer's internal management port

Question 10

An attacker uses a 'Homograph Attack' to spoof a domain. How does the analyst detect this?

Accepted Answer

Inspecting the Punycode representation of the domain. Homograph attacks use look-alike characters (like Cyrillic 'а' instead of Latin 'a') that are visible when inspecting the Punycode version of the domain.

Answer

Scanning the email for attachments

Answer

Checking the SPF record

Answer

Looking for a valid TLS certificate