212-89 Practice Test 8 — 10 Questions

Question 1

After containing a malware incident, the incident response team needs to remove the malware from infected systems and restore them to a trusted state. Which activity is part of the eradication phase?

Accepted Answer

Applying security patches and updating antivirus signatures.. Eradication focuses on eliminating the threat and the vulnerabilities that allowed it. Applying security patches and updating antivirus signatures directly removes malware and closes the door to reinfection. Reconnecting to the network, conducting lessons learned, and isolating the system belong to recovery, post-incident, and containment phases respectively. Thus, patching and updating signatures are the correct eradication activities.

Answer

Conducting a lessons learned meeting.

Answer

Reconnecting the system to the production network.

Answer

Isolating the infected system from the network.

Question 2

A web application is suspected of being compromised through a file inclusion vulnerability. The attacker used the vulnerability to read sensitive files on the server. Which web server log entry would provide the MOST direct evidence of the file inclusion attempt?

Accepted Answer

A request for a URL containing directory traversal sequences such as ../../etc/passwd.. File inclusion vulnerabilities are exploited by manipulating parameters to include local or remote files. Attackers often use directory traversal sequences to navigate the file system. Web server access logs that capture the request URI will show these sequences, providing direct evidence of the attempt. Other log entries may indicate scanning or other attacks but are less specific.

Answer

A POST request to a login page with a large number of parameters.

Answer

A request for a static image file that returns a 404 error.

Answer

A request with a User-Agent string that matches a known vulnerability scanner.

Question 3

You are reviewing a suspicious macro in a Word document attachment. Which tool is best suited for static analysis of the macro code?

Accepted Answer

Oledump. Oledump is a specialized tool for analyzing OLE (Object Linking and Embedding) files, including Word documents with VBA macros. It extracts and decompresses macro streams from the document, allowing static analysis of the macro code without executing it. This makes it the best choice for static analysis of a suspicious macro.

Answer

Nmap

Answer

Wireshark

Answer

Volatility

Question 4

What is the purpose of enabling 'Request Body Buffering' on a WAF during incident response?

Accepted Answer

To allow the WAF to inspect the full request body for malicious payloads. Request Body Buffering forces the WAF to buffer the entire HTTP request body before forwarding it to the backend, which is essential because many WAF inspection engines can only analyze the full payload once it has been completely received. Without buffering, the WAF may only inspect headers or the first chunk of a chunked/streamed body, allowing attackers to smuggle malicious payloads past inspection. During incident response, enabling this ensures payloads like SQLi, XSS, or file-upload exploits embedded deep in the body are actually evaluated against WAF rules.

Answer

To compress incoming traffic

Answer

To improve web server performance

Answer

To hide the web server version from attackers

Question 5

A financial institution's incident response team is investigating a suspected network intrusion. They observe anomalous traffic from an internal database server to an unknown external IP address. Which TWO of the following actions are appropriate for network-based containment in this scenario? (Choose two.)

Accepted Answer

Block the external IP address at the perimeter firewall.. Blocking the external IP at the firewall and applying an ACL on the internal router are both network-based containment actions that disrupt the malicious traffic while preserving the server's functionality and evidence. They are targeted and reversible, unlike disconnecting or shutting down the server, which cause unnecessary disruption.

Answer

Run a full malware scan on the database server.

Answer

Disconnect the database server from the network immediately.

Answer

Shut down the database service to prevent further data leakage.

Question 6

When an email incident is resolved, why is it necessary to update the organization's blocklist?

Accepted Answer

To prevent re-occurrence of the same campaign. Updating the blocklist after resolving an email incident is a proactive measure to prevent the same malicious campaign from affecting the organization again. By adding the identified malicious sender addresses, domains, or IPs to the blocklist, future emails from the same source are automatically blocked, thus breaking the attack chain. This directly reduces the risk of re-infection or re-compromise from the same threat actor. The other options do not address the primary security objective of incident response.

Answer

To comply with legal regulations

Answer

To improve system performance

Answer

To delete the user's account

Question 7

Which TWO types of evidence are considered 'volatile'?

Accepted Answer

System memory (RAM).. RAM and network connections are lost when power is removed or the system is reset.

Answer

Optical disc contents.

Answer

Hard drive data.

Answer

Printed log files.

Question 8

You are performing a post-incident review. Which action is the most important to ensure that the 'Lessons Learned' process effectively improves future response capabilities?

Accepted Answer

Documenting the root cause and defining specific, actionable process changes. The root cause analysis and resulting action items are what drive actual improvement in the IR lifecycle.

Answer

Updating the password policy

Answer

Archiving all forensic images for ten years

Answer

Assigning blame to the employee who made the error

Question 9

Which syslog facility would typically be configured on a network device to send audit logs to a central server?

Accepted Answer

local0. Syslog facilities local0 through local7 are reserved for local or custom use, and network devices (routers, switches, firewalls) conventionally use local0 (or another local facility) to tag audit and event logs sent to a central syslog server. This lets administrators separate device-generated audit logs from system daemons like kernel, cron, or mail in the central collector's configuration. Using local0 ensures the logs are routed and stored according to the organization's audit retention policy.

Answer

kernel

Answer

cron

Answer

mail

Question 10

When responding to a SQL injection incident, which TWO areas of the database server logs should be prioritized for review?

Accepted Answer

Database user activity/audit logs. Option C (database user activity/audit logs) is correct because audit logs record authentication events, privilege changes, and the specific accounts and source hosts involved in suspicious activity, which is essential for identifying who executed the injection and what they accessed. Option E (database query execution logs) is correct because they capture the actual SQL statements sent to the server, allowing responders to spot injected payloads such as UNION SELECT, OR 1=1, or stacked queries and to determine which tables or data were touched. Together these two log sources provide the attacker identity and the malicious query evidence needed for containment and forensic reconstruction. Option A (OS kernel logs) is not prioritized because it deals with hardware, driver, and system-level events rather than SQL activity. Option B (backup completion logs) only shows whether backup jobs succeeded and has no bearing on detecting or tracing an injection. Option D (network interface statistics) provides traffic counters and throughput data, not the application-layer SQL content or user context required for this investigation.

Answer

Operating system kernel logs

Answer

Database backup completion logs

Answer

Network interface statistics