212-89 Practice Test 9 — 10 Questions

Question 1

A first responder is using a 'Live Response' toolkit. What is the main characteristic of these tools?

Accepted Answer

They are designed to run from a USB drive to minimize impact on the target disk.. Live response tools are designed to collect data from a running system with minimal impact on the target environment.

Answer

They provide permanent remote access to the attacker.

Answer

They require the computer to be turned off.

Answer

They automatically delete evidence after collection.

Question 2

Which TWO of the following are essential components of an effective Incident Response (IR) plan?

Accepted Answer

List of key stakeholders and their contact details. Option C is correct because an effective IR plan must include a current list of key stakeholders — such as the CISO, legal counsel, IT operations, HR, communications, and possibly law enforcement or external forensics contacts — along with their contact details, so they can be reached immediately during an incident. Option D is correct because clearly defined roles and responsibilities (for example, incident commander, communications lead, forensics analyst, and remediation owner) ensure each team member knows exactly what to do, preventing confusion and duplicated effort during a high-pressure event. The remaining options do not belong: a full backup of financial records (A) is a data protection/recovery measure rather than an IR plan component, HR time-tracking instructions (B) are unrelated to incident handling, and a list of employees' social security numbers (E) is sensitive PII that would create a serious security and privacy risk if stored in an IR plan.

Answer

Full backup of the company's financial records

Answer

Detailed instructions on how to use the HR time-tracking system

Answer

A list of all employees' social security numbers

Question 3

A first responder arrives at a scene where a laptop is suspected to contain evidence of a data breach. The laptop is powered on and logged in. What is the first step the responder should take to preserve volatile evidence?

Accepted Answer

Take photographs of the screen and connected peripherals.. The first step in preserving volatile evidence is to document the current state without altering it. Photographing the screen and peripherals captures visual information that may be lost if the system is powered down or the user interacts with it. This non-invasive action supports later analysis and maintains the integrity of the scene. Other actions like removing power or running tools should come after documentation.

Answer

Run a live forensic tool to capture RAM and then shut down the system.

Answer

Ask the user to close all applications and log off to preserve the system state.

Answer

Immediately remove the laptop's battery to prevent remote wipe.

Question 4

During an investigation, you need to verify the integrity of a system configuration file. You have the original known-good hash. What does it mean if the hash of the current file matches the known-good hash?

Accepted Answer

The file contents are identical to the known-good state. If the hashes match, the file content has not changed, ensuring the file's integrity.

Answer

The system is definitely not compromised

Answer

The file was recently updated by an administrator

Answer

The file is free of malware

Question 5

You are configuring a SIEM for long-term storage of investigation logs. Which feature is most important to prevent evidence tampering?

Accepted Answer

WORM (Write Once, Read Many) storage media. WORM (Write Once, Read Many) storage ensures that once log data is written, it cannot be modified or deleted for a defined retention period, providing immutable evidence that satisfies chain-of-custody and regulatory requirements. This is the most important feature for preventing evidence tampering in long-term investigation log storage.

Answer

Automatic log compression

Answer

Log deduplication

Answer

Real-time log alerting

Question 6

Which TWO of the following activities are considered 'Eradication' steps in the incident response lifecycle?

Accepted Answer

Re-imaging infected workstations. In the incident response lifecycle, Eradication focuses on eliminating the threat from the environment, so option B (Re-imaging infected workstations) is correct because rebuilding a compromised host from a known-good image removes any residual malware, backdoors, or persistence mechanisms that cannot be reliably cleaned. Option C (Removing malicious files and registry keys) is also correct because deleting identified malware artifacts and associated persistence entries (e.g., Run keys, services, scheduled tasks) directly eliminates the adversary's foothold. Option A (Writing an incident report) belongs to the post-incident/lessons-learned phase, not eradication. Option D (Conducting a post-incident meeting) is part of the post-incident activity/lessons-learned stage. Option E (Notifying the news media) is a communications/PR action and is not an eradication step.

Answer

Writing an incident report

Answer

Conducting a post-incident meeting

Answer

Notifying the news media

Question 7

A financial institution's SOC detects anomalous SMB traffic from a workstation to multiple servers, including attempts to access ADMIN$ shares. Which TWO of the following artifacts should an incident responder prioritize to confirm lateral movement via SMB? (Choose two.)

Accepted Answer

Windows Security Event ID 5140 for network share access. To confirm SMB lateral movement, focus on events that show network logons and share access. Event ID 4624 with Logon Type 3 records network logons, which are used when connecting to SMB shares. Event ID 5140 logs access to network shares, including administrative shares. Together, they provide evidence of an attacker using compromised credentials to access remote systems via SMB. Other events either lack specificity or do not directly indicate SMB share access.

Answer

Windows Security Event ID 4776 for credential validation

Answer

Windows Security Event ID 4688 with process name psexec.exe

Answer

Windows Security Event ID 5156 for Windows Filtering Platform connection

Question 8

You are analyzing a malware sample that uses Domain Generation Algorithms (DGA). What is the primary purpose of DGA in malware?

Accepted Answer

Evading static C2 blocklists. DGA is used to generate a large number of domain names daily, making it difficult for defenders to block the command-and-control server effectively.

Answer

Spreading via local network shares

Answer

Encrypting the malware payload

Answer

Hiding processes from Task Manager

Question 9

During an email incident investigation, you need to analyze a malicious macro embedded in a Word document without executing it. Which tool is most appropriate for extracting and examining the macro code?

Accepted Answer

olevba from the oletools suite. olevba is designed specifically for static analysis of VBA macros in Office documents. It extracts macro code, highlights suspicious keywords, and helps analysts understand the macro's behavior without executing it, which is critical for safe incident response.

Answer

Volatility

Answer

Wireshark

Answer

Nmap

Question 10

What is the purpose of 'Sandboxing' in email security?

Accepted Answer

To safely execute and observe file behavior. Sandboxing in email security involves detonating suspicious attachments or URLs in an isolated, instrumented environment to observe their runtime behavior—such as file system changes, network callbacks, or process injections—without risking the production network. This dynamic analysis catches zero-day malware and evasive threats that static signatures miss, because the sandbox watches what the code actually does rather than what it looks like. The option 'safely execute and observe file behavior' precisely captures this controlled detonation and behavioral monitoring purpose.

Answer

To provide a backup of the email

Answer

To store malicious emails for future reference

Answer

To encrypt the email body