212-89 › First Response

First Response Practice Questions

First Response covers the initial actions a handler takes on a suspected compromised host: securing the scene, containing accounts and systems, and collecting volatile evidence before it is lost. Questions present Windows or Linux scenarios and ask you to choose the correct first command, containment step, or preservation action, testing order-of-volatility reasoning and tool selection.