212-89 First Response — 10 Questions

Question 1

When documenting the chain of custody for a seized laptop, which information is mandatory?

Accepted Answer

The serial number of the device.. A chain of custody must include the identity of the person collecting the evidence, the time/date, and the specific location of the item.

Answer

The name of the suspected attacker.

Answer

The user's password for the laptop.

Answer

The operating system version.

Question 2

You are using EnCase Endpoint Investigator to triage a suspicious endpoint. You need to identify unauthorized processes currently running. Which feature should you utilize?

Accepted Answer

Process List viewer.. The 'Process View' or 'Live Process' feature in EnCase allows for real-time investigation of currently executing processes on the remote endpoint.

Answer

File Signature Analysis.

Answer

Registry Analysis feature.

Answer

Event Log Collector.

Question 3

You are responding to an incident involving a compromised Windows server. You need to collect volatile data using a trusted toolkit. Which tool is standard for collecting running services and loaded DLLs?

Accepted Answer

PsService query. Sysinternals 'pslist' or 'listdlls' are standard, but 'DumpIt' or 'Magnet RAM Capture' are used for memory. For specific process/service visibility, 'PsService' is the tool.

Answer

System Information (msinfo32)

Answer

DiskPart

Answer

Taskmgr.exe

Question 4

As a first responder, you arrive at a compromised workstation showing signs of active malware beaconing. Which action should be performed first according to the Order of Volatility?

Accepted Answer

Perform a physical memory dump using FTK Imager.. The Order of Volatility dictates that the most volatile data should be collected first. Physical memory (RAM) is more volatile than disk storage and contains active malware, encryption keys, and network connections. Performing a physical memory dump with a tool like FTK Imager preserves this critical evidence before it is lost.

Answer

Create a bit-stream image of the hard drive.

Answer

Power down the machine to stop the malware.

Answer

Disconnect the network cable from the workstation.

Question 5

You are handling a database compromise. The database logs show evidence of SQL injection. What is the appropriate initial containment step for the database?

Accepted Answer

Disable the application service account.. Changing the database service account password prevents further unauthorized access without needing to shut down the service immediately.

Answer

Restart the database server.

Answer

Delete the entire database.

Answer

Clear the transaction logs.

Question 6

You discover a suspicious scheduled task on a server. Which Windows tool allows you to export this task for analysis without relying on the GUI?

Accepted Answer

schtasks /query /v. The 'schtasks' command-line tool is the standard way to query and manage tasks in Windows without triggering GUI-based auditing changes.

Answer

regedit.exe

Answer

netsh

Answer

Task Scheduler GUI.

Question 7

A user reports a 'missing' file that was present earlier. What is the first thing you should check in a forensic triage?

Accepted Answer

File system logs or audit logs for file deletion events.. The first step in forensic triage for a missing file is to check file system logs or audit logs for deletion events. These logs record when a file was deleted, by whom, and sometimes the process involved, providing immediate, non-destructive evidence. This aligns with the forensic principle of least volatility: logs are less volatile than the file itself and can be preserved for analysis. The recycle bin might be checked later, but logs give a definitive timeline and actor.

Answer

The recycle bin.

Answer

The backup server.

Answer

The user's email.

Question 8

Which THREE steps are involved in the standard triage process for a compromised endpoint?

Accepted Answer

Collection of volatile system information.. Triage involves identification, initial data capture, and containment analysis.

Answer

Replacing all server hardware.

Answer

Immediate deletion of all user accounts.

Question 9

Which THREE actions should be avoided during the initial response phase to ensure evidence integrity?

Accepted Answer

Installing security patches immediately.. Option B (Installing security patches immediately) must be avoided because patching alters system binaries, configuration files, and memory contents, destroying the state that existed at the time of the incident and potentially overwriting artifacts an investigator needs. Option C (Shutting down a system without capturing volatile data) is wrong because volatile evidence such as RAM contents, running processes, network connections, and cached credentials is lost on power-off, so the system should be isolated and volatile data captured first. Option D (Using native system tools that overwrite logs) should be avoided because tools like some built-in utilities can modify timestamps, rotate or truncate log files, and overwrite unallocated space, corrupting the integrity of the evidence. Option A is not among the correct answers because encrypting collected evidence files is actually a recommended practice to preserve confidentiality and integrity, and Option E is not correct because documenting the initial state of the system is a required step in the initial response phase, not an action to avoid.

Answer

Encrypting the evidence files.

Answer

Documenting the initial state of the system.

Question 10

You are triaging a compromised Windows workstation. Using the Volatility 3 framework, you need to identify hidden processes that may be indicative of a rootkit. Which command-line plugin provides the most direct evidence of process hiding by comparing the process list from the EPROCESS block against the thread scheduler list?

Accepted Answer

vol -f mem.dmp windows.psscan. The 'windows.psscan' plugin scans memory for EPROCESS objects, while 'windows.pstree' or 'windows.pslist' rely on the linked list of active processes. Comparing these identifies hidden processes.

Answer

vol -f mem.dmp windows.netscan

Answer

vol -f mem.dmp windows.handles

Answer

vol -f mem.dmp windows.memmap