212-89 First Response — 20 Questions

Question 1

You are using EnCase Endpoint Investigator to triage a suspicious endpoint. You need to identify unauthorized processes currently running. Which feature should you utilize?

Accepted Answer

Process List viewer.. The 'Process View' or 'Live Process' feature in EnCase allows for real-time investigation of currently executing processes on the remote endpoint.

Answer

File Signature Analysis.

Answer

Registry Analysis feature.

Answer

Event Log Collector.

Question 2

You are responding to an incident involving a compromised Windows server. You need to collect volatile data using a trusted toolkit. Which tool is standard for collecting running services and loaded DLLs?

Accepted Answer

PsService query. Sysinternals 'pslist' or 'listdlls' are standard, but 'DumpIt' or 'Magnet RAM Capture' are used for memory. For specific process/service visibility, 'PsService' is the tool.

Answer

System Information (msinfo32)

Answer

DiskPart

Answer

Taskmgr.exe

Question 3

You are handling a database compromise. The database logs show evidence of SQL injection. What is the appropriate initial containment step for the database?

Accepted Answer

Disable the application service account.. Changing the database service account password prevents further unauthorized access without needing to shut down the service immediately.

Answer

Restart the database server.

Answer

Delete the entire database.

Answer

Clear the transaction logs.

Question 4

Which THREE steps are involved in the standard triage process for a compromised endpoint?

Accepted Answer

Collection of volatile system information.. Triage involves identification, initial data capture, and containment analysis.

Answer

Replacing all server hardware.

Answer

Immediate deletion of all user accounts.

Question 5

You are triaging a compromised Windows workstation. Using the Volatility 3 framework, you need to identify hidden processes that may be indicative of a rootkit. Which command-line plugin provides the most direct evidence of process hiding by comparing the process list from the EPROCESS block against the thread scheduler list?

Accepted Answer

vol -f mem.dmp windows.psscan. The 'windows.psscan' plugin scans memory for EPROCESS objects, while 'windows.pstree' or 'windows.pslist' rely on the linked list of active processes. Comparing these identifies hidden processes.

Answer

vol -f mem.dmp windows.netscan

Answer

vol -f mem.dmp windows.handles

Answer

vol -f mem.dmp windows.memmap

Question 6

You are managing a live incident and need to preserve the network state of a Linux server. You must capture active network connections and the routing table. Which tool and flag combination is preferred by first responders to ensure minimal impact on the target system's binary integrity?

Accepted Answer

netstat -rn using a statically linked netstat binary from a trusted external source.. Using statically linked binaries (often found on a trusted 'live response' USB) is standard practice to avoid using potentially compromised libraries on the host system.

Answer

cat /proc/net/dev directly.

Answer

ss -antup using the local /usr/bin/ss binary.

Answer

tcpdump -i any -w capture.pcap.

Question 7

You are investigating a Linux server breach. You need to capture the current state of network connections without altering the evidence. Which command-line tool is preferred by first responders?

Accepted Answer

ss -tupn. 'ss' (socket statistics) or 'netstat' is used to view network connections, but 'ss' is modern and more efficient for incident response.

Answer

tcpdump -i eth0

Answer

lsof -i

Answer

iptables -L

Question 8

When documenting the chain of custody for a seized laptop, which information is mandatory?

Accepted Answer

The serial number of the device.. A chain of custody must include the identity of the person collecting the evidence, the time/date, and the specific location of the item.

Answer

The name of the suspected attacker.

Answer

The user's password for the laptop.

Answer

The operating system version.

Question 9

You are performing initial containment on a cloud-based AWS EC2 instance. The instance is under a DDoS attack. What is the most effective way to isolate this specific resource?

Accepted Answer

Modify the assigned Security Group to restrict all inbound/outbound traffic.. Modifying the Security Group to deny all ingress and egress is the fastest way to isolate the instance at the network level in AWS.

Answer

Stop the EC2 instance immediately.

Answer

Remove the VPC from the region.

Answer

Delete the EC2 instance.

Question 10

You are performing an investigation on a compromised mobile device. What is the primary risk of connecting the device to a standard workstation without a write blocker?

Accepted Answer

The workstation might write metadata or sync files, altering the original evidence.. Connecting a mobile device without a physical or software write blocker can lead to automatic synchronization or data modification by the host OS.

Answer

The battery will drain faster.

Answer

The workstation will be instantly infected.

Answer

The device will automatically wipe itself.

Question 11

A stakeholder asks you to prioritize the recovery of a compromised system. According to incident response best practices, what is your first responsibility?

Accepted Answer

Identify and confirm the security incident.. Triage and identification must occur before any recovery or containment steps to ensure the scope is understood.

Answer

Notify legal counsel.

Answer

Update firewall rules.

Answer

Rebuild the system from backup.

Question 12

As a first responder, you arrive at a compromised workstation showing signs of active malware beaconing. Which action should be performed first according to the Order of Volatility?

Accepted Answer

Perform a physical memory dump using FTK Imager.. Memory (RAM) is the most volatile component and must be captured before it is overwritten or lost during a shutdown.

Answer

Create a bit-stream image of the hard drive.

Answer

Power down the machine to stop the malware.

Answer

Disconnect the network cable from the workstation.

Question 13

You discover a suspicious scheduled task on a server. Which Windows tool allows you to export this task for analysis without relying on the GUI?

Accepted Answer

schtasks /query /v. The 'schtasks' command-line tool is the standard way to query and manage tasks in Windows without triggering GUI-based auditing changes.

Answer

regedit.exe

Answer

netsh

Answer

Task Scheduler GUI.

Question 14

Which documentation is required when transferring physical evidence from a responder to a forensic lab?

Accepted Answer

Chain of Custody form.. Chain of Custody (CoC) documents are required to ensure the legal integrity of the evidence.

Answer

User access log.

Answer

Incident summary report.

Answer

Asset inventory list.

Question 15

When investigating an incident on a virtualized platform (VMware), what is the first step to capture the state of the VM for analysis?

Accepted Answer

Take a VM snapshot with memory included.. Taking a VM snapshot captures the memory and disk state of the VM, which is the equivalent of a live acquisition.

Answer

Export the VM to OVF.

Answer

Power off the VM.

Answer

Clone the VM disk file.

Question 16

You are analyzing an incident where a user account is being used to exfiltrate data. What is the most immediate action to contain the account?

Accepted Answer

Reset the user password and invalidate active sessions.. Disabling the account is the standard containment measure to stop an active session or further logins.

Answer

Delete the user account.

Answer

Delete the user's home directory.

Answer

Lock the user's computer.

Question 17

You are responding to a web-based attack. Which log source is most critical for identifying the origin of a SQL injection attempt?

Accepted Answer

Web server access logs.. Web server access logs contain the request methods and query strings used to deliver the attack payload.

Answer

DHCP logs.

Answer

Windows System Event log.

Answer

Application crash dumps.

Question 18

A first responder is using a 'Live Response' toolkit. What is the main characteristic of these tools?

Accepted Answer

They are designed to run from a USB drive to minimize impact on the target disk.. Live response tools are designed to collect data from a running system with minimal impact on the target environment.

Answer

They provide permanent remote access to the attacker.

Answer

They require the computer to be turned off.

Answer

They automatically delete evidence after collection.

Question 19

While investigating a breach, you need to verify the integrity of a system file. Which process is correct to ensure the file has not been altered?

Accepted Answer

Generate a SHA-256 hash and compare to a trusted baseline.. Generating a cryptographic hash (SHA-256) of the file and comparing it to a known good baseline is the standard process for integrity verification.

Answer

Compare the file size with the original.

Answer

Check the 'Date Modified' timestamp.

Answer

Open the file in a text editor to look for changes.

Question 20

Which of the following is an example of a non-volatile data source?

Accepted Answer

Hard Disk Drive.. Hard drives and flash storage are non-volatile because they retain data when power is removed.

Answer

Processor Cache.

Answer

Network state table.

Answer

System RAM.