212-89 First Response — 40 Questions

Question 1

When documenting the chain of custody for a seized laptop, which information is mandatory?

Accepted Answer

The serial number of the device.. A chain of custody must include the identity of the person collecting the evidence, the time/date, and the specific location of the item.

Answer

The name of the suspected attacker.

Answer

The user's password for the laptop.

Answer

The operating system version.

Question 2

You are using EnCase Endpoint Investigator to triage a suspicious endpoint. You need to identify unauthorized processes currently running. Which feature should you utilize?

Accepted Answer

Process List viewer.. The 'Process View' or 'Live Process' feature in EnCase allows for real-time investigation of currently executing processes on the remote endpoint.

Answer

File Signature Analysis.

Answer

Registry Analysis feature.

Answer

Event Log Collector.

Question 3

You are responding to an incident involving a compromised Windows server. You need to collect volatile data using a trusted toolkit. Which tool is standard for collecting running services and loaded DLLs?

Accepted Answer

PsService query. Sysinternals 'pslist' or 'listdlls' are standard, but 'DumpIt' or 'Magnet RAM Capture' are used for memory. For specific process/service visibility, 'PsService' is the tool.

Answer

System Information (msinfo32)

Answer

DiskPart

Answer

Taskmgr.exe

Question 4

As a first responder, you arrive at a compromised workstation showing signs of active malware beaconing. Which action should be performed first according to the Order of Volatility?

Accepted Answer

Perform a physical memory dump using FTK Imager.. The Order of Volatility dictates that the most volatile data should be collected first. Physical memory (RAM) is more volatile than disk storage and contains active malware, encryption keys, and network connections. Performing a physical memory dump with a tool like FTK Imager preserves this critical evidence before it is lost.

Answer

Create a bit-stream image of the hard drive.

Answer

Power down the machine to stop the malware.

Answer

Disconnect the network cable from the workstation.

Question 5

You are handling a database compromise. The database logs show evidence of SQL injection. What is the appropriate initial containment step for the database?

Accepted Answer

Disable the application service account.. Changing the database service account password prevents further unauthorized access without needing to shut down the service immediately.

Answer

Restart the database server.

Answer

Delete the entire database.

Answer

Clear the transaction logs.

Question 6

You discover a suspicious scheduled task on a server. Which Windows tool allows you to export this task for analysis without relying on the GUI?

Accepted Answer

schtasks /query /v. The 'schtasks' command-line tool is the standard way to query and manage tasks in Windows without triggering GUI-based auditing changes.

Answer

regedit.exe

Answer

netsh

Answer

Task Scheduler GUI.

Question 7

A user reports a 'missing' file that was present earlier. What is the first thing you should check in a forensic triage?

Accepted Answer

File system logs or audit logs for file deletion events.. The first step in forensic triage for a missing file is to check file system logs or audit logs for deletion events. These logs record when a file was deleted, by whom, and sometimes the process involved, providing immediate, non-destructive evidence. This aligns with the forensic principle of least volatility: logs are less volatile than the file itself and can be preserved for analysis. The recycle bin might be checked later, but logs give a definitive timeline and actor.

Answer

The recycle bin.

Answer

The backup server.

Answer

The user's email.

Question 8

Which THREE steps are involved in the standard triage process for a compromised endpoint?

Accepted Answer

Collection of volatile system information.. Triage involves identification, initial data capture, and containment analysis.

Answer

Replacing all server hardware.

Answer

Immediate deletion of all user accounts.

Question 9

Which THREE actions should be avoided during the initial response phase to ensure evidence integrity?

Accepted Answer

Installing security patches immediately.. Option B (Installing security patches immediately) must be avoided because patching alters system binaries, configuration files, and memory contents, destroying the state that existed at the time of the incident and potentially overwriting artifacts an investigator needs. Option C (Shutting down a system without capturing volatile data) is wrong because volatile evidence such as RAM contents, running processes, network connections, and cached credentials is lost on power-off, so the system should be isolated and volatile data captured first. Option D (Using native system tools that overwrite logs) should be avoided because tools like some built-in utilities can modify timestamps, rotate or truncate log files, and overwrite unallocated space, corrupting the integrity of the evidence. Option A is not among the correct answers because encrypting collected evidence files is actually a recommended practice to preserve confidentiality and integrity, and Option E is not correct because documenting the initial state of the system is a required step in the initial response phase, not an action to avoid.

Answer

Encrypting the evidence files.

Answer

Documenting the initial state of the system.

Question 10

You are triaging a compromised Windows workstation. Using the Volatility 3 framework, you need to identify hidden processes that may be indicative of a rootkit. Which command-line plugin provides the most direct evidence of process hiding by comparing the process list from the EPROCESS block against the thread scheduler list?

Accepted Answer

vol -f mem.dmp windows.psscan. The 'windows.psscan' plugin scans memory for EPROCESS objects, while 'windows.pstree' or 'windows.pslist' rely on the linked list of active processes. Comparing these identifies hidden processes.

Answer

vol -f mem.dmp windows.netscan

Answer

vol -f mem.dmp windows.handles

Answer

vol -f mem.dmp windows.memmap

Question 11

During a suspected ransomware incident, you are using EnCase Endpoint to perform remote triage. You need to collect volatile data without triggering the ransomware's anti-forensic triggers. Which action should you take first to ensure the integrity of evidence?

Accepted Answer

Capture the RAM using a trusted forensic tool like DumpIt.. Capturing volatile data (RAM) before any other forensic action is standard practice as it is the most fragile evidence.

Answer

Review the Windows Event Logs for unauthorized access.

Answer

Perform a bit-stream image of the physical hard drive.

Answer

Shut down the computer to prevent further encryption.

Question 12

You are managing a live incident and need to preserve the network state of a Linux server. You must capture active network connections and the routing table. Which tool and flag combination is preferred by first responders to ensure minimal impact on the target system's binary integrity?

Accepted Answer

netstat -rn using a statically linked netstat binary from a trusted external source.. Using statically linked binaries (often found on a trusted 'live response' USB) is standard practice to avoid using potentially compromised libraries on the host system.

Answer

cat /proc/net/dev directly.

Answer

ss -antup using the local /usr/bin/ss binary.

Answer

tcpdump -i any -w capture.pcap.

Question 13

You have identified an active C2 beacon on a corporate server. You are instructed to implement 'Containment' via network segmentation. Which configuration change on a Cisco ASA firewall provides the most effective containment while still allowing for remote forensic forensic analysis?

Accepted Answer

Apply an ACL to the ingress interface that permits traffic only from the IR forensic workstation IP.. Creating a restrictive ACL that allows only the IR team's management IP to access the compromised server while blocking all other traffic is the best practice for controlled containment.

Answer

Disable the interface in the server's OS.

Answer

Change the server's default gateway to a null route.

Answer

Shut down the switch port connected to the server.

Question 14

You are assembling a 'First Responder Toolkit' for a remote incident team. Which THREE items are essential for collecting volatile data and ensuring legal defensibility on a Windows system?

Accepted Answer

Tamper-evident bags for physical evidence.. Option A (tamper-evident bags for physical evidence) is correct because they preserve the chain of custody for any physical media or hardware seized during the response, which is required for legal defensibility. Option C (hardware write-blocker such as Tableau) is correct because it prevents any writes to a suspect drive during acquisition, preserving evidentiary integrity for later forensic analysis. Option D (a live response toolkit with statically linked binaries) is correct because statically linked tools run without depending on the target's DLLs or libraries, so volatile data such as memory, network connections, and running processes can be collected reliably and with minimal footprint. Option B (Nessus vulnerability scanner) is not part of volatile data collection or evidence preservation; it is used for vulnerability assessment and would alter the system state. Option E (installing packet sniffing software on the target host) is not appropriate because installing software modifies the host, contaminates volatile evidence, and is better performed with external capture or a pre-installed agent.

Answer

Network vulnerability scanner (e.g., Nessus).

Answer

Packet sniffing software to install on the target host.

Question 15

A first responder is preparing to collect evidence from a compromised laptop that is still powered on. The responder must ensure that the evidence will be admissible in a court of law. Which TWO actions should the responder take to maintain the integrity of the evidence? (Choose two.)

Accepted Answer

Capture volatile data such as running processes and network connections before shutting down.. To maintain evidence integrity, a first responder must capture volatile data before any shutdown and document system times to establish a reliable timeline. These steps preserve critical evidence that would otherwise be lost and demonstrate a methodical, forensically sound approach. Other actions either destroy volatile data or are not applicable while the system is live.

Answer

Immediately remove the hard drive and connect it to a forensic workstation for imaging.

Answer

Use a write-blocker when capturing the hard drive image after shutting down the system.

Answer

Immediately disconnect the laptop from the network to prevent further data exfiltration.

Question 16

During an incident involving a compromised domain controller, you need to collect volatile data from memory. The server is running critical authentication services and cannot be restarted. Which tool should you use to capture the memory image without disrupting operations?

Accepted Answer

WinPmem. WinPmem is specifically designed for live memory acquisition on Windows, including server environments. It uses a kernel driver to safely read physical memory and can output to a file or network, minimizing disruption to critical services. Other tools like Magnet RAM Capture or DumpIt may work but are less robust for large server memory configurations. FTK Imager is not optimized for memory capture on servers. Therefore, WinPmem is the most appropriate choice.

Answer

FTK Imager

Answer

DumpIt

Answer

Magnet RAM Capture

Question 17

A first responder is preparing to collect volatile data from a compromised Windows workstation. Which TWO actions should be performed to maintain the integrity of the evidence? (Choose two.)

Accepted Answer

Document the system time and time zone before collecting any data.. To preserve volatile evidence on a live Windows workstation, the responder must document the system time and capture physical memory before any action that alters the system. Running antivirus, using a write-blocker on a live system, or rebooting into safe mode would either destroy evidence or are not applicable. These two steps ensure that time-based correlations are accurate and that in-memory artifacts are preserved.

Answer

Use a write-blocker when connecting the internal hard drive to a forensic workstation.

Answer

Reboot the system into safe mode to prevent malware from interfering with collection.

Answer

Run a full antivirus scan to identify and remove malware before collecting data.

Question 18

A first responder is called to investigate a suspected insider threat on a Linux server. The server is still running, and the responder needs to identify which user accounts are currently logged in and from which IP addresses. Which command should be used?

Accepted Answer

who. The who command reads the utmp file to list currently logged-in users, their terminals, login times, and remote host IP addresses. This is essential for live insider threat investigations. The last command shows historical logins, w provides additional activity details, and ps aux lists processes. For the specific need of current users and their IPs, who is the correct choice.

Answer

last

Answer

w

Answer

ps aux

Question 19

You are investigating a Linux server breach. You need to capture the current state of network connections without altering the evidence. Which command-line tool is preferred by first responders?

Accepted Answer

ss -tupn. The ss command is preferred by first responders because it is part of the iproute2 package and is designed to be faster and more informative than netstat, showing detailed socket information including process IDs and network namespaces. It captures current network connections without altering evidence, as it reads from kernel structures. tcpdump captures packets but may not show current connections and can alter system state by putting interface in promiscuous mode. lsof -i lists open files including network connections but may be slower and less comprehensive. iptables -L lists firewall rules, not current connections.

Answer

tcpdump -i eth0

Answer

lsof -i

Answer

iptables -L

Question 20

You are performing initial containment on a cloud-based AWS EC2 instance. The instance is under a DDoS attack. What is the most effective way to isolate this specific resource?

Accepted Answer

Modify the assigned Security Group to restrict all inbound/outbound traffic.. Modifying the assigned Security Group to restrict all inbound and outbound traffic is the most effective way to isolate the EC2 instance because it immediately cuts off all network communication while preserving the instance's state for forensic analysis. This action is reversible and does not destroy evidence. Stopping the instance may still allow some network activity during shutdown and can lose volatile memory. Deleting the instance destroys evidence. Removing the VPC is overly broad and affects other resources.

Answer

Stop the EC2 instance immediately.

Answer

Remove the VPC from the region.

Answer

Delete the EC2 instance.