212-89 First Response Practice Test 2 — 15 Questions

Question 1

During an incident involving a compromised domain controller, you need to collect volatile data from memory. The server is running critical authentication services and cannot be restarted. Which tool should you use to capture the memory image without disrupting operations?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

WinPmem. WinPmem is specifically designed for live memory acquisition on Windows, including server environments. It uses a kernel driver to safely read physical memory and can output to a file or network, minimizing disruption to critical services. Other tools like Magnet RAM Capture or DumpIt may work but are less robust for large server memory configurations. FTK Imager is not optimized for memory capture on servers. Therefore, WinPmem is the most appropriate choice.

Answer

FTK Imager

Answer

DumpIt

Answer

Magnet RAM Capture

Question 2

A first responder is preparing to collect volatile data from a compromised Windows workstation. Which TWO actions should be performed to maintain the integrity of the evidence? (Choose two.)

Accepted Answer

Document the system time and time zone before collecting any data.. To preserve volatile evidence on a live Windows workstation, the responder must document the system time and capture physical memory before any action that alters the system. Running antivirus, using a write-blocker on a live system, or rebooting into safe mode would either destroy evidence or are not applicable. These two steps ensure that time-based correlations are accurate and that in-memory artifacts are preserved.

Answer

Use a write-blocker when connecting the internal hard drive to a forensic workstation.

Answer

Reboot the system into safe mode to prevent malware from interfering with collection.

Answer

Run a full antivirus scan to identify and remove malware before collecting data.

Question 3

A first responder is called to investigate a suspected insider threat on a Linux server. The server is still running, and the responder needs to identify which user accounts are currently logged in and from which IP addresses. Which command should be used?

Accepted Answer

who. The who command reads the utmp file to list currently logged-in users, their terminals, login times, and remote host IP addresses. This is essential for live insider threat investigations. The last command shows historical logins, w provides additional activity details, and ps aux lists processes. For the specific need of current users and their IPs, who is the correct choice.

Answer

last

Answer

w

Answer

ps aux

Question 4

You are investigating a Linux server breach. You need to capture the current state of network connections without altering the evidence. Which command-line tool is preferred by first responders?

Accepted Answer

ss -tupn. The ss command is preferred by first responders because it is part of the iproute2 package and is designed to be faster and more informative than netstat, showing detailed socket information including process IDs and network namespaces. It captures current network connections without altering evidence, as it reads from kernel structures. tcpdump captures packets but may not show current connections and can alter system state by putting interface in promiscuous mode. lsof -i lists open files including network connections but may be slower and less comprehensive. iptables -L lists firewall rules, not current connections.

Answer

tcpdump -i eth0

Answer

lsof -i

Answer

iptables -L

Question 5

You are performing initial containment on a cloud-based AWS EC2 instance. The instance is under a DDoS attack. What is the most effective way to isolate this specific resource?

Accepted Answer

Modify the assigned Security Group to restrict all inbound/outbound traffic.. Modifying the assigned Security Group to restrict all inbound and outbound traffic is the most effective way to isolate the EC2 instance because it immediately cuts off all network communication while preserving the instance's state for forensic analysis. This action is reversible and does not destroy evidence. Stopping the instance may still allow some network activity during shutdown and can lose volatile memory. Deleting the instance destroys evidence. Removing the VPC is overly broad and affects other resources.

Answer

Stop the EC2 instance immediately.

Answer

Remove the VPC from the region.

Answer

Delete the EC2 instance.

Question 6

You are performing an investigation on a compromised mobile device. What is the primary risk of connecting the device to a standard workstation without a write blocker?

Accepted Answer

The workstation might write metadata or sync files, altering the original evidence.. Connecting a mobile device without a physical or software write blocker can lead to automatic synchronization or data modification by the host OS.

Answer

The battery will drain faster.

Answer

The workstation will be instantly infected.

Answer

The device will automatically wipe itself.

Question 7

A stakeholder asks you to prioritize the recovery of a compromised system. According to incident response best practices, what is your first responsibility?

Accepted Answer

Identify and confirm the security incident.. According to incident response best practices (e.g., NIST SP 800-61), the first phase is preparation, but once an event is detected, the immediate responsibility is to identify and confirm whether a security incident has actually occurred. This involves validating alerts, scoping the event, and determining if it meets the organization's incident criteria. Only after confirmation should containment, eradication, and recovery actions (like rebuilding from backup) be taken. Notifying legal counsel or updating firewall rules are subsequent steps that depend on the confirmed incident.

Answer

Notify legal counsel.

Answer

Update firewall rules.

Answer

Rebuild the system from backup.

Question 8

Which documentation is required when transferring physical evidence from a responder to a forensic lab?

Accepted Answer

Chain of Custody form.. The Chain of Custody form is the mandatory documentation that records the chronological sequence of custody, control, transfer, and disposition of physical evidence. When evidence moves from a responder to a forensic lab, the form captures who had it, when, where, and for what purpose, ensuring the evidence's integrity is admissible in legal proceedings.

Answer

User access log.

Answer

Incident summary report.

Answer

Asset inventory list.

Question 9

When investigating an incident on a virtualized platform (VMware), what is the first step to capture the state of the VM for analysis?

Accepted Answer

Take a VM snapshot with memory included.. For a virtualized platform like VMware, the first step to capture the state of a running VM for analysis is to take a snapshot that includes memory. This preserves the VM's disk and RAM state at a point in time, allowing later forensic analysis without altering the original. It is the virtual equivalent of capturing volatile memory and disk together.

Answer

Export the VM to OVF.

Answer

Power off the VM.

Answer

Clone the VM disk file.

Question 10

You are analyzing an incident where a user account is being used to exfiltrate data. What is the most immediate action to contain the account?

Accepted Answer

Reset the user password and invalidate active sessions.. Resetting the password and invalidating active sessions immediately cuts off the attacker's access while preserving the account and its data for forensic investigation. This contains the incident without destroying evidence, and it revokes any stolen session tokens or cookies the attacker may be using. It is the standard first containment step for a compromised account.

Answer

Delete the user account.

Answer

Delete the user's home directory.

Answer

Lock the user's computer.

Question 11

You are responding to a web-based attack. Which log source is most critical for identifying the origin of a SQL injection attempt?

Accepted Answer

Web server access logs.. Web server access logs record every HTTP request, including the full URL, query string, HTTP method, user agent, and source IP address. A SQL injection attempt typically appears in the query string or POST body parameters, and the source IP in the access log identifies the origin of the request. This makes access logs the most critical source for tracing the origin of a web-based SQLi attack.

Answer

DHCP logs.

Answer

Windows System Event log.

Answer

Application crash dumps.

Question 12

A first responder is using a 'Live Response' toolkit. What is the main characteristic of these tools?

Accepted Answer

They are designed to run from a USB drive to minimize impact on the target disk.. Live response tools are designed to collect data from a running system with minimal impact on the target environment.

Answer

They provide permanent remote access to the attacker.

Answer

They require the computer to be turned off.

Answer

They automatically delete evidence after collection.

Question 13

While investigating a breach, you need to verify the integrity of a system file. Which process is correct to ensure the file has not been altered?

Accepted Answer

Generate a SHA-256 hash and compare to a trusted baseline.. Generating a cryptographic hash (SHA-256) of the file and comparing it to a known good baseline is the standard process for integrity verification.

Answer

Compare the file size with the original.

Answer

Check the 'Date Modified' timestamp.

Answer

Open the file in a text editor to look for changes.

Question 14

Which of the following is an example of a non-volatile data source?

Accepted Answer

Hard Disk Drive.. A hard disk drive (HDD) is a non-volatile storage device — it retains data even when power is removed, because data is stored magnetically on platters. This makes it a classic example of a non-volatile data source in digital forensics, where investigators seek persistent artifacts like files, logs, and registry hives.

Answer

Processor Cache.

Answer

Network state table.

Answer

System RAM.

Question 15

You need to capture forensic data from a Windows machine using a remote agent. What is the risk of using built-in administrative tools like PowerShell for this?

Accepted Answer

They leave significant forensic footprints on the target system.. Built-in administrative tools like PowerShell are already present on Windows and, when used for remote forensic collection, generate artifacts — command history, event logs (e.g., PowerShell Operational log, Event ID 4104 script block logging), prefetch entries, and process creation events (4688). These footprints can alert an attacker, contaminate the evidence, and complicate the timeline reconstruction. That is the primary risk of using them for live forensic acquisition.

Answer

They are always blocked by the firewall.

Answer

They cannot collect binary data.

Answer

They require the system to be offline.