212-89 First Response Practice Test 3 — 15 Questions

Question 1

During an incident, a responder needs to capture the ARP cache to identify potential local spoofing. Which tool provides this information?

Accepted Answer

arp -a. The 'arp -a' command shows the current Address Resolution Protocol cache on a Windows or Linux system.

Answer

ipconfig /displaydns

Answer

route print

Answer

netstat -s

Question 2

You are performing a triage on a server and see unauthorized outbound connections to a foreign IP. What is the best way to determine which process initiated the connection?

Accepted Answer

Run 'netstat -ano' to map the connection to a PID.. On Windows, 'netstat -ano' lists active connections with the owning Process ID (PID) via the -o switch, letting you map the foreign IP connection to the exact process. You then correlate the PID to a process name using Task Manager or 'tasklist /fi "pid eq <PID>"'. This is the fastest triage method to identify the responsible binary.

Answer

ping the IP address.

Answer

Check the ARP table.

Answer

Use 'ipconfig /all'.

Question 3

You are handling a ransomware incident. Which step should be taken before attempting any file recovery?

Accepted Answer

Identify and preserve the encrypted samples and memory state.. It is critical to preserve the existing state for potential forensic analysis or decryptor key extraction before trying to recover files.

Answer

Reimage the machine.

Answer

Delete all encrypted files.

Answer

Pay the ransom.

Question 4

What is the primary purpose of a write blocker in a forensic investigation?

Accepted Answer

To ensure no data is modified on the source media.. A write blocker is a hardware or software tool that prevents any write operations to the source media during forensic imaging. Its primary purpose is to ensure the integrity of evidence by guaranteeing that no data is modified on the original drive, preserving its admissibility in court.

Answer

To speed up data transfer.

Answer

To encrypt the data on the drive.

Answer

To allow multiple people to read the drive.

Question 5

When identifying stakeholders to notify during an incident, which group should be notified first?

Accepted Answer

The incident response team.. The incident response team (IRT) should be notified first because they are the designated group responsible for containing, investigating, and mitigating the incident. Early notification enables the IRT to assess the scope, activate the incident response plan, and coordinate all subsequent communications and actions. Notifying external parties or executives before the IRT can lead to uninformed decisions, delayed technical response, and potential escalation.

Answer

The local police.

Answer

The company board of directors.

Answer

The public.

Question 6

What is the 'First Responder Toolkit' used for during an incident?

Accepted Answer

To collect forensic artifacts without modifying the target system.. A first responder toolkit provides pre-configured, trusted tools for incident triage and data collection.

Answer

To install new security software.

Answer

To permanently delete malicious files.

Answer

To provide remote access for the attacker.

Question 7

Which THREE pieces of information should be included in an incident triage report?

Accepted Answer

The date and time of the incident discovery.. Option A is correct because recording the date and time of incident discovery establishes the timeline anchor needed for triage prioritization, SLA tracking, and later forensic reconstruction of the event sequence. Option C is correct because identifying the systems and services impacted scopes the incident, enabling responders to determine business impact, prioritize containment, and decide whether escalation or isolation is required. Option D is correct because initial findings or indicators of compromise (IOCs) such as suspicious IP addresses, file hashes, or anomalous log entries give the triage team the technical evidence needed to classify the incident and guide the immediate response. Option B is not appropriate because private health records are sensitive PII/PHI that are irrelevant to triage and would introduce unnecessary privacy and compliance risk. Option E is not appropriate because a list of employees with building access is unrelated to the technical and operational facts needed to triage a security incident.

Answer

The private health records of the affected users.

Answer

The names of all employees who have access to the building.

Question 8

Which TWO actions are recommended for evidence preservation in a digital incident?

Accepted Answer

Calculate cryptographic hashes for all collected files.. Hashing ensures integrity, and chain of custody ensures legal admissibility.

Answer

Reboot the system to clear temporary files.

Answer

Modify file permissions to prevent further access.

Answer

Delete all temporary logs to save space.

Question 9

You are investigating a suspected rootkit. Which area of the operating system should you examine for unauthorized boot-time execution?

Accepted Answer

The Master Boot Record (MBR) or EFI partition.. The Master Boot Record (MBR) or EFI partition is the correct area to examine because rootkits often persist by modifying the boot process. The MBR (on BIOS systems) or EFI System Partition (on UEFI systems) contains the initial boot code that runs before the operating system loads, making it a prime location for bootkits—a type of rootkit that executes at boot time. By compromising these areas, malware can gain control early, hide its presence, and load before security defenses. Thus, examining the MBR/EFI partition is critical for detecting unauthorized boot-time execution.

Answer

The browser cache.

Answer

The user profile folder.

Answer

The temporary files directory.

Question 10

Which TWO criteria must a first responder satisfy when choosing a tool for a toolkit?

Accepted Answer

The tool must be known to have minimal impact on the target system.. Tools must be trusted and cause minimal impact on the subject system.

Answer

The tool must run on a cloud-based server.

Answer

The tool must be proprietary and expensive.

Answer

The tool must be able to delete the malware.

Question 11

You are documenting an incident and need to record the time of the event. Why is accurate time synchronization critical?

Accepted Answer

To correlate events across different log sources accurately.. Accurate time synchronization is critical because incident responders must reconstruct the sequence of events from logs generated by many different devices (firewalls, servers, IDS, endpoints). If each device's clock drifts, timestamps cannot be reliably aligned, making it impossible to prove causality or build a defensible timeline. Standards such as RFC 5905 (NTP) and ISO 27037 emphasize synchronized, verifiable timestamps for evidence integrity.

Answer

To ensure the server doesn't crash.

Answer

To comply with user privacy laws.

Answer

To make the report look professional.

Question 12

Which TWO types of evidence are considered 'volatile'?

Accepted Answer

System memory (RAM).. RAM and network connections are lost when power is removed or the system is reset.

Answer

Optical disc contents.

Answer

Hard drive data.

Answer

Printed log files.

Question 13

Which TWO items should be part of a first responder's physical toolkit?

Accepted Answer

Bootable forensic collection drive.. A first responder's physical toolkit must enable volatile and non-volatile evidence capture without altering the original media, so option B (a bootable forensic collection drive) is correct because it lets the responder boot a trusted forensic environment and run imaging/hashing tools (e.g., dd, FTK Imager, EnCase) to acquire a bit-for-bit copy of the suspect system while preserving integrity. Option C (a hardware write blocker) is also correct because it enforces a read-only connection between the suspect drive and the acquisition host at the hardware level, preventing any writes or metadata changes that would break the chain of custody and violate the order of volatility. Option A is wrong because storing all user passwords is a security and privacy risk and is not a legitimate forensic collection tool; credentials should be obtained through proper legal/administrative channels, not carried by responders. Option D is wrong because a commercial email marketing tool has no role in evidence acquisition or preservation. Option E is wrong because a wireless router is network infrastructure, not a standard first-responder forensic collection item, and introducing one could alter the environment rather than preserve it.

Answer

A copy of all user passwords.

Answer

A commercial email marketing tool.

Answer

A wireless router.

Question 14

Which THREE categories of stakeholders should be considered for notification in a major data breach?

Accepted Answer

Legal and Compliance departments.. Legal, IT Management, and the Privacy Officer are critical stakeholders during a breach.

Answer

The local coffee shop staff.

Answer

The company's external social media followers.

Question 15

Which TWO actions are recommended for secure evidence storage?

Accepted Answer

Storing in a locked cabinet with access control.. Option B is correct because storing evidence in a locked cabinet with access control enforces physical security and restricts custody to authorized personnel, satisfying chain-of-custody requirements for secure evidence storage. Option E is correct because keeping a digital log of who accesses the storage creates an auditable access record that documents each individual's interaction with the evidence, which is essential for maintaining chain of custody and detecting unauthorized access. Options A, C, and D do not belong: mailing evidence without tracking breaks the chain of custody and provides no delivery confirmation, leaving evidence on a public desk exposes it to theft or tampering, and copying evidence to a public server for sharing violates confidentiality and integrity controls by allowing uncontrolled access.

Answer

Mailing evidence without tracking.

Answer

Leaving the evidence on a public desk.

Answer

Copying evidence to a public server for sharing.