212-89 First Response Practice Test 3 — 15 Questions

Question 1

You are investigating a suspected rootkit. Which area of the operating system should you examine for unauthorized boot-time execution?

Accepted Answer

The Master Boot Record (MBR) or EFI partition.. The Master Boot Record (MBR) or the EFI partition are common targets for rootkits that persist across reboots.

Answer

The browser cache.

Answer

The user profile folder.

Answer

The temporary files directory.

Question 2

Which TWO criteria must a first responder satisfy when choosing a tool for a toolkit?

Accepted Answer

The tool must be known to have minimal impact on the target system.. Tools must be trusted and cause minimal impact on the subject system.

Answer

The tool must run on a cloud-based server.

Answer

The tool must be proprietary and expensive.

Answer

The tool must be able to delete the malware.

Question 3

You are documenting an incident and need to record the time of the event. Why is accurate time synchronization critical?

Accepted Answer

To correlate events across different log sources accurately.. Correlation of logs across different systems requires synchronized clocks, typically via NTP.

Answer

To ensure the server doesn't crash.

Answer

To comply with user privacy laws.

Answer

To make the report look professional.

Question 4

Which TWO types of evidence are considered 'volatile'?

Accepted Answer

System memory (RAM).. RAM and network connections are lost when power is removed or the system is reset.

Answer

Optical disc contents.

Answer

Hard drive data.

Answer

Printed log files.

Question 5

Which TWO items should be part of a first responder's physical toolkit?

Accepted Answer

Bootable forensic collection drive.. A write blocker and a bootable forensic drive are essential for physical evidence collection.

Answer

A copy of all user passwords.

Answer

A commercial email marketing tool.

Answer

A wireless router.

Question 6

Which THREE actions should be avoided during the initial response phase to ensure evidence integrity?

Accepted Answer

Installing security patches immediately.. Modifying, destroying, or altering evidence is strictly forbidden during incident response.

Answer

Encrypting the evidence files.

Answer

Documenting the initial state of the system.

Question 7

Which THREE categories of stakeholders should be considered for notification in a major data breach?

Accepted Answer

Legal and Compliance departments.. Legal, IT Management, and the Privacy Officer are critical stakeholders during a breach.

Answer

The local coffee shop staff.

Answer

The company's external social media followers.

Question 8

Which TWO actions are recommended for secure evidence storage?

Accepted Answer

Storing in a locked cabinet with access control.. Evidence should be kept in a controlled, access-restricted environment to maintain its integrity.

Answer

Mailing evidence without tracking.

Answer

Leaving the evidence on a public desk.

Answer

Copying evidence to a public server for sharing.

Question 9

Which THREE pieces of information should be recorded on a Chain of Custody (CoC) form when collecting a device?

Accepted Answer

Detailed physical description and identifiers (e.g., serial number).. CoC must track who collected it, when, and where it came from.

Answer

The social media passwords of the owner.

Answer

The home address of the user.

Question 10

During a suspected ransomware incident, you are using EnCase Endpoint to perform remote triage. You need to collect volatile data without triggering the ransomware's anti-forensic triggers. Which action should you take first to ensure the integrity of evidence?

Accepted Answer

Capture the RAM using a trusted forensic tool like DumpIt.. Capturing volatile data (RAM) before any other forensic action is standard practice as it is the most fragile evidence.

Answer

Review the Windows Event Logs for unauthorized access.

Answer

Perform a bit-stream image of the physical hard drive.

Answer

Shut down the computer to prevent further encryption.

Question 11

In the context of the NIST Incident Response Life Cycle, which phase immediately follows the 'Detection and Analysis' phase, specifically focusing on limiting the scope of the compromise?

Accepted Answer

Containment. Containment is the phase where the responder takes action to stop the spread or further damage of the incident.

Answer

Recovery

Answer

Lessons Learned

Answer

Eradication

Question 12

You have identified an active C2 beacon on a corporate server. You are instructed to implement 'Containment' via network segmentation. Which configuration change on a Cisco ASA firewall provides the most effective containment while still allowing for remote forensic forensic analysis?

Accepted Answer

Apply an ACL to the ingress interface that permits traffic only from the IR forensic workstation IP.. Creating a restrictive ACL that allows only the IR team's management IP to access the compromised server while blocking all other traffic is the best practice for controlled containment.

Answer

Disable the interface in the server's OS.

Answer

Change the server's default gateway to a null route.

Answer

Shut down the switch port connected to the server.

Question 13

When documenting evidence for a forensic investigation, you are required to establish a chain of custody. Which information is considered mandatory for each entry in the chain of custody log to satisfy legal requirements?

Accepted Answer

Name of the person transferring the evidence, the receiver, date/time, and the specific storage location.. Legal standards require clear documentation of who handled the evidence, when, and the specific action taken.

Answer

The name of the software used to perform the collection.

Answer

The BIOS serial number and hard drive firmware version.

Answer

The hash values of the collected files.

Question 14

You are assembling a 'First Responder Toolkit' for a remote incident team. Which THREE items are essential for collecting volatile data and ensuring legal defensibility on a Windows system?

Accepted Answer

Tamper-evident bags for physical evidence.. To preserve evidence, you need a write-blocker for disks, a trusted forensic toolkit for memory, and tamper-evident storage.

Answer

Network vulnerability scanner (e.g., Nessus).

Answer

Packet sniffing software to install on the target host.

Question 15

During initial triage, you identify that a system's time is significantly out of sync with the NTP server. Why is this critical to record during the first response?

Accepted Answer

To ensure that file system timestamps can be accurately correlated with other logs.. Timeline analysis is central to IR; inaccurate system clocks will misrepresent the sequence of events in logs.

Answer

It is a sign of an active buffer overflow attack.

Answer

Because it indicates the BIOS battery is failing.

Answer

It affects the ability of the system to join the Active Directory domain.