212-89 First Response Practice Test 4 — 15 Questions

Question 1

Which THREE pieces of information should be recorded on a Chain of Custody (CoC) form when collecting a device?

Accepted Answer

Detailed physical description and identifiers (e.g., serial number).. Option A is correct because a Chain of Custody form must uniquely identify the evidence, so a detailed physical description (make, model, color, condition) plus unique identifiers such as the serial number, IMEI, or asset tag is recorded to distinguish the device from all others. Option B is correct because the exact time and date of collection establish when custody transferred and anchor the evidence timeline, which is essential for admissibility and for proving the item was not tampered with. Option C is correct because the name and signature of the individual collecting the item create accountability, showing exactly who took custody and enabling each subsequent transfer to be traced. Option D is not included because owner social media passwords are not custody information and collecting them would be irrelevant and privacy-invasive. Option E is not included because the user's home address is not required to document the chain of custody of a device.

Answer

The social media passwords of the owner.

Answer

The home address of the user.

Question 2

In the context of the NIST Incident Response Life Cycle, which phase immediately follows the 'Detection and Analysis' phase, specifically focusing on limiting the scope of the compromise?

Accepted Answer

Containment. Containment is the phase where the responder takes action to stop the spread or further damage of the incident.

Answer

Recovery

Answer

Lessons Learned

Answer

Eradication

Question 3

When documenting evidence for a forensic investigation, you are required to establish a chain of custody. Which information is considered mandatory for each entry in the chain of custody log to satisfy legal requirements?

Accepted Answer

Name of the person transferring the evidence, the receiver, date/time, and the specific storage location.. A chain of custody log must document the sequence of custody, control, transfer, and disposition of evidence. Mandatory entries include the name of the person transferring the evidence, the receiver, the date and time of transfer, and the specific storage location. This information ensures that evidence is admissible in legal proceedings by proving it has not been tampered with.

Answer

The name of the software used to perform the collection.

Answer

The BIOS serial number and hard drive firmware version.

Answer

The hash values of the collected files.

Question 4

During initial triage, you identify that a system's time is significantly out of sync with the NTP server. Why is this critical to record during the first response?

Accepted Answer

To ensure that file system timestamps can be accurately correlated with other logs.. File system timestamps (MAC times — modify, access, change) are only meaningful when correlated against logs from other systems such as firewalls, IDS, and authentication servers. If the suspect host's clock is skewed, every timestamp it produces is offset by an unknown amount, making it impossible to build an accurate timeline of the intrusion. Recording the offset during first response lets investigators normalise the data later, preserving its evidentiary value.

Answer

It is a sign of an active buffer overflow attack.

Answer

Because it indicates the BIOS battery is failing.

Answer

It affects the ability of the system to join the Active Directory domain.

Question 5

When notifying stakeholders during a major data breach, which TWO of the following groups must be informed according to standard incident communication plans to satisfy regulatory and operational needs?

Accepted Answer

Legal Counsel/Privacy Officer.. Legal Counsel/Privacy Officer (B) must be informed because breach notification statutes (e.g., GDPR Article 33, HIPAA Breach Notification Rule, and U.S. state laws) impose specific timelines and content requirements for notifying regulators and affected individuals, and only legal/privacy experts can determine whether notification is triggered and how to comply. The IT Infrastructure Team (D) must be informed because it is the operational group responsible for containing the incident, preserving forensic evidence, identifying affected systems and data, and executing technical remediation such as rotating credentials, patching, or isolating hosts. The entire public customer base via social media (A) is not a standard first-step stakeholder group, since public disclosure must be coordinated with legal guidance and typically follows direct notification to affected parties and regulators. The software development team lead (C) is only relevant if the breach involves application code or a software vulnerability, so it is not a mandatory stakeholder in every incident communication plan. External marketing vendors (E) are third parties without a regulatory need to know and are not part of the standard incident notification chain unless they process the affected data.

Answer

The entire public customer base via social media.

Answer

The software development team lead.

Answer

External marketing vendors.

Question 6

During the triage of a Linux server, you suspect a rootkit is intercepting system calls. Which THREE actions are appropriate for the first responder to perform to gather evidence of the rootkit?

Accepted Answer

Compare the md5sum of critical binaries against a known-good baseline.. Option A is correct because comparing md5sum hashes of critical binaries (e.g., /bin/ls, /bin/ps) against a known-good baseline detects trojanized executables that a rootkit may have replaced. Option B is correct because a rootkit intercepting system calls often resides in kernel memory, and capturing a full memory dump for offline analysis with Volatility preserves volatile evidence such as hidden processes, hooks, and loaded modules. Option E is correct because running 'lsmod' lists loaded kernel modules, allowing the responder to spot suspicious or unsigned modules that could implement the system-call interception. Option C is not appropriate because reinstalling the OS destroys evidence and is a remediation step, not evidence gathering. Option D is not appropriate because 'chkdsk' is a Windows utility for file-system errors and is irrelevant on Linux, where fsck would be used and would not reveal a rootkit.

Answer

Reinstall the OS immediately to ensure cleanliness.

Answer

Run 'chkdsk' to look for file system errors.

Question 7

A first responder arrives at a workstation where an employee is suspected of exfiltrating data via a USB device. The machine is powered on with a screensaver active. The responder must capture the current physical memory contents for later analysis. Which action should the responder take first?

Accepted Answer

Use a validated hardware-based memory acquisition device that captures RAM without altering the running system.. Capturing physical memory from a live system requires a method that does not significantly alter the system state. A hardware-based acquisition device reads RAM directly, preserving volatile evidence such as running processes and network connections. Other options either destroy memory or introduce changes that compromise the evidence, making them unsuitable for this scenario.

Answer

Perform a hard shutdown by holding the power button, then remove the drive for forensic imaging.

Answer

Document the screen contents with a photograph, then reboot into a forensic Linux distribution to capture memory.

Answer

Press Ctrl+Alt+Delete to unlock the session, then run a memory acquisition tool from a USB drive.

Question 8

During the first response to a compromised Windows workstation, you must capture volatile memory before shutting the system down. Which tool or technique is designed to acquire the full physical memory image while preserving its integrity for later analysis?

Accepted Answer

Use WinPmem or a similar memory acquisition tool to dump physical memory to a removable drive.. Capturing physical memory is critical in incident response because it contains running processes, network connections, encryption keys, and malware that may exist only in RAM. Tools like WinPmem are purpose-built to create a forensic image of memory without significantly altering the system state. Other options either capture different data types or modify the system, which would compromise the integrity of the volatile evidence needed for analysis.

Answer

Create a System Restore point and then copy the pagefile.sys file.

Answer

Export the Windows Event Logs to a CSV file on the local disk.

Answer

Run a full antivirus scan from a write-protected USB drive.

Question 9

During an incident response engagement, a first responder is collecting volatile data from a compromised Windows server. The responder needs to capture the current network connections, including the process ID associated with each connection, without installing any third-party tools. Which native Windows command should the responder use?

Accepted Answer

netstat -ano. The netstat -ano command is a native Windows utility that lists all active network connections and listening ports along with the owning process ID. This allows a first responder to quickly identify which process is associated with a suspicious connection, enabling immediate containment or further analysis without introducing third-party tools that could alter the system.

Answer

net session

Answer

tasklist /svc

Answer

ipconfig /displaydns

Question 10

You are the first responder dispatched to a workstation suspected of being compromised by a phishing payload. The user is still logged in and a suspicious process is actively communicating over the network. Before you begin any data collection, what should you do first?

Accepted Answer

Document the current state of the screen, running applications, and visible network activity using a camera or screenshot tool.. The first action in first response is to document the scene and capture volatile evidence before it is lost. Photographing or screenshotting the screen preserves visible indicators like open applications and network activity. Powering off, scanning, or disconnecting prematurely can destroy or alter critical volatile data that is essential for understanding the incident and supporting later forensic analysis.

Answer

Run a full antivirus scan to identify and remove the malicious files before collecting evidence.

Answer

Immediately power off the workstation to prevent further malware execution and data exfiltration.

Answer

Disconnect the workstation from the network and then begin collecting the hard drive for forensic imaging.

Question 11

You are the first responder to a Linux server that is suspected of being compromised. You need to collect volatile data in the order of volatility. Which command should you run first to capture the most volatile data?

Accepted Answer

netstat -antp. The order of volatility guides first responders to collect the most perishable data first. Network connections are extremely volatile and can be lost within seconds if an attacker disconnects or a timeout occurs. Capturing them with netstat -antp provides immediate insight into active sessions and listening services. Process lists and disk logs, while important, are less volatile and can be collected subsequently without as much risk of loss.

Answer

cat /var/log/auth.log

Answer

df -h

Answer

ps aux

Question 12

A first responder arrives at a workstation where a user is suspected of exfiltrating data via a USB drive. The machine is still powered on. The responder must preserve the most volatile evidence first. Which artifact should be captured immediately?

Accepted Answer

The current contents of physical memory (RAM) and running processes. The order of volatility dictates that the most perishable evidence be collected first. Physical memory and running processes are lost when the system is powered off, so they must be captured before any disk-based artifacts. Pagefile, hibernation files, disk images, and event logs are persistent and can be acquired afterward without losing their content.

Answer

The Windows Event Log files stored in C:\Windows\System32\winevt\Logs

Answer

A forensic image of the entire hard drive using a write-blocker

Answer

The contents of the pagefile.sys and hiberfil.sys files on the local disk

Question 13

You are a first responder called to a scene where a laptop is running and logged in. You need to preserve the most volatile evidence. What should you do first?

Accepted Answer

Capture a memory image using a forensic tool.. Volatile evidence such as RAM contents is lost when a system is powered down. Capturing a memory image first ensures that critical artifacts like running processes, network connections, and encryption keys are preserved. Other actions, like photographing the screen or removing the hard drive, are either less volatile or require powering down the system. Therefore, memory capture is the correct initial step in preserving the most perishable evidence.

Answer

Remove the hard drive and connect it to a write blocker.

Answer

Take photographs of the screen and surrounding area.

Answer

Shut down the laptop to prevent further damage.

Question 14

During a forensic investigation of a compromised Linux server, you need to collect volatile data from memory. The server is running critical services and cannot be taken offline. Which method is most appropriate for capturing memory while minimizing disruption?

Accepted Answer

Install and run a kernel module such as LiME (Linux Memory Extractor) to dump memory to a remote location or external storage.. LiME is specifically designed for live memory acquisition on Linux, allowing responders to capture RAM without rebooting or significantly disrupting services. It loads as a kernel module and can write the memory image to a file or send it over the network, preserving evidence integrity. Other methods like /dev/mem or gcore are either unreliable, incomplete, or disruptive, making LiME the most appropriate choice for this scenario.

Answer

Use the dd command to copy /dev/mem to an external drive.

Answer

Use the gcore command to dump the memory of all running processes, then combine them into a single image.

Answer

Trigger a kernel panic to force a memory dump to the swap partition, then recover it later.

Question 15

During a network intrusion investigation, a first responder needs to capture volatile network configuration data from a compromised Windows server before it is rebooted. Which command should be used to display the current ARP cache?

Accepted Answer

arp -a. The ARP cache is a volatile artifact that maps IP addresses to MAC addresses and can reveal attacker presence or network topology. On Windows, the arp -a command lists these entries. Other commands like netstat, ipconfig, and route print provide different network information and do not display the ARP cache, so they are not suitable for this task.

Answer

ipconfig /all

Answer

route print

Answer

netstat -ano