212-89 First Response — Timed 15 Questions

Question 1

When documenting the chain of custody for a seized laptop, which information is mandatory?

Accepted Answer

The serial number of the device.. A chain of custody must include the identity of the person collecting the evidence, the time/date, and the specific location of the item.

Answer

The name of the suspected attacker.

Answer

The user's password for the laptop.

Answer

The operating system version.

Question 2

You are using EnCase Endpoint Investigator to triage a suspicious endpoint. You need to identify unauthorized processes currently running. Which feature should you utilize?

Accepted Answer

Process List viewer.. The 'Process View' or 'Live Process' feature in EnCase allows for real-time investigation of currently executing processes on the remote endpoint.

Answer

File Signature Analysis.

Answer

Registry Analysis feature.

Answer

Event Log Collector.

Question 3

You are responding to an incident involving a compromised Windows server. You need to collect volatile data using a trusted toolkit. Which tool is standard for collecting running services and loaded DLLs?

Accepted Answer

PsService query. Sysinternals 'pslist' or 'listdlls' are standard, but 'DumpIt' or 'Magnet RAM Capture' are used for memory. For specific process/service visibility, 'PsService' is the tool.

Answer

System Information (msinfo32)

Answer

DiskPart

Answer

Taskmgr.exe

Question 4

As a first responder, you arrive at a compromised workstation showing signs of active malware beaconing. Which action should be performed first according to the Order of Volatility?

Accepted Answer

Perform a physical memory dump using FTK Imager.. The Order of Volatility dictates that the most volatile data should be collected first. Physical memory (RAM) is more volatile than disk storage and contains active malware, encryption keys, and network connections. Performing a physical memory dump with a tool like FTK Imager preserves this critical evidence before it is lost.

Answer

Create a bit-stream image of the hard drive.

Answer

Power down the machine to stop the malware.

Answer

Disconnect the network cable from the workstation.

Question 5

You are handling a database compromise. The database logs show evidence of SQL injection. What is the appropriate initial containment step for the database?

Accepted Answer

Disable the application service account.. Changing the database service account password prevents further unauthorized access without needing to shut down the service immediately.

Answer

Restart the database server.

Answer

Delete the entire database.

Answer

Clear the transaction logs.

Question 6

You discover a suspicious scheduled task on a server. Which Windows tool allows you to export this task for analysis without relying on the GUI?

Accepted Answer

schtasks /query /v. The 'schtasks' command-line tool is the standard way to query and manage tasks in Windows without triggering GUI-based auditing changes.

Answer

regedit.exe

Answer

netsh

Answer

Task Scheduler GUI.

Question 7

A user reports a 'missing' file that was present earlier. What is the first thing you should check in a forensic triage?

Accepted Answer

File system logs or audit logs for file deletion events.. The first step in forensic triage for a missing file is to check file system logs or audit logs for deletion events. These logs record when a file was deleted, by whom, and sometimes the process involved, providing immediate, non-destructive evidence. This aligns with the forensic principle of least volatility: logs are less volatile than the file itself and can be preserved for analysis. The recycle bin might be checked later, but logs give a definitive timeline and actor.

Answer

The recycle bin.

Answer

The backup server.

Answer

The user's email.

Question 8

Which THREE steps are involved in the standard triage process for a compromised endpoint?

Accepted Answer

Collection of volatile system information.. Triage involves identification, initial data capture, and containment analysis.

Answer

Replacing all server hardware.

Answer

Immediate deletion of all user accounts.

Question 9

Which THREE actions should be avoided during the initial response phase to ensure evidence integrity?

Accepted Answer

Installing security patches immediately.. Option B (Installing security patches immediately) must be avoided because patching alters system binaries, configuration files, and memory contents, destroying the state that existed at the time of the incident and potentially overwriting artifacts an investigator needs. Option C (Shutting down a system without capturing volatile data) is wrong because volatile evidence such as RAM contents, running processes, network connections, and cached credentials is lost on power-off, so the system should be isolated and volatile data captured first. Option D (Using native system tools that overwrite logs) should be avoided because tools like some built-in utilities can modify timestamps, rotate or truncate log files, and overwrite unallocated space, corrupting the integrity of the evidence. Option A is not among the correct answers because encrypting collected evidence files is actually a recommended practice to preserve confidentiality and integrity, and Option E is not correct because documenting the initial state of the system is a required step in the initial response phase, not an action to avoid.

Answer

Encrypting the evidence files.

Answer

Documenting the initial state of the system.

Question 10

You are triaging a compromised Windows workstation. Using the Volatility 3 framework, you need to identify hidden processes that may be indicative of a rootkit. Which command-line plugin provides the most direct evidence of process hiding by comparing the process list from the EPROCESS block against the thread scheduler list?

Accepted Answer

vol -f mem.dmp windows.psscan. The 'windows.psscan' plugin scans memory for EPROCESS objects, while 'windows.pstree' or 'windows.pslist' rely on the linked list of active processes. Comparing these identifies hidden processes.

Answer

vol -f mem.dmp windows.netscan

Answer

vol -f mem.dmp windows.handles

Answer

vol -f mem.dmp windows.memmap

Question 11

During a suspected ransomware incident, you are using EnCase Endpoint to perform remote triage. You need to collect volatile data without triggering the ransomware's anti-forensic triggers. Which action should you take first to ensure the integrity of evidence?

Accepted Answer

Capture the RAM using a trusted forensic tool like DumpIt.. Capturing volatile data (RAM) before any other forensic action is standard practice as it is the most fragile evidence.

Answer

Review the Windows Event Logs for unauthorized access.

Answer

Perform a bit-stream image of the physical hard drive.

Answer

Shut down the computer to prevent further encryption.

Question 12

You are managing a live incident and need to preserve the network state of a Linux server. You must capture active network connections and the routing table. Which tool and flag combination is preferred by first responders to ensure minimal impact on the target system's binary integrity?

Accepted Answer

netstat -rn using a statically linked netstat binary from a trusted external source.. Using statically linked binaries (often found on a trusted 'live response' USB) is standard practice to avoid using potentially compromised libraries on the host system.

Answer

cat /proc/net/dev directly.

Answer

ss -antup using the local /usr/bin/ss binary.

Answer

tcpdump -i any -w capture.pcap.

Question 13

You have identified an active C2 beacon on a corporate server. You are instructed to implement 'Containment' via network segmentation. Which configuration change on a Cisco ASA firewall provides the most effective containment while still allowing for remote forensic forensic analysis?

Accepted Answer

Apply an ACL to the ingress interface that permits traffic only from the IR forensic workstation IP.. Creating a restrictive ACL that allows only the IR team's management IP to access the compromised server while blocking all other traffic is the best practice for controlled containment.

Answer

Disable the interface in the server's OS.

Answer

Change the server's default gateway to a null route.

Answer

Shut down the switch port connected to the server.

Question 14

You are assembling a 'First Responder Toolkit' for a remote incident team. Which THREE items are essential for collecting volatile data and ensuring legal defensibility on a Windows system?

Accepted Answer

Tamper-evident bags for physical evidence.. Option A (tamper-evident bags for physical evidence) is correct because they preserve the chain of custody for any physical media or hardware seized during the response, which is required for legal defensibility. Option C (hardware write-blocker such as Tableau) is correct because it prevents any writes to a suspect drive during acquisition, preserving evidentiary integrity for later forensic analysis. Option D (a live response toolkit with statically linked binaries) is correct because statically linked tools run without depending on the target's DLLs or libraries, so volatile data such as memory, network connections, and running processes can be collected reliably and with minimal footprint. Option B (Nessus vulnerability scanner) is not part of volatile data collection or evidence preservation; it is used for vulnerability assessment and would alter the system state. Option E (installing packet sniffing software on the target host) is not appropriate because installing software modifies the host, contaminates volatile evidence, and is better performed with external capture or a pre-installed agent.

Answer

Network vulnerability scanner (e.g., Nessus).

Answer

Packet sniffing software to install on the target host.

Question 15

A first responder is preparing to collect evidence from a compromised laptop that is still powered on. The responder must ensure that the evidence will be admissible in a court of law. Which TWO actions should the responder take to maintain the integrity of the evidence? (Choose two.)

Accepted Answer

Capture volatile data such as running processes and network connections before shutting down.. To maintain evidence integrity, a first responder must capture volatile data before any shutdown and document system times to establish a reliable timeline. These steps preserve critical evidence that would otherwise be lost and demonstrate a methodical, forensically sound approach. Other actions either destroy volatile data or are not applicable while the system is live.

Answer

Immediately remove the hard drive and connect it to a forensic workstation for imaging.

Answer

Use a write-blocker when capturing the hard drive image after shutting down the system.

Answer

Immediately disconnect the laptop from the network to prevent further data exfiltration.