212-89 Hard Questions — 25 Difficult Questions

Question 1

You suspect a CSRF (Cross-Site Request Forgery) attack. What log entry pattern confirms this?

Accepted Answer

Referer header showing a domain different from the application's domain. CSRF attacks originate from a different site. Checking the 'Referer' header in the logs for unexpected domains is the primary method for detection.

Answer

Multiple POST requests without a corresponding GET request

Answer

High volume of 401 Unauthorized errors

Answer

A sudden change in the session cookie value

Question 2

You suspect a DNS tunneling attack for data exfiltration. In your DNS server logs, which characteristic is the strongest indicator of a tunnel rather than standard recursive lookups?

Accepted Answer

Unusually long, high-entropy subdomains. DNS tunneling encodes data in the subdomain portion of DNS queries, and because DNS labels are limited to 63 characters, attackers pack them with long, random-looking (high-entropy) strings to maximize data throughput. Standard recursive lookups use short, human-readable domain names, so unusually long, high-entropy subdomains are the strongest indicator of a tunnel. Tools like iodine and dnscat2 produce exactly this pattern.

Answer

High volume of A records

Answer

Requests for PTR records

Answer

Queries to root hints

Question 3

An incident handler is documenting the timeline of a security breach. The handler discovers that system clocks on different servers are not synchronized. Which action should the handler take to ensure the timeline is accurate and defensible?

Accepted Answer

Normalize all timestamps to a common time zone and document the clock offsets.. When system clocks are unsynchronized, the handler must account for offsets and normalize timestamps to a common reference, such as UTC, while documenting each system's deviation. This preserves the integrity of the original evidence and enables accurate correlation. Excluding data, trusting one clock, or reconfiguring systems during the investigation are all inappropriate and can compromise the timeline's defensibility.

Answer

Reconfigure all servers to use a network time protocol server and restart them.

Answer

Exclude timestamps from servers with unsynchronized clocks to avoid confusion.

Answer

Use the timestamps from the server with the most reliable clock as the single source of truth.

Question 4

You are using YARA to detect a specific strain of ransomware. You want to match a file if it contains a specific hex string OR a specific string value. How do you construct this in your rule?

Accepted Answer

condition: $a or $b. YARA uses the 'or' operator within the condition section to evaluate multiple criteria, allowing a match if either condition is met.

Answer

condition: $a + $b

Answer

condition: $a != $b

Answer

condition: $a && $b

Question 5

Which TWO of the following techniques would an attacker likely use to hide lateral movement traffic within a network?

Accepted Answer

Masquerading malicious traffic on common ports like 443. Option A is correct because masquerading malicious traffic on common ports like 443 (HTTPS) allows the attacker's command-and-control or lateral movement traffic to blend in with legitimate encrypted web traffic, making it difficult for network monitoring tools to distinguish it from normal activity. Option E is correct because embedding data within encrypted SSH tunnels hides the actual payload from deep packet inspection, since the traffic appears as a legitimate SSH session on port 22, effectively concealing lateral movement. Option B is not correct because clear-text Telnet is easily detected by network monitoring and is not a stealthy technique for hiding traffic. Option C is not correct because sending traffic exclusively during business hours may reduce suspicion but does not inherently hide the traffic from detection systems. Option D is not correct because disabling logging on the source host is a host-based anti-forensic technique, not a network traffic-hiding technique for lateral movement.

Answer

Using clear-text Telnet for all communication

Answer

Sending traffic exclusively during business hours

Answer

Disabling all logging on the source host

Question 6

You are the first responder to a Linux server that is suspected of being compromised. You need to collect volatile data in the order of volatility. Which command should you run first to capture the most volatile data?

Accepted Answer

netstat -antp. The order of volatility guides first responders to collect the most perishable data first. Network connections are extremely volatile and can be lost within seconds if an attacker disconnects or a timeout occurs. Capturing them with netstat -antp provides immediate insight into active sessions and listening services. Process lists and disk logs, while important, are less volatile and can be collected subsequently without as much risk of loss.

Answer

cat /var/log/auth.log

Answer

df -h

Answer

ps aux

Question 7

Which THREE of the following characterize potential lateral movement using RDP in a domain environment?

Accepted Answer

Unusual use of NTLM for RDP authentication. Option A is correct because in a domain environment RDP authentication normally uses Kerberos, so a shift to NTLM for RDP (e.g., via Restricted Admin mode or credential-based attacks) is a strong indicator of lateral movement attempts. Option D is correct because mstsc.exe is the native RDP client, and its use with unusual flags (such as /admin, /restrictedAdmin, or /v to non-standard hosts) can signal an attacker pivoting between systems. Option E is correct because RDP logins originating from workstations to servers are atypical in most domain environments, where administrative RDP typically flows from jump hosts or management stations, making such connections a hallmark of lateral movement. Option B is incorrect because SNMP is a network management protocol unrelated to RDP session behavior. Option C is incorrect because HTTPS traffic is encrypted web traffic and does not characterize RDP-based lateral movement.

Answer

Increased usage of SNMP

Answer

High volume of HTTPS traffic

Question 8

During an incident response engagement, a first responder is collecting volatile data from a compromised Windows server. The responder needs to capture the current network connections, including the process ID associated with each connection, without installing any third-party tools. Which native Windows command should the responder use?

Accepted Answer

netstat -ano. The netstat -ano command is a native Windows utility that lists all active network connections and listening ports along with the owning process ID. This allows a first responder to quickly identify which process is associated with a suspicious connection, enabling immediate containment or further analysis without introducing third-party tools that could alter the system.

Answer

net session

Answer

tasklist /svc

Answer

ipconfig /displaydns

Question 9

You are dealing with a legal hold request for data related to an investigation. How should you handle the data retention policy for this specific case?

Accepted Answer

Suspend the automatic deletion for the affected data. A legal hold overrides existing retention policies, preventing the automatic deletion of relevant data.

Answer

Export the data to a public cloud storage service

Answer

Follow the standard 90-day retention policy

Answer

Delete the data and generate an audit log

Question 10

A web application is vulnerable to session fixation. What is the primary indicator of this attack in the logs?

Accepted Answer

A user session ID remains identical before and after a successful authentication event. Session fixation occurs when an attacker sets or knows a victim's session ID before authentication and the application fails to regenerate that ID after login. The primary log indicator is therefore a session ID that remains identical before and after a successful authentication event. This persistence of the pre-authentication session identifier is the defining signature of the vulnerability being exploited.

Answer

High volume of requests to the login page without POST data

Answer

The same session ID is associated with two different IP addresses within a short timeframe

Answer

A sudden spike in failed login attempts

Question 11

You suspect an incident involves an insider threat. Which step should be taken FIRST to preserve the integrity of the potential evidence while minimizing system downtime?

Accepted Answer

Capture a bit-stream image of the storage media. Creating a forensic image ensures that the current state is preserved before any volatile data is lost or system state changes.

Answer

Change the root password to lock out the attacker

Answer

Delete the suspicious user account

Answer

Reboot the compromised system to clear malicious memory

Question 12

Which THREE of the following tools would be most effective for performing live memory forensics on a compromised Windows workstation?

Accepted Answer

WinPmem. WinPmem (B) is a purpose-built, open-source memory acquisition driver for Windows that captures physical RAM to a raw image while preserving volatile evidence such as running processes, network connections, and injected code. Magnet RAM Capture (C) is a free forensic acquisition tool from Magnet Forensics that dumps physical memory on Windows systems into a .raw/.mem image suitable for later analysis. Volatility 3 (E) is the leading memory forensics framework that parses those acquired images to extract processes, handles, DLLs, registry hives, and malware artifacts, making it essential for the analysis phase of live memory forensics. CCleaner (A) is a system-cleaning utility that deletes temporary files and traces, which would destroy volatile evidence rather than preserve it. Windows Update (D) is a patching service with no forensic acquisition or analysis capability and is irrelevant to memory forensics.

Answer

CCleaner

Answer

Windows Update

Question 13

An organization's CSIRT is activated for a suspected ransomware outbreak. The incident handler must decide whether to escalate the incident to management. According to the incident handling process, which factor is the MOST appropriate trigger for immediate escalation?

Accepted Answer

The incident affects a critical business system and has the potential to disrupt operations.. Escalation criteria in incident handling are based on business impact, scope, and urgency. A ransomware outbreak affecting a critical system with potential operational disruption clearly meets the threshold for immediate management notification. Technical details such as malware family or ticket status are secondary; the handler must focus on the potential harm to the organization and the need for management decisions.

Answer

The handler has completed the initial triage checklist.

Answer

The malware sample has been identified as a known ransomware family.

Answer

The incident has been assigned a ticket number in the incident tracking system.

Question 14

A security team is reviewing their incident handling process after a recent data breach. They want to ensure that their eradication phase is effective. Which TWO activities are essential during the eradication phase? (Choose two.)

Accepted Answer

Applying security patches to vulnerable systems. Eradication involves removing the threat and its root cause. Deleting malicious files eliminates the immediate malware, while applying patches closes the vulnerability that was exploited. These actions ensure the threat is fully removed and cannot easily recur. Other options are containment or recovery activities.

Answer

Blocking the attacker's IP address at the firewall

Answer

Restoring data from backups

Answer

Conducting a lessons learned meeting

Question 15

An incident responder is investigating a suspected data exfiltration over HTTPS. The organization uses a next-generation firewall with TLS inspection enabled. Which artifact from the firewall logs would best help identify the exfiltration channel?

Accepted Answer

The TLS certificate issuer and common name of the external server. When TLS inspection is enabled, the firewall can decrypt and log detailed information about HTTPS sessions, including the server certificate. The certificate issuer and common name can reveal if the external server is legitimate or suspicious, such as a self-signed certificate or a known malicious domain. This is more specific than generic IP/port or byte counts, and directly aids in identifying the exfiltration channel.

Answer

The HTTP User-Agent string used by the internal host

Answer

The total number of bytes transferred during the session

Answer

The source IP address and port number of the internal host

Question 16

A security analyst is reviewing network traffic and observes a large number of TCP RST packets being sent from an internal server to various external IP addresses. The server is not responding to any SYN packets. Which type of network incident is most likely occurring?

Accepted Answer

TCP reset attack to disrupt communications. The internal server is sending TCP RST packets to various external IP addresses and is not responding to SYN packets. This behavior is indicative of a TCP reset attack, where an attacker uses a compromised host to send spoofed RST packets to disrupt legitimate TCP sessions. The incident handler should investigate the server for compromise and analyze the RST packets for spoofed source addresses.

Answer

TCP RST flood denial-of-service attack

Answer

TCP SYN scan with RST responses

Answer

TCP SYN flood denial-of-service attack

Question 17

During a malware incident, you observe that a compromised system is communicating with a known command-and-control (C2) server at 203.0.113.45 over TCP port 443. You need to block this communication at the network perimeter to prevent further data exfiltration. Which action should you take?

Accepted Answer

Create an outbound firewall rule to block traffic to 203.0.113.45 on port 443. The compromised system initiates outbound connections to the C2 server, so blocking outbound traffic to that specific IP and port is the most effective way to sever communication. This action prevents data exfiltration and further instructions from the attacker. It is targeted and minimizes disruption to legitimate traffic.

Answer

Add a static route to null0 for 203.0.113.45 on the internal router

Answer

Enable deep packet inspection (DPI) to block all HTTPS traffic

Answer

Create an inbound firewall rule to block traffic from 203.0.113.45

Question 18

Which TWO criteria must a first responder satisfy when choosing a tool for a toolkit?

Accepted Answer

The tool must be known to have minimal impact on the target system.. Tools must be trusted and cause minimal impact on the subject system.

Answer

The tool must run on a cloud-based server.

Answer

The tool must be proprietary and expensive.

Answer

The tool must be able to delete the malware.

Question 19

You are managing a live incident and need to preserve the network state of a Linux server. You must capture active network connections and the routing table. Which tool and flag combination is preferred by first responders to ensure minimal impact on the target system's binary integrity?

Accepted Answer

netstat -rn using a statically linked netstat binary from a trusted external source.. Using statically linked binaries (often found on a trusted 'live response' USB) is standard practice to avoid using potentially compromised libraries on the host system.

Answer

cat /proc/net/dev directly.

Answer

ss -antup using the local /usr/bin/ss binary.

Answer

tcpdump -i any -w capture.pcap.

Question 20

You are configuring an automated incident response workflow in TheHive. Which specific configuration parameter must be validated to ensure that the incident triage phase correctly captures the 'Impact' and 'Urgency' fields for reporting?

Accepted Answer

The 'Custom Fields' definition within the incident template configuration. In TheHive, these fields are part of the incident template configuration, and incorrect mapping leads to failed data normalization during the ingestion phase.

Answer

The 'Elasticsearch' index prefix in system settings

Answer

The 'Analyzer' timeout setting in the application.conf file

Answer

The 'Cortex' connection string in the GUI settings