212-89 Incident Handling Process — 10 Questions

Question 1

During a suspected data breach, you must collect volatile memory. Which tool and command is the industry-standard starting point for capturing an image of RAM in a Windows-based incident?

Accepted Answer

FTK Imager Memory Capture. FTK Imager Memory Capture is an industry-standard tool specifically designed for acquiring volatile memory (RAM) in a forensically sound manner, preserving metadata and ensuring integrity. It is widely accepted in incident response and digital forensics for Windows systems, providing a reliable starting point for memory analysis.

Answer

Netstat -an

Answer

Windows Task Manager dump

Answer

WinPcap capture

Question 2

A department head demands to know the names of the employees involved in an internal data leak. Which policy document defines your obligation to disclose or withhold this information?

Accepted Answer

Incident Communication Policy. The Incident Communication Policy defines the organization's procedures for communicating during and after an incident, including who is authorized to disclose information and to whom. It outlines obligations regarding internal and external notifications, including legal and privacy considerations, and thus governs whether you can disclose the names of employees involved in an internal data leak.

Answer

Acceptable Use Policy

Answer

Access Control Policy

Answer

Data Classification Policy

Question 3

Which of the following activities is best suited for the 'Recovery' phase of the incident handling process?

Accepted Answer

Scanning for vulnerabilities to ensure the exploit vector is closed. The Recovery phase of incident handling focuses on restoring normal operations and ensuring the exploited vulnerability is remediated to prevent re-infection. Scanning for vulnerabilities to confirm the exploit vector is closed is a recovery activity that validates the system is safe to return to production. This aligns with the goal of returning to a secure state after containment and eradication.

Answer

Isolating infected hosts from the network

Answer

Interviewing employees about the incident

Answer

Notifying the media of the breach

Question 4

You are configuring an automated incident response workflow in TheHive. Which specific configuration parameter must be validated to ensure that the incident triage phase correctly captures the 'Impact' and 'Urgency' fields for reporting?

Accepted Answer

The 'Custom Fields' definition within the incident template configuration. In TheHive, these fields are part of the incident template configuration, and incorrect mapping leads to failed data normalization during the ingestion phase.

Answer

The 'Elasticsearch' index prefix in system settings

Answer

The 'Analyzer' timeout setting in the application.conf file

Answer

The 'Cortex' connection string in the GUI settings

Question 5

During a ransomware outbreak, the incident response team lead must decide whether to disconnect a critically infected file server from the network. The server hosts a database that a revenue-generating application depends on. The team has already collected volatile data and a forensic image. Which containment approach best balances incident impact with business continuity?

Accepted Answer

Isolate the server from the network while keeping it powered on and allowing the database to continue serving the application locally.. The best containment strategy isolates the affected system to prevent further spread while maintaining essential business functions. Keeping the server powered on preserves volatile evidence and allows the database to continue serving the application locally. This approach aligns with the incident handling process by balancing damage limitation with operational continuity. It also avoids destructive actions like powering off or reimaging, which could complicate recovery and evidence collection.

Answer

Reimage the server immediately to restore operations, then reconnect it to the network.

Answer

Immediately power off the server to stop the encryption process.

Answer

Leave the server connected to monitor the attacker's behavior and gather more intelligence.

Question 6

A financial services firm has just confirmed a ransomware infection on several endpoints. The incident response team is preparing to contain the incident while preserving the ability to investigate and recover. Which TWO of the following containment actions are MOST appropriate at this stage? (Choose two.)

Accepted Answer

Disconnect the affected endpoints from the network to prevent further spread.. Containment aims to stop the spread of ransomware while preserving evidence and enabling recovery. Isolating infected endpoints and isolating the affected network segment both limit lateral movement and protect critical assets. Recovery actions such as reimaging or restoring backups must wait until containment is complete and the root cause is understood.

Answer

Disable the compromised user accounts and reset their credentials.

Answer

Reimage all affected endpoints immediately to restore normal operations.

Answer

Restore affected systems from the most recent backups.

Question 7

Which role in the Incident Response Team is primarily responsible for ensuring that the incident handling activities remain aligned with organizational legal and privacy requirements?

Accepted Answer

Legal Counsel. The legal counsel or representative ensures that all actions taken during an incident are compliant with applicable laws.

Answer

Technical Investigator

Answer

Incident Lead

Answer

Communications Officer

Question 8

You are managing chain of custody for a physical server seized during an investigation. What is the most critical action to ensure the evidence remains admissible in court?

Accepted Answer

Logging every individual who accessed, transported, or stored the device. Maintaining a verifiable, gapless log of every person who touched the evidence is the core requirement of chain of custody.

Answer

Taking photographs of the server location

Answer

Using an anti-static bag for transport

Answer

Hashing the drive contents immediately

Question 9

You are performing a post-incident review. Which action is the most important to ensure that the 'Lessons Learned' process effectively improves future response capabilities?

Accepted Answer

Documenting the root cause and defining specific, actionable process changes. The root cause analysis and resulting action items are what drive actual improvement in the IR lifecycle.

Answer

Updating the password policy

Answer

Archiving all forensic images for ten years

Answer

Assigning blame to the employee who made the error

Question 10

You are setting up a secure communication channel for the IR team during a major incident. Why is it recommended to use an out-of-band communication method?

Accepted Answer

To prevent the attacker from monitoring team communications. If the primary network is compromised, internal communication (email/Slack) may be monitored by the attacker.

Answer

To comply with the Acceptable Use Policy

Answer

To simplify documentation for the final report

Answer

To increase bandwidth for file transfers