212-89 Incident Handling Process — 25 Questions

Question 1

During a suspected data breach, you must collect volatile memory. Which tool and command is the industry-standard starting point for capturing an image of RAM in a Windows-based incident?

Accepted Answer

FTK Imager Memory Capture. FTK Imager Memory Capture is an industry-standard tool specifically designed for acquiring volatile memory (RAM) in a forensically sound manner, preserving metadata and ensuring integrity. It is widely accepted in incident response and digital forensics for Windows systems, providing a reliable starting point for memory analysis.

Answer

Netstat -an

Answer

Windows Task Manager dump

Answer

WinPcap capture

Question 2

A department head demands to know the names of the employees involved in an internal data leak. Which policy document defines your obligation to disclose or withhold this information?

Accepted Answer

Incident Communication Policy. The Incident Communication Policy defines the organization's procedures for communicating during and after an incident, including who is authorized to disclose information and to whom. It outlines obligations regarding internal and external notifications, including legal and privacy considerations, and thus governs whether you can disclose the names of employees involved in an internal data leak.

Answer

Acceptable Use Policy

Answer

Access Control Policy

Answer

Data Classification Policy

Question 3

Which of the following activities is best suited for the 'Recovery' phase of the incident handling process?

Accepted Answer

Scanning for vulnerabilities to ensure the exploit vector is closed. The Recovery phase of incident handling focuses on restoring normal operations and ensuring the exploited vulnerability is remediated to prevent re-infection. Scanning for vulnerabilities to confirm the exploit vector is closed is a recovery activity that validates the system is safe to return to production. This aligns with the goal of returning to a secure state after containment and eradication.

Answer

Isolating infected hosts from the network

Answer

Interviewing employees about the incident

Answer

Notifying the media of the breach

Question 4

You are configuring an automated incident response workflow in TheHive. Which specific configuration parameter must be validated to ensure that the incident triage phase correctly captures the 'Impact' and 'Urgency' fields for reporting?

Accepted Answer

The 'Custom Fields' definition within the incident template configuration. In TheHive, these fields are part of the incident template configuration, and incorrect mapping leads to failed data normalization during the ingestion phase.

Answer

The 'Elasticsearch' index prefix in system settings

Answer

The 'Analyzer' timeout setting in the application.conf file

Answer

The 'Cortex' connection string in the GUI settings

Question 5

During a ransomware outbreak, the incident response team lead must decide whether to disconnect a critically infected file server from the network. The server hosts a database that a revenue-generating application depends on. The team has already collected volatile data and a forensic image. Which containment approach best balances incident impact with business continuity?

Accepted Answer

Isolate the server from the network while keeping it powered on and allowing the database to continue serving the application locally.. The best containment strategy isolates the affected system to prevent further spread while maintaining essential business functions. Keeping the server powered on preserves volatile evidence and allows the database to continue serving the application locally. This approach aligns with the incident handling process by balancing damage limitation with operational continuity. It also avoids destructive actions like powering off or reimaging, which could complicate recovery and evidence collection.

Answer

Reimage the server immediately to restore operations, then reconnect it to the network.

Answer

Immediately power off the server to stop the encryption process.

Answer

Leave the server connected to monitor the attacker's behavior and gather more intelligence.

Question 6

A financial services firm has just confirmed a ransomware infection on several endpoints. The incident response team is preparing to contain the incident while preserving the ability to investigate and recover. Which TWO of the following containment actions are MOST appropriate at this stage? (Choose two.)

Accepted Answer

Disconnect the affected endpoints from the network to prevent further spread.. Containment aims to stop the spread of ransomware while preserving evidence and enabling recovery. Isolating infected endpoints and isolating the affected network segment both limit lateral movement and protect critical assets. Recovery actions such as reimaging or restoring backups must wait until containment is complete and the root cause is understood.

Answer

Disable the compromised user accounts and reset their credentials.

Answer

Reimage all affected endpoints immediately to restore normal operations.

Answer

Restore affected systems from the most recent backups.

Question 7

Which role in the Incident Response Team is primarily responsible for ensuring that the incident handling activities remain aligned with organizational legal and privacy requirements?

Accepted Answer

Legal Counsel. The legal counsel or representative ensures that all actions taken during an incident are compliant with applicable laws.

Answer

Technical Investigator

Answer

Incident Lead

Answer

Communications Officer

Question 8

You are managing chain of custody for a physical server seized during an investigation. What is the most critical action to ensure the evidence remains admissible in court?

Accepted Answer

Logging every individual who accessed, transported, or stored the device. Maintaining a verifiable, gapless log of every person who touched the evidence is the core requirement of chain of custody.

Answer

Taking photographs of the server location

Answer

Using an anti-static bag for transport

Answer

Hashing the drive contents immediately

Question 9

You are performing a post-incident review. Which action is the most important to ensure that the 'Lessons Learned' process effectively improves future response capabilities?

Accepted Answer

Documenting the root cause and defining specific, actionable process changes. The root cause analysis and resulting action items are what drive actual improvement in the IR lifecycle.

Answer

Updating the password policy

Answer

Archiving all forensic images for ten years

Answer

Assigning blame to the employee who made the error

Question 10

You are setting up a secure communication channel for the IR team during a major incident. Why is it recommended to use an out-of-band communication method?

Accepted Answer

To prevent the attacker from monitoring team communications. If the primary network is compromised, internal communication (email/Slack) may be monitored by the attacker.

Answer

To comply with the Acceptable Use Policy

Answer

To simplify documentation for the final report

Answer

To increase bandwidth for file transfers

Question 11

You are establishing an Incident Response Plan (IRP). Which document should prioritize the technical steps for restoring services after a ransomware attack?

Accepted Answer

Playbook. The Incident Response Plan focuses on the procedural steps for handling specific incident types, including recovery.

Answer

Business Continuity Plan

Answer

Communication Plan

Answer

Security Policy

Question 12

You suspect an incident involves an insider threat. Which step should be taken FIRST to preserve the integrity of the potential evidence while minimizing system downtime?

Accepted Answer

Capture a bit-stream image of the storage media. Creating a forensic image ensures that the current state is preserved before any volatile data is lost or system state changes.

Answer

Change the root password to lock out the attacker

Answer

Delete the suspicious user account

Answer

Reboot the compromised system to clear malicious memory

Question 13

You have identified a potential Advanced Persistent Threat (APT) in your network. Which evidence preservation strategy is required to maintain the validity of the logs found in a SIEM?

Accepted Answer

Applying a cryptographic hash to the exported logs. Generating cryptographic hashes for log files ensures they can be verified as untampered during later analysis.

Answer

Moving the logs to a backup server

Answer

Printing the logs to a secure PDF

Answer

Taking a screenshot of the SIEM dashboard

Question 14

You are documenting a post-incident review. Which of the following should be included in the 'Timeline of Events' section?

Accepted Answer

The chronological order of detection, analysis, and containment actions. The 'Timeline of Events' section in a post-incident review should present a chronological sequence of key actions and occurrences, including detection, analysis, containment, eradication, and recovery. This helps identify gaps, measure response effectiveness, and improve future incident handling.

Answer

A list of all employees who were working during the incident

Answer

The cost estimate for all hardware replaced

Answer

The personal opinion of the investigators on who was responsible

Question 15

During the identification phase, you notice a high volume of traffic from an unknown IP to your web server. What is the most appropriate action to take first?

Accepted Answer

Analyze the traffic logs to determine the nature of the activity. Analyzing the traffic confirms whether it is an attack or benign activity before taking disruptive action.

Answer

Block the IP at the firewall immediately

Answer

Notify the local law enforcement

Answer

Shut down the web server

Question 16

When classifying the severity of an incident, which factor should carry the most weight in your decision-making process?

Accepted Answer

The potential impact on business availability and data integrity. The impact on business operations is the most significant factor in determining the urgency and scope of the response.

Answer

The number of security tools that flagged the alert

Answer

The time of day the incident occurred

Answer

The technical complexity of the exploit

Question 17

You are dealing with a legal hold request for data related to an investigation. How should you handle the data retention policy for this specific case?

Accepted Answer

Suspend the automatic deletion for the affected data. A legal hold overrides existing retention policies, preventing the automatic deletion of relevant data.

Answer

Export the data to a public cloud storage service

Answer

Follow the standard 90-day retention policy

Answer

Delete the data and generate an audit log

Question 18

An incident handler is reviewing an alert from the Endpoint Detection and Response (EDR) system. What is the main goal of the 'Containment' phase?

Accepted Answer

To limit the scope and damage of the incident. The primary goal of containment is to stop the spread of the attack and prevent further damage.

Answer

To identify the attacker

Answer

To analyze the root cause

Answer

To recover normal operations

Question 19

What is the primary function of an Incident Response (IR) policy?

Accepted Answer

To establish the authority and framework for incident management. An IR policy is a high-level governance document that assigns authority, defines the scope of the incident response programme, and establishes the framework within which procedures and plans operate. It answers 'who is in charge and under what mandate', not 'how do I remove malware'. It is approved by executive management and provides the organisational legitimacy for the IR team to act.

Answer

To monitor network traffic for threats

Answer

To define the budget for new security tools

Answer

To provide step-by-step instructions for patching servers

Question 20

Which team should be notified first in the event of a confirmed external data breach involving customer PII?

Accepted Answer

Legal and Privacy officers. In a confirmed external data breach involving customer PII, Legal and Privacy officers must be notified first because they own the regulatory notification obligations (e.g., GDPR, CCPA, HIPAA) and privilege considerations. Involving legal counsel early preserves attorney-client privilege over the investigation and ensures breach notification deadlines are met. They also coordinate with regulators, law enforcement, and affected parties as required by law.

Answer

The local news media

Answer

The marketing department

Answer

The software development team