212-89 Incident Handling Process Practice Test 2 — 15 Questions

Question 1

When classifying the severity of an incident, which factor should carry the most weight in your decision-making process?

Accepted Answer

The potential impact on business availability and data integrity. The impact on business operations is the most significant factor in determining the urgency and scope of the response.

Answer

The number of security tools that flagged the alert

Answer

The time of day the incident occurred

Answer

The technical complexity of the exploit

Question 2

You are dealing with a legal hold request for data related to an investigation. How should you handle the data retention policy for this specific case?

Accepted Answer

Suspend the automatic deletion for the affected data. A legal hold overrides existing retention policies, preventing the automatic deletion of relevant data.

Answer

Export the data to a public cloud storage service

Answer

Follow the standard 90-day retention policy

Answer

Delete the data and generate an audit log

Question 3

An incident handler is reviewing an alert from the Endpoint Detection and Response (EDR) system. What is the main goal of the 'Containment' phase?

Accepted Answer

To limit the scope and damage of the incident. The primary goal of containment is to stop the spread of the attack and prevent further damage.

Answer

To identify the attacker

Answer

To analyze the root cause

Answer

To recover normal operations

Question 4

What is the primary function of an Incident Response (IR) policy?

Accepted Answer

To establish the authority and framework for incident management. An IR policy is a high-level governance document that assigns authority, defines the scope of the incident response programme, and establishes the framework within which procedures and plans operate. It answers 'who is in charge and under what mandate', not 'how do I remove malware'. It is approved by executive management and provides the organisational legitimacy for the IR team to act.

Answer

To monitor network traffic for threats

Answer

To define the budget for new security tools

Answer

To provide step-by-step instructions for patching servers

Question 5

Which team should be notified first in the event of a confirmed external data breach involving customer PII?

Accepted Answer

Legal and Privacy officers. In a confirmed external data breach involving customer PII, Legal and Privacy officers must be notified first because they own the regulatory notification obligations (e.g., GDPR, CCPA, HIPAA) and privilege considerations. Involving legal counsel early preserves attorney-client privilege over the investigation and ensures breach notification deadlines are met. They also coordinate with regulators, law enforcement, and affected parties as required by law.

Answer

The local news media

Answer

The marketing department

Answer

The software development team

Question 6

When dealing with digital evidence in a remote investigation, what is the standard procedure to ensure evidence integrity during network transfer?

Accepted Answer

Use a secure, encrypted tunnel and verify hashes at the destination. The standard procedure for ensuring evidence integrity during network transfer is to use a secure, encrypted tunnel (e.g., VPN, TLS) and verify hashes at the destination. This ensures both confidentiality during transmission and integrity verification that the evidence was not altered. Hash verification (e.g., SHA-256) before and after transfer confirms the data is bit-for-bit identical.

Answer

Compress the data using zip files to reduce file size

Answer

Email the files to the lead investigator

Answer

Transfer the data over FTP to a staging server

Question 7

You are using a SIEM to correlate events during an investigation. What is the primary advantage of correlation in incident analysis?

Accepted Answer

It links related alerts to show the attack progression. Correlation in a SIEM links events from multiple sources (firewall, endpoint, authentication, proxy) that share attributes like IP, user, or timestamp, revealing the sequence of an attack. This transforms isolated alerts into a coherent narrative — for example, linking a failed login spike to a successful login from a new geography to a lateral movement alert — which is the primary advantage for incident analysis.

Answer

It reduces the amount of storage required for logs

Answer

It automatically blocks all suspicious traffic

Answer

It replaces the need for human analysis

Question 8

You are preparing a final report for an incident. Which element is mandatory for ensuring the report serves as a valid document for future insurance or legal claims?

Accepted Answer

Verification and sign-off by the relevant stakeholders and legal counsel. For an incident report to be admissible as evidence or usable in an insurance claim, it must be authenticated and shown to be a reliable, unaltered record of the investigation. Verification and sign-off by relevant stakeholders and legal counsel establishes the report's authenticity, chain of custody, and organizational authority, which is what courts and insurers require. Without this attestation, the report is just an internal narrative with no legal weight.

Answer

A copy of all emails sent by the attacker

Answer

A detailed technical guide on how to configure the firewall

Answer

A list of every employee's salary grade

Question 9

You are assessing the effectiveness of a containment strategy for a worm spreading through the network. What is the most effective metric to use?

Accepted Answer

The rate of new successful infections. The rate of new successful infections directly measures whether the containment strategy is actually stopping the worm from spreading to new hosts, which is the definition of containment effectiveness. A declining infection rate indicates the worm is being contained; a rising or flat rate indicates the strategy is failing. This metric is outcome-focused and tied to the adversary's propagation capability.

Answer

Total time spent by the IR team

Answer

Number of emails sent by the IR team

Answer

Total number of systems scanned

Question 10

During an incident, why is it important to keep the 'Incident Log' updated in real-time?

Accepted Answer

To provide an accurate, chronological record for the final report. A real-time log ensures an accurate, contemporaneous record of actions, which is vital for later analysis and legal defense.

Answer

To keep the team busy

Answer

To allow management to monitor the team's progress

Answer

To comply with IT service desk ticket requirements

Question 11

During an investigation, you need to verify the integrity of a system configuration file. You have the original known-good hash. What does it mean if the hash of the current file matches the known-good hash?

Accepted Answer

The file contents are identical to the known-good state. If the hashes match, the file content has not changed, ensuring the file's integrity.

Answer

The system is definitely not compromised

Answer

The file was recently updated by an administrator

Answer

The file is free of malware

Question 12

You are choosing a destination for forensic image storage. What is the most critical characteristic of this storage?

Accepted Answer

Write-protection and tamper-evident logging. The storage must be write-blocked or read-only once data is written to ensure the evidence cannot be altered.

Answer

Fast read/write speeds

Answer

Cloud-based accessibility

Answer

High storage capacity

Question 13

What is the primary purpose of the 'Preparation' phase in the incident response lifecycle?

Accepted Answer

To establish the capabilities and resources for response. The Preparation phase in the incident response lifecycle exists to build the capabilities, tools, communication paths, and resources needed before an incident occurs, so the organization can respond effectively when one does. It covers establishing the IR team, acquiring tooling, defining policies and playbooks, and conducting training and exercises. This is distinct from the reactive phases (detection, containment, eradication, recovery) that only execute once an incident is underway.

Answer

To contain the threat

Answer

To analyze the incident after it happens

Answer

To provide training to end users

Question 14

When conducting an interview with a potential witness during an investigation, what is the best practice to follow?

Accepted Answer

Ask open-ended questions to gather facts without bias. Open-ended questions allow witnesses to provide their own account without being steered by the interviewer's assumptions, preserving the integrity and admissibility of the evidence. This approach aligns with forensic interviewing best practices, such as the cognitive interview technique, which emphasizes free recall before specific probing. It reduces the risk of contaminating witness memory and ensures the investigation remains objective.

Answer

Ask leading questions to confirm your suspicions

Answer

Have the witness sign a statement before they start talking

Answer

Record the interview without telling the witness

Question 15

Which TWO of the following are primary objectives of the 'Lessons Learned' phase?

Accepted Answer

Updating policies and procedures to prevent recurrence. Option C is correct because the Lessons Learned phase exists to feed findings back into the organization's documentation, so updating policies, procedures, and controls to prevent recurrence of the incident is a primary objective. Option E is correct because a core purpose of the post-incident review is to identify security gaps and weaknesses in the current response process, such as missed detection opportunities or ineffective containment steps, so they can be remediated. The remaining options do not belong: A is wrong because incident records and evidence must be retained for legal, forensic, and compliance purposes rather than deleted, B is wrong because assigning financial bonuses is a human-resources matter unrelated to the review's objectives, and D is wrong because testing a building's backup power supply is a routine maintenance or contingency test, not an objective of the Lessons Learned phase.

Answer

Deleting all incident records to protect privacy

Answer

Assigning financial bonuses to the team

Answer

Testing the backup power supply of the building