212-89 Incident Handling Process Practice Test 2 — 15 Questions

Question 1

Which of the following activities is best suited for the 'Recovery' phase of the incident handling process?

Accepted Answer

Scanning for vulnerabilities to ensure the exploit vector is closed. Recovery involves restoring systems to a clean state, which includes verifying patches and security controls.

Answer

Isolating infected hosts from the network

Answer

Interviewing employees about the incident

Answer

Notifying the media of the breach

Question 2

What is the primary function of an Incident Response (IR) policy?

Accepted Answer

To establish the authority and framework for incident management. An IR policy provides the high-level authority and framework for how an organization prepares for and responds to incidents.

Answer

To monitor network traffic for threats

Answer

To define the budget for new security tools

Answer

To provide step-by-step instructions for patching servers

Question 3

Which team should be notified first in the event of a confirmed external data breach involving customer PII?

Accepted Answer

Legal and Privacy officers. Legal and Data Privacy teams must be involved early to handle regulatory compliance and notifications.

Answer

The local news media

Answer

The marketing department

Answer

The software development team

Question 4

When dealing with digital evidence in a remote investigation, what is the standard procedure to ensure evidence integrity during network transfer?

Accepted Answer

Use a secure, encrypted tunnel and verify hashes at the destination. Using encrypted, secure tunnels and verifying hashes at both ends is the standard for remote forensic collection.

Answer

Compress the data using zip files to reduce file size

Answer

Email the files to the lead investigator

Answer

Transfer the data over FTP to a staging server

Question 5

You are using a SIEM to correlate events during an investigation. What is the primary advantage of correlation in incident analysis?

Accepted Answer

It links related alerts to show the attack progression. Correlation links disparate events across different devices to reveal the full attack path.

Answer

It reduces the amount of storage required for logs

Answer

It automatically blocks all suspicious traffic

Answer

It replaces the need for human analysis

Question 6

You are preparing a final report for an incident. Which element is mandatory for ensuring the report serves as a valid document for future insurance or legal claims?

Accepted Answer

Verification and sign-off by the relevant stakeholders and legal counsel. The report must be signed by the incident lead and reviewed by legal to serve as an official, admissible document.

Answer

A copy of all emails sent by the attacker

Answer

A detailed technical guide on how to configure the firewall

Answer

A list of every employee's salary grade

Question 7

You are assessing the effectiveness of a containment strategy for a worm spreading through the network. What is the most effective metric to use?

Accepted Answer

The rate of new successful infections. The rate of new infections is the most direct indicator of whether the containment strategy is successfully stopping the spread.

Answer

Total time spent by the IR team

Answer

Number of emails sent by the IR team

Answer

Total number of systems scanned

Question 8

During an incident, why is it important to keep the 'Incident Log' updated in real-time?

Accepted Answer

To provide an accurate, chronological record for the final report. A real-time log ensures an accurate, contemporaneous record of actions, which is vital for later analysis and legal defense.

Answer

To keep the team busy

Answer

To allow management to monitor the team's progress

Answer

To comply with IT service desk ticket requirements

Question 9

During an investigation, you need to verify the integrity of a system configuration file. You have the original known-good hash. What does it mean if the hash of the current file matches the known-good hash?

Accepted Answer

The file contents are identical to the known-good state. If the hashes match, the file content has not changed, ensuring the file's integrity.

Answer

The system is definitely not compromised

Answer

The file was recently updated by an administrator

Answer

The file is free of malware

Question 10

You are choosing a destination for forensic image storage. What is the most critical characteristic of this storage?

Accepted Answer

Write-protection and tamper-evident logging. The storage must be write-blocked or read-only once data is written to ensure the evidence cannot be altered.

Answer

Fast read/write speeds

Answer

Cloud-based accessibility

Answer

High storage capacity

Question 11

What is the primary purpose of the 'Preparation' phase in the incident response lifecycle?

Accepted Answer

To establish the capabilities and resources for response. Preparation involves establishing the tools, teams, and plans necessary to respond effectively when an incident occurs.

Answer

To contain the threat

Answer

To analyze the incident after it happens

Answer

To provide training to end users

Question 12

When conducting an interview with a potential witness during an investigation, what is the best practice to follow?

Accepted Answer

Ask open-ended questions to gather facts without bias. Structured, open-ended questions minimize bias and allow the witness to provide their full account.

Answer

Ask leading questions to confirm your suspicions

Answer

Have the witness sign a statement before they start talking

Answer

Record the interview without telling the witness

Question 13

Which TWO of the following are primary objectives of the 'Lessons Learned' phase?

Accepted Answer

Updating policies and procedures to prevent recurrence. Lessons learned aims to improve future response and document findings for management.

Answer

Deleting all incident records to protect privacy

Answer

Assigning financial bonuses to the team

Answer

Testing the backup power supply of the building

Question 14

Which TWO of the following are essential components of an effective Incident Response (IR) plan?

Accepted Answer

List of key stakeholders and their contact details. An IR plan must have defined roles and clear contact information to be actionable.

Answer

Full backup of the company's financial records

Answer

Detailed instructions on how to use the HR time-tracking system

Answer

A list of all employees' social security numbers

Question 15

You are configuring a SIEM for long-term storage of investigation logs. Which feature is most important to prevent evidence tampering?

Accepted Answer

WORM (Write Once, Read Many) storage media. WORM (Write Once, Read Many) storage ensures that logs cannot be deleted or modified once they are written, providing strong integrity.

Answer

Automatic log compression

Answer

Log deduplication

Answer

Real-time log alerting