212-89 Incident Handling Process Practice Test 3 — 15 Questions

Question 1

Which TWO of the following are essential components of an effective Incident Response (IR) plan?

Accepted Answer

List of key stakeholders and their contact details. Option C is correct because an effective IR plan must include a current list of key stakeholders — such as the CISO, legal counsel, IT operations, HR, communications, and possibly law enforcement or external forensics contacts — along with their contact details, so they can be reached immediately during an incident. Option D is correct because clearly defined roles and responsibilities (for example, incident commander, communications lead, forensics analyst, and remediation owner) ensure each team member knows exactly what to do, preventing confusion and duplicated effort during a high-pressure event. The remaining options do not belong: a full backup of financial records (A) is a data protection/recovery measure rather than an IR plan component, HR time-tracking instructions (B) are unrelated to incident handling, and a list of employees' social security numbers (E) is sensitive PII that would create a serious security and privacy risk if stored in an IR plan.

Answer

Full backup of the company's financial records

Answer

Detailed instructions on how to use the HR time-tracking system

Answer

A list of all employees' social security numbers

Question 2

You are configuring a SIEM for long-term storage of investigation logs. Which feature is most important to prevent evidence tampering?

Accepted Answer

WORM (Write Once, Read Many) storage media. WORM (Write Once, Read Many) storage ensures that once log data is written, it cannot be modified or deleted for a defined retention period, providing immutable evidence that satisfies chain-of-custody and regulatory requirements. This is the most important feature for preventing evidence tampering in long-term investigation log storage.

Answer

Automatic log compression

Answer

Log deduplication

Answer

Real-time log alerting

Question 3

Which THREE of the following should be included in an incident communication plan?

Accepted Answer

Rules for communicating with law enforcement. An incident communication plan must define how the organization interacts with external authorities, so option A (rules for communicating with law enforcement) is correct because it establishes when, how, and through whom law enforcement or regulatory bodies are contacted during a security incident. Option C (pre-approved templates for stakeholder notifications) is correct because having vetted templates for customers, executives, regulators, and media enables fast, consistent, and legally reviewed messaging under time pressure. Option E (emergency contact list for key personnel) is correct because the plan must identify who to reach (incident responders, legal counsel, PR, executives) and how, including after-hours numbers, to activate the response team quickly. Option B (the office building floor plan) is not part of an incident communication plan; it belongs to physical security or evacuation documentation. Option D (the marketing department's social media password) should never be included, since embedding credentials in a plan violates least privilege and secure credential management practices.

Answer

The office building floor plan

Answer

The company's marketing department's social media password

Question 4

Which THREE of the following are critical requirements for maintaining a valid Chain of Custody?

Accepted Answer

Verifying that the evidence was not tampered with during transport. Option B is correct because a valid Chain of Custody must demonstrate that evidence remained unaltered from seizure through presentation, which requires verifying integrity during transport (e.g., via hash comparison or sealed tamper-evident containers). Option D is correct because the core of Chain of Custody is a chronological record documenting every individual who took possession of the evidence, including times, dates, and signatures, ensuring unbroken accountability. Option E is correct because documenting exactly where evidence was stored (location, container, conditions) is essential to prove it was secured against unauthorized access or contamination. Option A does not belong because a log of software installed on the investigator's machine relates to tool validation and forensic soundness, not to the custody of the evidence itself. Option C does not belong because the attacker's original IP address is an investigative artifact or indicator of compromise, not a requirement for maintaining Chain of Custody.

Answer

A log of all software installed on the investigator's machine

Answer

A copy of the attacker's original IP address

Question 5

Which TWO of the following are common indicators that an incident should be declared?

Accepted Answer

Unusual or unauthorized system access patterns. Option B is correct because unusual or unauthorized system access patterns — such as logins from anomalous geolocations, off-hours authentication, or brute-force attempts — are classic indicators of a security incident requiring declaration and investigation. Option D is correct because an unexplained loss of service or system availability (e.g., unexpected downtime, DoS symptoms, or a crashed critical service) signals a potential incident that must be declared so response procedures can begin. Option A is not an indicator, since a scheduled software update is a planned, authorized change rather than an anomaly. Option C is not an indicator because elevated CPU usage during scheduled maintenance is expected and accounted for. Option E is not an indicator, as a routine password reset request is a normal helpdesk activity, not evidence of a security event.

Answer

A scheduled software update being pushed to clients

Answer

An increase in system CPU usage during scheduled maintenance

Answer

An employee requesting a password reset

Question 6

Which TWO of the following actions are standard steps in the 'Analysis' phase of an incident?

Accepted Answer

Identifying the scope and extent of the compromise. Option A is correct because determining the scope and extent of the compromise is a core Analysis-phase activity — analysts must establish which hosts, accounts, and data are affected to understand the incident's boundaries. Option E is correct because correlating logs from multiple sources (e.g., SIEM, EDR, firewall, and authentication logs) to reconstruct the timeline and attack chain is a fundamental analytical technique used to validate and understand what occurred. Option B (phishing awareness training) is a preventive/user-awareness measure, not part of analyzing an active incident. Option C (installing new antivirus software) is a remediation or hardening action, not analysis. Option D (restoring systems from backup) belongs to the recovery/eradication phase, not the Analysis phase.

Answer

Training employees on phishing awareness

Answer

Installing new antivirus software

Answer

Restoring systems from a backup

Question 7

Which THREE of the following roles are typically included in an IR team?

Accepted Answer

Human Resources Representative. The three roles marked correct are B, C, and E. Human Resources Representative (B) is typically included because HR manages employee-related aspects of an incident, such as insider threat investigations, disciplinary actions, and coordination of personnel communications. Incident Handler/Lead (C) is the core role that directs the technical response, triages alerts, contains and eradicates threats, and coordinates the overall IR lifecycle. Legal Counsel (E) is essential for advising on regulatory notification requirements, preserving evidence and chain of custody, managing liability, and ensuring compliance with laws such as GDPR or HIPAA. The unmarked options do not belong: the company's primary janitor (A) and web designer (D) have no defined IR responsibilities, authority, or technical/legal expertise relevant to incident response.

Answer

The company's primary janitor

Answer

The company's web designer

Question 8

Which TWO of the following are recommended when creating a forensic copy of a hard drive?

Accepted Answer

Using a physical write-blocker. Option A is correct because a physical write-blocker prevents any write operations from reaching the source drive during imaging, preserving the integrity of the original evidence so it is not altered. Option E is correct because calculating a cryptographic hash (e.g., MD5 or SHA-256) of both the original drive and the forensic image allows verification that the copy is bit-for-bit identical to the source. Option B is wrong because forensic imaging requires a full bit-by-bit copy of the entire drive, not selective copying of files that appear important. Option C is wrong because reformatting the drive would destroy the very evidence that needs to be preserved. Option D is wrong because installing drivers on the drive would modify its contents and violate the requirement to keep the original evidence unaltered.

Answer

Copying only the files that seem important

Answer

Reformatting the drive before imaging

Answer

Installing new drivers on the drive

Question 9

Which TWO of the following are common sources for incident identification?

Accepted Answer

Alerts from IDS or SIEM systems. Option C is correct because IDS (Intrusion Detection System) and SIEM (Security Information and Event Management) systems are designed to continuously monitor network traffic, logs, and events, generating alerts that are primary technical sources for identifying security incidents. Option E is correct because internal users or employees often report suspicious activity, phishing emails, or anomalies they encounter, making user reports a valuable and common human source of incident identification. The remaining options do not belong: randomly checking employee browser history (A) is not a systematic or standard detection method and raises privacy concerns, cleaning the breakroom (B) and the daily lunch menu (D) are unrelated to security monitoring or incident detection.

Answer

Randomly checking employee browser history

Answer

Cleaning the office breakroom

Answer

The daily lunch menu

Question 10

Which THREE of the following are legal considerations when handling an incident?

Accepted Answer

Compliance with regional data breach notification laws. Option C is correct because incident handling must comply with regional data breach notification laws, which set mandatory timelines and reporting requirements (e.g., GDPR's 72-hour notification) that dictate how and when an incident is disclosed. Option D is correct because the admissibility of collected evidence in a court of law depends on maintaining proper chain of custody, forensic soundness, and legal seizure procedures, so evidence handling must follow legal standards to be usable in prosecution. Option E is correct because privacy rights of the employees involved impose legal limits on monitoring, searching, and disclosing personal data during an investigation, requiring adherence to privacy statutes and internal policies. Option A is not a legal consideration but a financial and operational one, and Option B is a technical performance factor, neither of which involves legal obligations or constraints.

Answer

The cost of upgrading the company's hardware

Answer

The speed of the internet connection used for analysis

Question 11

You are utilizing NIST SP 800-61 Rev. 2 to structure your incident response team. During a critical ransomware outbreak, you need to assign a lead who coordinates with legal, PR, and executive leadership. Which role should you designate to ensure organizational communication is handled per the policy?

Accepted Answer

Incident Coordinator. The Incident Coordinator is the role responsible for orchestrating the overall response, including communication with legal, public relations, and executive leadership. NIST SP 800-61 Rev. 2 describes this coordination function as the single point of contact that manages information flow and ensures the response aligns with organisational policy. This role bridges the technical response team and the business stakeholders.

Answer

Technical Lead

Answer

Forensics Analyst

Answer

System Administrator

Question 12

While investigating a server compromise, you need to ensure the digital evidence collected from the RAID array is admissible in court. What is the most critical requirement for the chain of custody?

Accepted Answer

Maintaining a detailed log of every individual who accessed or transferred the evidence. Chain of custody requires a chronological log of who handled the evidence, where it was stored, and proof that it was not altered, typically via cryptographic hashes.

Answer

Deleting temporary files to prevent cross-contamination

Answer

Encrypting the collected evidence folder with AES-256

Answer

Creating a bit-stream image of the disk drive

Question 13

During the lessons learned phase of a P1 incident, you notice that the incident handling policy failed to define clear 'Rules of Engagement' for containment, leading to accidental service disruption. Which document should be updated to address this deficiency?

Accepted Answer

The Incident Response Plan (IRP). The Incident Response Plan (IRP) contains the specific procedures and rules for containment, and it must be updated to prevent future operational failures.

Answer

The Corporate Acceptable Use Policy

Answer

The Network Topology Map

Answer

The Business Continuity Plan (BCP)

Question 14

You are reviewing a failed incident case management report. The team failed to capture the 'Time of Detection' vs. 'Time of Occurrence'. Which metric is directly impacted by this lack of documentation?

Accepted Answer

Mean Time to Detect (MTTD). Mean Time to Detect (MTTD) is calculated by the difference between the actual occurrence and the detection time; failing to record these makes the metric impossible to compute.

Answer

False Positive Rate

Answer

Mean Time to Contain (MTTC)

Answer

Mean Time to Recover (MTTR)

Question 15

You are performing an incident investigation involving a suspected insider threat. Under GDPR compliance, you must ensure that your data collection methods adhere to the 'data minimization' principle. Which action best aligns with this requirement?

Accepted Answer

Collect only specific log entries and application artifacts related to the suspicious activity. Data minimization requires collecting only what is necessary for the investigation, avoiding the wholesale harvesting of unrelated user traffic or personal files.

Answer

Perform a full disk image of the suspect's entire workstation and cloud storage account

Answer

Install a keylogger on the workstation to monitor all user activity indefinitely

Answer

Request a full dump of the company-wide SQL database to search for activity