212-89 Incident Handling Process Practice Test 3 — 15 Questions

Question 1

Which THREE of the following should be included in an incident communication plan?

Accepted Answer

Rules for communicating with law enforcement. A communication plan defines who to tell, how to tell them, and what to say.

Answer

The office building floor plan

Answer

The company's marketing department's social media password

Question 2

Which THREE of the following are critical requirements for maintaining a valid Chain of Custody?

Accepted Answer

Verifying that the evidence was not tampered with during transport. The chain of custody requires documenting the 'who, what, where, and when' of evidence possession.

Answer

A log of all software installed on the investigator's machine

Answer

A copy of the attacker's original IP address

Question 3

Which TWO of the following are common indicators that an incident should be declared?

Accepted Answer

Unusual or unauthorized system access patterns. Evidence of unauthorized access or service disruption are clear triggers for declaring an incident.

Answer

A scheduled software update being pushed to clients

Answer

An increase in system CPU usage during scheduled maintenance

Answer

An employee requesting a password reset

Question 4

Which TWO of the following actions are standard steps in the 'Analysis' phase of an incident?

Accepted Answer

Identifying the scope and extent of the compromise. Analysis involves confirming the scope and technical details of the breach.

Answer

Training employees on phishing awareness

Answer

Installing new antivirus software

Answer

Restoring systems from a backup

Question 5

Which THREE of the following roles are typically included in an IR team?

Accepted Answer

Human Resources Representative. An IR team requires technical, legal, and managerial expertise.

Answer

The company's primary janitor

Answer

The company's web designer

Question 6

Which TWO of the following are recommended when creating a forensic copy of a hard drive?

Accepted Answer

Using a physical write-blocker. Integrity is ensured by hashing and using write-blockers.

Answer

Copying only the files that seem important

Answer

Reformatting the drive before imaging

Answer

Installing new drivers on the drive

Question 7

Which TWO of the following are common sources for incident identification?

Accepted Answer

Alerts from IDS or SIEM systems. Alerts from security tools and reports from users are the most common ways incidents are found.

Answer

Randomly checking employee browser history

Answer

Cleaning the office breakroom

Answer

The daily lunch menu

Question 8

Which THREE of the following are legal considerations when handling an incident?

Accepted Answer

Compliance with regional data breach notification laws. Data privacy, regulatory reporting, and evidence admissibility are critical legal areas.

Answer

The cost of upgrading the company's hardware

Answer

The speed of the internet connection used for analysis

Question 9

You are utilizing NIST SP 800-61 Rev. 2 to structure your incident response team. During a critical ransomware outbreak, you need to assign a lead who coordinates with legal, PR, and executive leadership. Which role should you designate to ensure organizational communication is handled per the policy?

Accepted Answer

Incident Coordinator. The Incident Coordinator or Communications Lead is responsible for managing the flow of information during an incident, keeping stakeholders informed without compromising technical investigation efforts.

Answer

Technical Lead

Answer

Forensics Analyst

Answer

System Administrator

Question 10

While investigating a server compromise, you need to ensure the digital evidence collected from the RAID array is admissible in court. What is the most critical requirement for the chain of custody?

Accepted Answer

Maintaining a detailed log of every individual who accessed or transferred the evidence. Chain of custody requires a chronological log of who handled the evidence, where it was stored, and proof that it was not altered, typically via cryptographic hashes.

Answer

Deleting temporary files to prevent cross-contamination

Answer

Encrypting the collected evidence folder with AES-256

Answer

Creating a bit-stream image of the disk drive

Question 11

During the lessons learned phase of a P1 incident, you notice that the incident handling policy failed to define clear 'Rules of Engagement' for containment, leading to accidental service disruption. Which document should be updated to address this deficiency?

Accepted Answer

The Incident Response Plan (IRP). The Incident Response Plan (IRP) contains the specific procedures and rules for containment, and it must be updated to prevent future operational failures.

Answer

The Corporate Acceptable Use Policy

Answer

The Network Topology Map

Answer

The Business Continuity Plan (BCP)

Question 12

You are reviewing a failed incident case management report. The team failed to capture the 'Time of Detection' vs. 'Time of Occurrence'. Which metric is directly impacted by this lack of documentation?

Accepted Answer

Mean Time to Detect (MTTD). Mean Time to Detect (MTTD) is calculated by the difference between the actual occurrence and the detection time; failing to record these makes the metric impossible to compute.

Answer

False Positive Rate

Answer

Mean Time to Contain (MTTC)

Answer

Mean Time to Recover (MTTR)

Question 13

You are performing an incident investigation involving a suspected insider threat. Under GDPR compliance, you must ensure that your data collection methods adhere to the 'data minimization' principle. Which action best aligns with this requirement?

Accepted Answer

Collect only specific log entries and application artifacts related to the suspicious activity. Data minimization requires collecting only what is necessary for the investigation, avoiding the wholesale harvesting of unrelated user traffic or personal files.

Answer

Perform a full disk image of the suspect's entire workstation and cloud storage account

Answer

Install a keylogger on the workstation to monitor all user activity indefinitely

Answer

Request a full dump of the company-wide SQL database to search for activity

Question 14

An organization is establishing an Incident Response (IR) team. According to NIST, which team structure is most suitable for a large, globally distributed organization that requires localized response capability with centralized oversight?

Accepted Answer

Distributed IR Team. A distributed team structure allows local teams to respond quickly to regional incidents while reporting to a centralized hub for unified policy enforcement.

Answer

Centralized IR Team

Answer

Virtual IR Team

Answer

Outsourced IR Team

Question 15

Which TWO of the following are essential components of an effective Incident Communication Plan?

Accepted Answer

A list of internal and external stakeholder contact details. An effective communication plan must include defined points of contact (who to talk to) and escalation triggers (when to notify them).

Answer

A standard template for forensic report generation

Answer

A list of firewall rules for blocking malicious IPs

Answer

Scripts for resetting user passwords