212-89 Incident Handling Process Practice Test 4 — 15 Questions

Question 1

An organization is establishing an Incident Response (IR) team. According to NIST, which team structure is most suitable for a large, globally distributed organization that requires localized response capability with centralized oversight?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Distributed IR Team. A distributed team structure allows local teams to respond quickly to regional incidents while reporting to a centralized hub for unified policy enforcement.

Answer

Centralized IR Team

Answer

Virtual IR Team

Answer

Outsourced IR Team

Question 2

Which TWO of the following are essential components of an effective Incident Communication Plan?

Accepted Answer

A list of internal and external stakeholder contact details. Option A is correct because an effective Incident Communication Plan must identify who needs to be notified during an incident, so maintaining up-to-date contact details for internal and external stakeholders (employees, customers, regulators, law enforcement, media) is essential for timely and accurate dissemination of information. Option D is correct because defined escalation criteria specify the thresholds, severity levels, and triggers that determine when and how executive management must be notified, ensuring leadership is engaged appropriately without unnecessary delays or over-notification. Options B, C, and E are not components of an Incident Communication Plan: a forensic report template (B) belongs to incident investigation and documentation procedures, firewall rules for blocking malicious IPs (C) are part of technical containment and network security controls, and password reset scripts (E) are remediation/IT operational tools rather than communication planning elements.

Answer

A standard template for forensic report generation

Answer

A list of firewall rules for blocking malicious IPs

Answer

Scripts for resetting user passwords

Question 3

When managing the 'Lessons Learned' phase of the incident response lifecycle, which THREE activities should be conducted to ensure continuous improvement?

Accepted Answer

Reviewing the incident timeline to identify gaps in detection. Option B is correct because reviewing the incident timeline during the Lessons Learned phase reveals where detection, triage, or escalation failed, exposing concrete gaps such as missing SIEM alerts, inadequate log coverage, or delayed analyst response that can be remediated. Option D is correct because a post-incident report formally documents what went right and what went wrong, capturing root cause, response effectiveness, and metrics (e.g., MTTD/MTTR) that drive measurable improvements. Option E is correct because updating SOPs based on identified operational failures translates lessons into durable process changes, ensuring playbooks, runbooks, and escalation paths reflect the corrected procedures. Option A does not belong because a full production penetration test is a proactive security assessment, not a Lessons Learned activity, and it is out of scope for post-incident review. Option C does not belong because retaining evidence for 50 years in cold storage is an arbitrary, excessive retention choice unrelated to continuous improvement, and evidence retention periods should follow legal, regulatory, and policy requirements.

Answer

Conducting a penetration test against the entire production network

Answer

Archiving all evidence in a cold storage bucket for 50 years

Question 4

Which TWO of the following are considered 'Legal Considerations' during the Incident Handling process that must be integrated into the response plan?

Accepted Answer

Ensuring compliance with data breach notification statutes. Option B is correct because data breach notification statutes (e.g., GDPR, HIPAA, state laws like California's CCPA) impose legally mandated timelines and procedures for informing regulators and affected parties, and these legal obligations must be built into the incident response plan to avoid fines and liability. Option D is correct because a formal chain of custody documents who collected, handled, and transferred digital evidence, ensuring its admissibility in legal or disciplinary proceedings, which is a core legal consideration during incident handling. Option A is not a legal consideration but a technical containment measure performed on the edge firewall. Option C is an administrative maintenance task unrelated to legal obligations during incident response. Option E is a technical assessment activity, not a legal requirement, and would not by itself satisfy legal or evidentiary obligations.

Answer

Configuring automated IP blocking on the edge firewall

Answer

Updating the organizational server maintenance schedule

Answer

Running a vulnerability scan on the impacted systems

Question 5

During an incident, a security analyst discovers that a compromised workstation is communicating with a known malicious IP address. The analyst wants to block the IP at the perimeter firewall. Which phase of the incident handling process does this action fall under?

Accepted Answer

Containment. Blocking a malicious IP at the firewall is a containment action because it stops the incident from spreading or causing further damage. Containment is about limiting the blast radius, and this step prevents additional communication with the attacker. Eradication would involve removing the threat, while identification and recovery have different goals.

Answer

Recovery

Answer

Eradication

Answer

Identification

Question 6

A security team is reviewing their incident handling process after a recent data breach. They want to ensure that their eradication phase is effective. Which TWO activities are essential during the eradication phase? (Choose two.)

Accepted Answer

Applying security patches to vulnerable systems. Eradication involves removing the threat and its root cause. Deleting malicious files eliminates the immediate malware, while applying patches closes the vulnerability that was exploited. These actions ensure the threat is fully removed and cannot easily recur. Other options are containment or recovery activities.

Answer

Blocking the attacker's IP address at the firewall

Answer

Restoring data from backups

Answer

Conducting a lessons learned meeting

Question 7

A security analyst is documenting an incident that involved unauthorized access to a database. The analyst needs to record the timeline of events. Which phase of the incident handling process includes documenting the timeline?

Accepted Answer

Post-Incident Activity. Documenting the timeline is a key part of post-incident activity, where the incident is reviewed and lessons learned are captured. While timeline information is gathered throughout the process, the formal documentation and analysis occur after the incident is resolved, ensuring a complete record for future reference.

Answer

Containment

Answer

Preparation

Answer

Identification

Question 8

You are an incident handler assigned to a case involving a suspected insider threat. Before collecting evidence from an employee's workstation, you must ensure your actions are legally defensible and compliant with company policy. Which document should you consult FIRST to determine your authority to search and seize the workstation?

Accepted Answer

The incident response policy and its associated Rules of Engagement (RoE). The incident response policy and its Rules of Engagement establish the legal and procedural boundaries for an investigation. They define who may authorize searches, what actions are permitted, and how evidence must be handled. Consulting this document first ensures that the handler acts within granted authority and avoids actions that could invalidate evidence or expose the organization to liability.

Answer

The organization's Acceptable Use Policy (AUP)

Answer

The IT asset management database

Answer

The data retention and destruction schedule

Question 9

During the containment phase of a ransomware incident, you must decide whether to disconnect the infected host from the network or keep it connected for monitoring. The host is encrypting files on a shared network drive. Which action should you take FIRST to limit the spread while preserving evidence?

Accepted Answer

Disconnect the host from the network by unplugging the Ethernet cable or disabling Wi-Fi.. Disconnecting the host from the network is the most effective first step to stop the spread of ransomware to shared drives while preserving volatile evidence. It isolates the threat without destroying memory or running processes, allowing later forensic analysis. Powering off or leaving it connected both have significant drawbacks that could worsen the incident or hinder investigation.

Answer

Run a full antivirus scan on the infected host to remove the malware.

Answer

Immediately power off the infected host to stop encryption.

Answer

Leave the host connected and monitor network traffic to identify the command-and-control server.

Question 10

You are leading the eradication phase of a malware incident. Which TWO activities are essential to ensure the malware is completely removed and the system is restored to a trusted state? (Choose two.)

Accepted Answer

Applying all missing security patches and updates to the affected system and its dependencies.. Reimaging from a known-good baseline and applying all missing security patches are essential for complete eradication. Reimaging removes all malware artifacts, while patching eliminates the vulnerability that allowed the compromise. Together, they ensure the system is restored to a trusted state and reduce the risk of reinfection.

Answer

Deleting all files in the temporary directories of the affected system.

Answer

Running a single antivirus scan and quarantining detected threats.

Answer

Disconnecting the system from the network and leaving it offline for 30 days.

Question 11

During a live incident, an analyst needs to capture volatile data from a compromised Windows server before containment. The server has 32 GB of RAM and is still running. Which action should the analyst perform FIRST to preserve the most volatile evidence?

Accepted Answer

Capture the contents of RAM using a memory acquisition tool such as WinPmem.. The order of volatility dictates that the most perishable evidence be collected first. On a running system, RAM contents are lost upon shutdown or reboot, so memory acquisition precedes disk imaging, documentation, or containment. Capturing RAM preserves processes, network connections, and encryption keys that may not exist on disk, making it the essential first action in this scenario.

Answer

Document the system's serial number and asset tag for chain-of-custody records.

Answer

Disconnect the server from the network to prevent further spread.

Answer

Create a forensic image of the system drive using FTK Imager.

Question 12

After a major security breach, you are tasked with conducting a lessons learned meeting. Which of the following is the PRIMARY objective of this meeting?

Accepted Answer

To identify improvements to the incident response process and prevent recurrence.. The primary objective of a lessons learned meeting is to identify improvements to the incident response process and prevent recurrence. It is a constructive review that focuses on what happened, why, and how to enhance future response. Blame, cost calculation, or immediate plan updates are secondary or separate activities.

Answer

To immediately update the incident response plan with new technical controls.

Answer

To assign blame to the individuals responsible for the breach.

Answer

To determine the exact financial cost of the incident.

Question 13

An organization's CSIRT is activated for a suspected ransomware outbreak. The incident handler must decide whether to escalate the incident to management. According to the incident handling process, which factor is the MOST appropriate trigger for immediate escalation?

Accepted Answer

The incident affects a critical business system and has the potential to disrupt operations.. Escalation criteria in incident handling are based on business impact, scope, and urgency. A ransomware outbreak affecting a critical system with potential operational disruption clearly meets the threshold for immediate management notification. Technical details such as malware family or ticket status are secondary; the handler must focus on the potential harm to the organization and the need for management decisions.

Answer

The handler has completed the initial triage checklist.

Answer

The malware sample has been identified as a known ransomware family.

Answer

The incident has been assigned a ticket number in the incident tracking system.

Question 14

A hospital's incident response team has just finished eradicating a ransomware infection that encrypted several clinical workstations. The CISO asks the handler to formally close the incident and release the team. According to the incident handling process, which activity must occur BEFORE the incident can be declared closed?

Accepted Answer

Conduct a post-incident review and document lessons learned with stakeholders.. Incident closure requires a formal post-incident review where the team, management, and stakeholders examine the timeline, root cause, and response effectiveness. This review produces lessons learned and assigned improvements, which is the defining activity of the post-incident phase. Reimaging the enterprise, notifying media, or destroying evidence are either disproportionate, policy-bound, or destructive actions that do not constitute the required closure step.

Answer

Immediately notify the media to demonstrate transparency about the ransomware attack.

Answer

Delete all forensic evidence to free storage space now that eradication is complete.

Answer

Reimage every workstation on the hospital network to guarantee no residual malware remains.

Question 15

An incident handler is preparing the containment strategy for a compromised workstation that is communicating with a command-and-control server. Which TWO actions are appropriate immediate containment measures? (Choose two.)

Accepted Answer

Apply a firewall rule to block the known command-and-control IP address.. Containment aims to stop the spread and limit damage while preserving evidence. Disconnecting the workstation from the network and blocking the command-and-control IP at the firewall achieve isolation without destroying volatile data. Powering off, reimaging, or running antivirus scans either destroy evidence or are remediation steps, not containment, and should be deferred until after analysis.

Answer

Reimage the workstation with a clean operating system.

Answer

Run a full antivirus scan on the workstation.

Answer

Power off the workstation immediately.