212-89 Incident Handling Process Practice Test 5 — 15 Questions

Question 1

A security analyst receives an alert about a possible data exfiltration from a compromised workstation. The analyst needs to determine the scope of the incident by identifying other systems that may have communicated with the same command-and-control (C2) server. Which data source is most effective for this correlation during the identification phase?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Firewall and proxy logs aggregated in a SIEM.. Firewall and proxy logs, especially when centralized in a SIEM, provide the network visibility needed to identify all hosts communicating with a known malicious IP or domain. This correlation is essential for scoping a data exfiltration incident, as it reveals other potentially compromised systems. Antivirus, domain controller, and email logs each offer valuable but different perspectives; none provide the direct network connection data required to track C2 communications across the enterprise.

Answer

Windows Event Logs from the domain controller.

Answer

Email gateway logs for inbound messages.

Answer

Antivirus logs from the endpoint protection console.

Question 2

After an incident has been resolved, the incident handler is conducting a post-incident review. Which activity is the PRIMARY purpose of this phase?

Accepted Answer

Identifying lessons learned to improve future incident response.. The post-incident review, or lessons learned phase, is dedicated to analyzing the incident and the response to identify improvements. Its primary purpose is to enhance future incident handling by updating plans, procedures, and training. Blame, recovery, and ticket closure are either inappropriate or belong to other phases, making lessons learned the correct focus.

Answer

Assigning blame to the employees responsible for the incident.

Answer

Restoring affected systems to normal operations.

Answer

Closing the incident ticket in the tracking system.

Question 3

A handler is documenting a confirmed breach of a customer database. Legal counsel needs to know the earliest point at which the organization 'knew' the incident occurred for regulatory reporting deadlines. During which phase of the incident handling process does this formal determination of incident occurrence typically get made?

Accepted Answer

Identification. The moment an organization validates that a detected event is a real incident marks its awareness, and that determination is made during the identification phase. This timestamp is what legal and compliance teams use to calculate regulatory notification windows. Preparation precedes any event, while containment and eradication happen after awareness is already established, so none of those phases can define when the organization first knew.

Answer

Eradication

Answer

Preparation

Answer

Containment

Question 4

After containing a malware incident, the incident response team needs to remove the malware from infected systems and restore them to a trusted state. Which activity is part of the eradication phase?

Accepted Answer

Applying security patches and updating antivirus signatures.. Eradication focuses on eliminating the threat and the vulnerabilities that allowed it. Applying security patches and updating antivirus signatures directly removes malware and closes the door to reinfection. Reconnecting to the network, conducting lessons learned, and isolating the system belong to recovery, post-incident, and containment phases respectively. Thus, patching and updating signatures are the correct eradication activities.

Answer

Conducting a lessons learned meeting.

Answer

Reconnecting the system to the production network.

Answer

Isolating the infected system from the network.

Question 5

An incident handler is documenting the timeline of a security breach. The handler discovers that system clocks on different servers are not synchronized. Which action should the handler take to ensure the timeline is accurate and defensible?

Accepted Answer

Normalize all timestamps to a common time zone and document the clock offsets.. When system clocks are unsynchronized, the handler must account for offsets and normalize timestamps to a common reference, such as UTC, while documenting each system's deviation. This preserves the integrity of the original evidence and enables accurate correlation. Excluding data, trusting one clock, or reconfiguring systems during the investigation are all inappropriate and can compromise the timeline's defensibility.

Answer

Reconfigure all servers to use a network time protocol server and restart them.

Answer

Exclude timestamps from servers with unsynchronized clocks to avoid confusion.

Answer

Use the timestamps from the server with the most reliable clock as the single source of truth.

Question 6

A financial services firm has activated its incident response plan after detecting unauthorized access to an internal file server. The incident commander must decide which activities belong to the containment phase rather than recovery. (Choose two.)

Accepted Answer

Isolating the affected server from the production network by disabling its switch port.. Containment focuses on stopping the spread and limiting damage while preserving evidence, which isolation of the compromised host and blocking the attacker's command-and-control channels both accomplish. Restoring from backup, patching the exploited vulnerability, and re-enabling user access are recovery or eradication activities that occur only after the threat has been contained and removed from the environment.

Answer

Re-enabling user access to shared drives after verifying file integrity checksums.

Answer

Restoring the file server from the most recent clean backup and returning it to service.

Answer

Applying the vendor security patch that fixes the vulnerability used to gain initial access.

Question 7

An organization's incident response team is drafting its first formal incident handling capability. Management asks which phase of the process should include developing the incident response plan, acquiring forensic tools, and training the team before any real event occurs.

Accepted Answer

Preparation. Preparation is the only phase that occurs before incidents and encompasses building the plan, acquiring and maintaining forensic tooling, and training responders. Identification, containment, and post-incident activity all presuppose that this groundwork already exists, so they cannot be the phase in which the organization first creates its incident handling capability.

Answer

Containment

Answer

Identification

Answer

Post-incident activity

Question 8

An organization is conducting a post-incident review after a major data breach. The team must document the incident timeline, root cause, and corrective actions. Which phase of the incident handling process does this activity belong to?

Accepted Answer

Post-incident activity. The post-incident activity phase encompasses all actions taken after the incident is resolved, including reviewing what happened, why it happened, and how to prevent recurrence. Documenting the timeline, root cause, and corrective actions is central to this phase. Preparation, identification, and containment are earlier phases focused on readiness, detection, and damage limitation, respectively. Thus, the post-incident review belongs to post-incident activity.

Answer

Preparation

Answer

Containment

Answer

Identification

Question 9

During the preparation phase, an organization is developing its incident response plan. Which TWO of the following are essential elements that should be included to ensure effective incident handling? (Choose two.)

Accepted Answer

Defined roles and responsibilities for the incident response team.. An effective incident response plan must define roles and responsibilities to ensure clear accountability and coordination. It also requires a robust communication plan to manage information flow to both internal and external stakeholders. These elements enable a swift and organized response. A full employee contact list, a complete software inventory, and a vulnerability scan schedule, while potentially useful, are not core components of the IR plan and do not directly facilitate incident handling.

Answer

A list of all software installed on every endpoint.

Answer

A detailed contact list of all employees in the organization.

Answer

A schedule for regular vulnerability scans.

Question 10

During a live intrusion, the incident commander must choose a containment strategy. Taking the affected system offline immediately would destroy volatile memory evidence and alert the attacker, while leaving it online risks further data exfiltration. Which approach best balances evidence preservation with damage limitation?

Accepted Answer

Capture volatile memory and network connection data first, then isolate the host while monitoring for attacker reaction.. The correct balance is to collect volatile data first, because RAM and active connections vanish the moment a system is isolated or powered down, and then contain the host while watching for attacker reaction. Immediate shutdown sacrifices irreplaceable evidence, pure monitoring without containment permits ongoing theft, and reformatting destroys everything before scope is known.

Answer

Reformat the system's storage immediately and rebuild it from the original installation media.

Answer

Leave the system fully online and untouched to maximize the intelligence gathered about the attacker's tools.

Answer

Immediately power off the affected system to guarantee the attacker cannot exfiltrate any more data.

Question 11

A healthcare provider's incident response team is notified that a clinical workstation is repeatedly re-infecting with ransomware 20 minutes after each cleanup. Volatile evidence has been preserved, and the business owner has authorized taking the endpoint offline. The team suspects a persistent mechanism that re-establishes the payload. Which action BEST aligns with the Containment phase of the incident handling process while preserving the ability to identify the persistence mechanism?

Accepted Answer

Isolate the workstation at the network level while keeping it powered on, then acquire a forensic image and examine startup and scheduled task locations for the persistence mechanism.. Containment should stop the spread and limit damage without destroying evidence required to determine root cause. Network isolation keeps the host running so memory and persistence artifacts can be collected, while disconnecting only the network path prevents re-infection and lateral movement. Reimaging or account-only actions skip the analysis needed to find how the ransomware persists, and deliberately leaving the host connected contradicts the containment objective.

Answer

Leave the workstation connected to allow the attacker to reveal additional command-and-control infrastructure, and monitor traffic passively for 24 hours.

Answer

Immediately reimage the workstation from the standard clinical image and return it to service to minimize patient-care downtime.

Answer

Disable the user's Active Directory account, reset the password, and require multi-factor authentication re-enrollment before restoring the workstation.

Question 12

A junior SOC analyst receives an alert at 03:00 showing a workstation contacting a known command-and-control (C2) IP address. The analyst is unsure whether this is a true incident or a false positive and wants guidance before waking the on-call incident handler. According to the incident handling process, what should the analyst do FIRST?

Accepted Answer

Perform triage by validating the alert against available telemetry to determine whether it is a true or false positive.. Triage is the validation step that separates genuine incidents from false positives before escalation. The analyst should correlate the C2 alert with other telemetry to confirm malicious activity, then classify and escalate if warranted. This preserves incident handler time and ensures real incidents are handled promptly.

Answer

Immediately isolate the workstation from the network to prevent potential lateral movement.

Answer

Escalate the alert to the on-call incident handler immediately without performing any validation.

Answer

Close the alert as a false positive because the IP address may be shared infrastructure.

Question 13

An incident handler is preparing to collect volatile evidence from a compromised Linux server that is still running. The handler must decide which data to capture first before memory-resident artifacts are lost. Which of the following should be collected FIRST?

Accepted Answer

Memory contents including running processes and active network connections.. The order of volatility requires the most perishable evidence to be collected first. Memory-resident artifacts such as running processes and active network connections disappear on shutdown or reboot, so they must be captured before persistent data like logs, configuration files, or disk images. This preserves the most time-sensitive evidence for later analysis.

Answer

The contents of /var/log directory including syslog and auth.log.

Answer

A full disk image of the server's primary storage volume.

Answer

The server's system configuration files from /etc.

Question 14

During an incident investigation, the handler discovers that an attacker used a compromised service account to move laterally across multiple servers. The handler needs to determine the full scope of affected systems. Which of the following is the MOST reliable method to identify all systems the attacker accessed using that account?

Accepted Answer

Review the service account's recent login events in the centralized SIEM and correlate them with authentication logs from all servers.. Determining the full scope of a compromised account requires correlating authentication events across all systems. Centralized SIEM data combined with server authentication logs reveals every logon, source IP, and timestamp associated with the account, providing an objective and comprehensive view of lateral movement. Other methods are narrow or subjective and can miss affected systems.

Answer

Interview the IT administrators who manage the affected servers about which systems the account typically accesses.

Answer

Check the service account's home directory for recently modified files on the domain controller.

Answer

Scan all servers for the presence of a specific malware hash associated with the attacker.

Question 15

An organization's incident response plan defines a communication protocol for notifying stakeholders during an incident. A major security breach has just been confirmed, and the incident handler must decide who to notify and how. Which of the following is the PRIMARY factor that should guide the notification process?

Accepted Answer

The predefined communication and escalation matrix in the incident response plan.. The incident response plan's communication and escalation matrix is the authoritative guide for notifications during a confirmed breach. It specifies stakeholders, order, timing, and channels, ensuring legal and regulatory requirements are met and the right people are informed. Personal preference, severity alone, or media coverage should not drive the notification process.

Answer

The severity rating assigned by the security operations center (SOC) analyst who detected the breach.

Answer

The personal preference of the incident handler regarding which stakeholders to inform.

Answer

The amount of media coverage the breach is likely to receive.