212-89 Malware Incidents Practice Test 2 — 15 Questions

Question 1

A user reports their system is running slowly, and you observe a suspicious file in 'C:\Users\[User]\AppData\Local\Temp'. What is the most appropriate first step in your investigation?

Accepted Answer

Calculate the file hash. Calculating the file hash is the correct first step because it preserves the integrity of the evidence and allows the file to be identified against known malware databases (e.g., VirusTotal, NIST NSRL) without altering or executing it. Hashing is non-destructive, produces a unique fingerprint (MD5/SHA-256), and maintains chain-of-custody for any subsequent forensic or legal action. This aligns with the order of volatility and standard incident response handling procedures.

Answer

Re-image the computer

Answer

Delete the file immediately

Answer

Execute the file in a debugger

Question 2

After eradicating a malware infection, you need to ensure the system is hardened against future occurrences. Which action is most effective against fileless malware?

Accepted Answer

Implement PowerShell Constrained Language Mode. Disabling PowerShell for non-administrative users or implementing Constrained Language Mode is a key defense against fileless script-based attacks.

Answer

Enable auto-updates for all applications

Answer

Install an extra antivirus

Answer

Enable full disk encryption

Question 3

An incident handler is analyzing a malware incident that used a phishing email. What is the most important field to check in the email header to determine the true origin of the email?

Accepted Answer

Received header. The Received header is the most important field because each mail server that handles a message prepends its own Received header, creating a chronological chain that traces the message's path from origin to destination. By reading the headers bottom-up (oldest first), an investigator can identify the originating IP address and mail server, which is essential for determining the true source of a phishing email. Subject, Message-ID, and Content-Type can all be trivially spoofed or fabricated by the sender and carry no routing information.

Answer

Subject line

Answer

Message-ID

Answer

Content-Type

Question 4

You are analyzing a malware sample that uses Domain Generation Algorithms (DGA). What is the primary purpose of DGA in malware?

Accepted Answer

Evading static C2 blocklists. DGA is used to generate a large number of domain names daily, making it difficult for defenders to block the command-and-control server effectively.

Answer

Spreading via local network shares

Answer

Encrypting the malware payload

Answer

Hiding processes from Task Manager

Question 5

A malware sample was found to use a 'Mutex' to ensure only one instance of the malware runs at a time. What tool would you use to find the Mutex name on an infected host?

Accepted Answer

Handle. Handle (Sysinternals Handle) is the correct tool because it enumerates open handles — including named mutexes — held by processes on a Windows system. Running 'handle.exe -a' lists all handle types, and you can search for the mutex name associated with the malware, confirming infection and enabling detection signatures. Mutexes are kernel objects, and Handle is purpose-built to display them per process.

Answer

TCPView

Answer

Procmon

Answer

Autoruns

Question 6

Which document is essential to maintain during a malware incident to ensure accountability and track the actions taken by the incident response team?

Accepted Answer

Incident Log. An Incident Log (or Chain of Custody record) is critical for documenting every step, tool, and decision made during the response process.

Answer

User Manual

Answer

System Backup

Answer

Vulnerability Assessment Report

Question 7

You are performing forensic analysis on a suspicious file. You need to determine if it is a packed executable. Which tool is most effective for viewing the file's section headers to identify anomalies?

Accepted Answer

PEview. PEview is a Windows tool that parses the Portable Executable (PE) format and displays section headers, the import table, export table, and other structural metadata. Packed executables typically show anomalies such as section names like UPX0/UPX1, unusually high entropy, a tiny import table, or a section with raw size much larger than virtual size — all visible in PEview's section header view.

Answer

Wireshark

Answer

Process Explorer

Answer

Regedit

Question 8

You suspect a malware incident caused unauthorized data exfiltration. Which log source is most useful to identify the destination IP of the exfiltrated data?

Accepted Answer

Firewall logs. Firewall logs provide a record of all outbound connections and are the most reliable source for identifying destination IP addresses in an exfiltration event.

Answer

Application logs

Answer

Local security policy settings

Answer

System event logs

Question 9

A system has been infected by a worm that is spreading across the network. What is the most immediate action to stop the spread?

Accepted Answer

Block propagation ports at the network level. Isolating the affected segments or blocking the ports used for the worm's propagation (e.g., SMB/445) is essential to stop lateral movement.

Answer

Update the BIOS on all machines

Answer

Disable the internet gateway

Answer

Email all users to reboot

Question 10

You are analyzing a malware sample that uses 'API Hooking'. What is the goal of this technique?

Accepted Answer

Interception and manipulation of system calls. API hooking is a technique where malware intercepts calls to system or library functions (APIs) by redirecting execution to attacker-controlled code, allowing it to monitor, modify, or block the original function's behavior. The goal is interception and manipulation of system calls — for example, hiding files, suppressing AV alerts, or stealing credentials passed to APIs. This is a core evasion and data-theft mechanism.

Answer

Increasing CPU priority

Answer

Bypassing network authentication

Answer

Preventing the system from hibernating

Question 11

You have identified a malicious DLL that is being loaded by a legitimate process. Which tool allows you to view which DLLs are loaded by a specific process?

Accepted Answer

Process Explorer. Process Explorer's lower pane (when configured for DLLs) provides a clear list of all loaded modules/DLLs for any selected process.

Answer

Task Scheduler

Answer

Disk Cleanup

Answer

Device Manager

Question 12

During the 'Recovery' phase of the malware incident, what must be done to ensure the environment is safe before reconnecting the restored systems?

Accepted Answer

Perform a vulnerability scan. Vulnerability scanning confirms that the original entry points or vulnerabilities used by the malware have been patched or mitigated.

Answer

Delete all user profiles

Answer

Upgrade the OS to the latest version

Answer

Reformat all external hard drives

Question 13

You suspect a file on a Linux server is malicious. What command can you use to obtain the MD5 hash of the file?

Accepted Answer

md5sum [filename]. The md5sum utility is the standard Linux command-line tool for computing and verifying MD5 message digests. Running 'md5sum [filename]' outputs the 128-bit MD5 hash followed by the filename, which is exactly what an incident responder needs to fingerprint a suspected malicious file. It is part of GNU coreutils and is present on virtually every Linux distribution by default.

Answer

checkhash [filename]

Answer

hash -md5 [filename]

Answer

echo md5 [filename]

Question 14

During a malware analysis, which TWO of the following indicators are typically used to identify persistence mechanisms in the Windows registry?

Accepted Answer

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services. Option C is correct because the HKLM\System\CurrentControlSet\Services key stores configuration for Windows services, including the ImagePath and Start values that malware commonly abuses to register a malicious service (for example, a kernel driver or auto-start service) so it launches at boot. Option E is correct because the HKLM\Software\Microsoft\Windows\CurrentVersion\Run key is a classic autostart location where entries execute programs at user logon, making it a primary persistence mechanism for malware. Option A is not a persistence indicator per se; HKCR\CLSID holds COM class registration data, which can be abused for hijacking but is not a standard auto-start persistence key. Option B is not a persistence mechanism; the Control Panel\Desktop key stores user interface settings such as wallpaper and screen saver configuration. Option D is not a persistence mechanism; MountPoints2 records per-user mounted volume information and is more relevant to forensic artifact tracking than to autostart persistence.

Answer

HKEY_CLASSES_ROOT\CLSID

Answer

HKEY_CURRENT_USER\Control Panel\Desktop

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Question 15

Which THREE of the following are considered 'behavioral' indicators of a malware infection?

Accepted Answer

Unexplained outbound network connections to unknown IP addresses. Option A is correct because unexplained outbound network connections to unknown IP addresses are a behavioral indicator—they reflect the malware's runtime activity, such as command-and-control (C2) beaconing or data exfiltration, rather than a static artifact. Option C is correct because high CPU utilization by an unknown background process is behavioral: sustained resource consumption by an unrecognized process often signals cryptomining, worm propagation, or other malicious execution. Option D is correct because frequent modifications to system-protected files are behavioral, indicating ongoing tampering such as persistence mechanisms, rootkit installation, or system file replacement. Option B does not belong because a valid digital signature on a system file is a static integrity attribute, not an observed behavior, and it actually suggests the file is legitimate. Option E does not belong because the mere presence of a .txt file is a static file attribute with no behavioral context and is not indicative of malware.

Answer

A valid digital signature on a system file

Answer

Presence of a file with a .txt extension