212-89 Malware Incidents Practice Test 3 — 15 Questions

Question 1

Which TWO of the following sources of information are most helpful for building an Indicators of Compromise (IoC) list during an investigation?

Accepted Answer

EDR security event logs. EDR security event logs (A) are a primary IoC source because endpoint detection and response tools record process executions, command lines, file hashes, registry modifications, network connections, and persistence mechanisms that directly yield host-based indicators such as malicious file names, hashes, and parent-child process relationships. Firewall logs (D) are equally valuable for network-based IoCs, capturing source/destination IP addresses, ports, protocols, and connection timestamps that reveal command-and-control traffic and lateral movement. Together, endpoint and network telemetry provide the host and network indicators needed to construct a usable IoC list. The HR handbook (B) and cafeteria menus (E) contain no security telemetry and are irrelevant to threat detection, while office printer logs (C) are too narrow and rarely expose adversary activity beyond isolated print jobs, making them far less helpful than EDR and firewall data.

Answer

HR handbook

Answer

Office printer logs

Answer

Cafeteria menus

Question 2

Which THREE of the following tools would be most effective for performing live memory forensics on a compromised Windows workstation?

Accepted Answer

WinPmem. WinPmem (B) is a purpose-built, open-source memory acquisition driver for Windows that captures physical RAM to a raw image while preserving volatile evidence such as running processes, network connections, and injected code. Magnet RAM Capture (C) is a free forensic acquisition tool from Magnet Forensics that dumps physical memory on Windows systems into a .raw/.mem image suitable for later analysis. Volatility 3 (E) is the leading memory forensics framework that parses those acquired images to extract processes, handles, DLLs, registry hives, and malware artifacts, making it essential for the analysis phase of live memory forensics. CCleaner (A) is a system-cleaning utility that deletes temporary files and traces, which would destroy volatile evidence rather than preserve it. Windows Update (D) is a patching service with no forensic acquisition or analysis capability and is irrelevant to memory forensics.

Answer

CCleaner

Answer

Windows Update

Question 3

When eradicating malware, which TWO of the following steps are essential to ensure the host is fully cleaned and the entry point is secured?

Accepted Answer

Identify and patch the vulnerability that allowed entry. Option B is correct because identifying and patching the vulnerability that allowed entry closes the initial access vector, preventing reinfection or re-exploitation by the same malware or attacker. Option D is correct because deleting all identified malicious artifacts—such as malicious executables, registry keys, scheduled tasks, and persistence mechanisms—ensures the host is actually cleaned and no residual malware remains. Option A is not relevant, as changing the wallpaper has no security impact on malware eradication. Option C is not relevant, since installing a new browser plugin does not address the infection or its entry point. Option E is insufficient on its own, as clearing the browser cache may remove some traces but does not eliminate malware or secure the vulnerability.

Answer

Change the background wallpaper to a default image

Answer

Install a new browser plugin

Answer

Clear the browser cache

Question 4

Which THREE of the following are effective methods for protecting backup systems from being encrypted by ransomware?

Accepted Answer

Restricting backup service account permissions. Option A (Restricting backup service account permissions) is correct because applying least-privilege to the backup service account prevents ransomware that has compromised a user or admin context from using those credentials to delete or overwrite backup repositories, since the backup process only needs write access to its target and not broad domain or filesystem rights. Option C (Using immutable storage solutions) is correct because immutability features such as S3 Object Lock in compliance mode, WORM storage, or immutable snapshots prevent any modification or deletion of backup data for a defined retention period, even if an attacker obtains administrative credentials. Option E (Implementing air-gapped backup storage) is correct because physically or logically isolating backups from the production network, such as offline tape, removable media, or a disconnected vault, means ransomware cannot reach the backup copies to encrypt them. Option B is incorrect because storing backups on the same server as the primary data exposes them to the same compromise and encryption event, defeating the purpose of a separate backup. Option D is incorrect because an easy-to-guess password weakens access control and makes it trivial for ransomware or an attacker to access and encrypt the backup drive.

Answer

Storing backups on the same server as the primary data

Answer

Using an easy-to-guess password for the backup drive

Question 5

When analyzing a potentially malicious script, which THREE of the following techniques help in deobfuscating the code?

Accepted Answer

Decrypting embedded strings. Option C (Decrypting embedded strings) is correct because obfuscated scripts frequently hide payloads, URLs, or commands inside encoded or encrypted string literals (e.g., Base64, XOR, ROT13), and extracting/decoding those strings reveals the script's true intent. Option D (Using an emulator for script execution) is correct because sandboxed emulators and instrumented interpreters let you execute the script in a controlled environment while logging API calls, string decryptions, and network activity, exposing behavior that static reading alone would miss. Option E (Manual code tracing in a debugger) is correct because stepping through the script line by line in a debugger lets you observe variable values, follow control flow through junk code and conditional obfuscation, and reconstruct the original logic. Option A (Renaming the file extension to .txt) is not a deobfuscation technique; changing the extension only affects how the OS associates the file and does not alter or reveal the code's obfuscation. Option B (Running the script as an administrator) is not a deobfuscation technique and is actually dangerous, since executing unknown malicious code with elevated privileges increases the risk of system compromise rather than helping to analyze the code.

Answer

Renaming the file extension to .txt

Answer

Running the script as an administrator

Question 6

Which TWO of the following activities are considered 'Eradication' steps in the incident response lifecycle?

Accepted Answer

Re-imaging infected workstations. In the incident response lifecycle, Eradication focuses on eliminating the threat from the environment, so option B (Re-imaging infected workstations) is correct because rebuilding a compromised host from a known-good image removes any residual malware, backdoors, or persistence mechanisms that cannot be reliably cleaned. Option C (Removing malicious files and registry keys) is also correct because deleting identified malware artifacts and associated persistence entries (e.g., Run keys, services, scheduled tasks) directly eliminates the adversary's foothold. Option A (Writing an incident report) belongs to the post-incident/lessons-learned phase, not eradication. Option D (Conducting a post-incident meeting) is part of the post-incident activity/lessons-learned stage. Option E (Notifying the news media) is a communications/PR action and is not an eradication step.

Answer

Writing an incident report

Answer

Conducting a post-incident meeting

Answer

Notifying the news media

Question 7

Which THREE of the following indicators are found in email-based malware delivery?

Accepted Answer

Hidden links pointing to malicious domains. Option A is correct because email-based malware delivery commonly relies on hidden or obfuscated hyperlinks (e.g., HTML anchor text or URL shorteners) that redirect victims to malicious domains hosting exploit kits or credential-phishing pages. Option B is correct because a sender address that does not match the organization's legitimate domain is a classic spoofing/impersonation indicator, often revealed by failed SPF, DKIM, or DMARC alignment checks. Option E is correct because suspicious attachments such as .zip archives or macro-enabled .docm files are frequent malware carriers used to deliver droppers, ransomware, or trojans when opened. Option C does not belong because a standard company footer is a normal, legitimate branding element and is not by itself an indicator of malicious delivery. Option D does not belong because the time of day an email is sent (business hours) is not a reliable technical indicator of malware delivery, since attackers can send messages at any time.

Answer

The email has a standard company footer

Answer

The email was sent during business hours

Question 8

When reviewing network traffic for C2 communication, which THREE of the following indicators are commonly observed?

Accepted Answer

Periodic connections (beaconing) to a specific IP. Option B is correct because beaconing — repeated, evenly spaced outbound connections to the same IP or host — is a hallmark of malware checking in with its command-and-control server, often using fixed sleep/jitter intervals. Option C is correct because C2 channels frequently abuse non-standard ports (for example, running HTTPS on 8080, 8443, or 443 on an unexpected host) to blend in or bypass egress filtering that only permits common ports. Option E is correct because threat actors often stand up C2 infrastructure on newly registered or short-lived domains, so connections to domains with very recent registration dates are a strong indicator of compromise. Option A does not belong because local users printing to a printer is normal internal business traffic with no C2 relevance. Option D does not belong because a high volume of legitimate DNS traffic is ordinary network activity; only anomalous DNS patterns such as long TXT queries, high-entropy subdomains, or excessive NXDOMAIN responses would suggest C2 tunneling.

Answer

Connections from local users to a printer

Answer

High volume of legitimate DNS traffic

Question 9

A user's Windows 10 workstation is suspected of being infected with fileless malware that resides only in memory and executes PowerShell commands. The incident handler needs to capture volatile evidence from the system before it is powered off. Which tool is specifically designed for acquiring a memory dump from a Windows system?

Accepted Answer

WinPmem. Fileless malware operates in memory, leaving little to no artifacts on disk. Capturing a memory dump is critical to preserve evidence such as injected code, running processes, and network connections. WinPmem is a dedicated memory acquisition tool for Windows, ensuring a forensically sound capture of volatile data before the system is powered off or rebooted.

Answer

Nmap

Answer

FTK Imager

Answer

Wireshark

Question 10

During a malware incident on a Windows 10 workstation, you observe that a scheduled task named "UpdaterSvc" executes a binary in C:\Users\Public\svchost.exe every 15 minutes and re-creates its own registry Run key if deleted. The user reports the malware reappears after each cleanup. Which containment action BEST addresses this persistence while preserving forensic evidence?

Accepted Answer

Disconnect the workstation from the network, capture a memory image, then delete the scheduled task and quarantine the binary.. Effective containment for self-healing malware requires isolating the host to stop external communication and preserving volatile evidence before making changes. Capturing memory first retains injected code and process artifacts, then removing the scheduled task and quarantining the binary eliminates the persistence that re-creates the Run key, preventing reinfection after cleanup.

Answer

Run a full antivirus scan on the workstation while it remains connected so the vendor cloud can identify the malware family.

Answer

Immediately reimage the workstation without collecting volatile data, because the malware will otherwise return.

Answer

Disable the user account, delete the C:\Users\Public\svchost.exe file, and reboot the workstation to clear the infection.

Question 11

During a malware incident, you observe that a compromised system is communicating with a known command-and-control (C2) server at 203.0.113.45 over TCP port 443. You need to block this communication at the network perimeter to prevent further data exfiltration. Which action should you take?

Accepted Answer

Create an outbound firewall rule to block traffic to 203.0.113.45 on port 443. The compromised system initiates outbound connections to the C2 server, so blocking outbound traffic to that specific IP and port is the most effective way to sever communication. This action prevents data exfiltration and further instructions from the attacker. It is targeted and minimizes disruption to legitimate traffic.

Answer

Add a static route to null0 for 203.0.113.45 on the internal router

Answer

Enable deep packet inspection (DPI) to block all HTTPS traffic

Answer

Create an inbound firewall rule to block traffic from 203.0.113.45

Question 12

A user reports their Windows 10 workstation is running very slowly and displaying unexpected pop-up ads in the browser. The incident handler suspects an adware infection. After isolating the machine, which Windows tool should the handler use to identify the malicious process consuming CPU and its associated network connections?

Accepted Answer

Resource Monitor. Resource Monitor offers a granular view of per-process resource utilization and network activity, enabling the handler to pinpoint the adware process causing high CPU usage and pop-ups. It shows which process is making network connections, which is critical for understanding the adware's behavior. Task Manager lacks network details, Event Viewer lacks real-time process data, and Performance Monitor is not designed for quick per-process network correlation.

Answer

Task Manager

Answer

Performance Monitor

Answer

Event Viewer

Question 13

You are investigating a suspected fileless malware incident on a Windows server. EDR telemetry shows that powershell.exe was spawned by winword.exe and executed an encoded command that downloaded a script from a remote host. The process has already exited. Which artifact is MOST likely to contain the decoded command and the URL contacted?

Accepted Answer

The PowerShell operational log, event ID 4104, which records script block content including the decoded command.. For fileless attacks using encoded PowerShell, the decoded script content is captured by PowerShell script block logging in event ID 4104 when that feature is enabled. Unlike process creation logs that preserve the obfuscated Base64 string, this event records the actual script text executed, exposing embedded URLs and commands even after the process has terminated.

Answer

The Sysmon event ID 1 log, which records process creation with hashes and parent process information.

Answer

The Windows Security event log, event ID 4688, which records process creation with full command lines.

Answer

The Windows Prefetch file for powershell.exe, which stores the last executed command line and remote URLs.

Question 14

A malware incident has been detected on a Windows server. The incident handler needs to identify the persistence mechanism used by the malware. The handler runs the 'Autoruns' tool and observes an entry in the 'Scheduled Tasks' tab that points to a suspicious executable in the user's AppData folder. Which Windows feature is being abused for persistence?

Accepted Answer

Task Scheduler. The Scheduled Tasks tab in Autoruns displays tasks that are configured to run automatically. Malware can create scheduled tasks to ensure it executes after reboots or at specific intervals. Identifying the task and its associated executable is crucial for eradication. The other options are different persistence mechanisms that would appear in other tabs of Autoruns.

Answer

Startup folder

Answer

Windows Management Instrumentation (WMI) event subscription

Answer

Registry Run keys

Question 15

An incident handler is analyzing a malware sample that appears to be a ransomware variant. The sample encrypts files with a specific extension and drops a ransom note. The handler wants to determine the encryption algorithm used to potentially find weaknesses. Which artifact from the malware analysis is most directly useful to identify the encryption algorithm?

Accepted Answer

Disassembly of the encryption routine. Disassembling the encryption routine provides the most definitive identification of the encryption algorithm by revealing the specific cryptographic functions and constants used. The ransom note, file extension, and strings may offer clues but lack the technical precision required. For ransomware analysis, understanding the algorithm is crucial for potential decryption or identifying implementation flaws.

Answer

The ransom note text file

Answer

The file extension appended to encrypted files

Answer

Strings extracted from the malware binary