212-89 Malware Incidents Practice Test 4 — 15 Questions

Question 1

A finance workstation running Windows 10 begins displaying a full-screen message demanding Bitcoin payment and encrypts files with the .locky extension. The user reports the machine is still powered on and connected to the corporate network. As the incident handler, which action should you take FIRST to preserve volatile evidence?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Acquire a live memory dump using a tool such as Magnet RAM Capture or WinPmem.. Because the workstation is still powered on, volatile data in RAM, including process lists, network connections, and potential encryption keys, remains available. The order of volatility dictates that this evidence be captured before any shutdown, disconnection, or remediation action. Acquiring a live memory dump first preserves the most perishable evidence and supports subsequent malware analysis and containment decisions.

Answer

Run a full antivirus scan and quarantine all detected files.

Answer

Capture a forensic image of the physical hard drive using a write blocker.

Answer

Immediately disconnect the workstation from the network and power it off.

Question 2

A helpdesk technician reports that multiple users received an email with an attached PDF that, when opened, prompted them to enable macros. One user enabled macros and their workstation is now showing unusual outbound connections. As the incident handler, which action should you take FIRST according to the incident response lifecycle?

Accepted Answer

Contain the incident by isolating the affected workstation from the network and preserving its current state.. The incident response lifecycle places containment immediately after detection to limit damage and preserve evidence. Isolating the affected workstation stops outbound malicious traffic and prevents lateral spread, while preserving the system state allows investigators to determine scope and root cause before moving to eradication and recovery.

Answer

Eradicate the malware by running a full antivirus scan and removing the PDF from the email server.

Answer

Recover operations by restoring the user's files from the most recent backup and reconnecting the workstation.

Answer

Identify the malware family by submitting the PDF to a public sandbox and wait for the report.

Question 3

A company's security team detects that a server is communicating with a known malicious IP address every hour. The traffic is encrypted and small in size. The incident handler suspects a malware infection with a beaconing mechanism. Which type of malware is most likely responsible for this behavior?

Accepted Answer

Remote Access Trojan (RAT). A Remote Access Trojan (RAT) is designed for stealthy, persistent access, often using regular beaconing to a command-and-control server. The small, encrypted, hourly traffic matches this pattern, allowing the attacker to maintain control without attracting attention. Ransomware, worms, and adware have different primary behaviors that do not align with the described stealthy beaconing.

Answer

Ransomware

Answer

Worm

Answer

Adware

Question 4

A malware incident has been identified on a corporate workstation. The incident response team is following the containment, eradication, and recovery phases. Which TWO of the following actions are considered part of the eradication phase? (Choose two.)

Accepted Answer

Applying security patches to the operating system. Eradication involves removing the malware and its components from the infected system. Deleting malicious files and registry keys eliminates the malware's presence and persistence. Applying security patches addresses the vulnerability that allowed the infection, preventing future occurrences. Containment (disconnecting from network) and recovery (restoring from backup, monitoring) are separate phases.

Answer

Monitoring network traffic for signs of re-infection

Answer

Restoring the system from a known good backup

Answer

Disconnecting the infected workstation from the network

Question 5

During a malware incident investigation, you observe a Windows host establishing periodic outbound HTTPS connections to an unknown IP address every 60 seconds, with small, uniform packet sizes. Which two characteristics most strongly indicate this is command-and-control (C2) beaconing rather than legitimate traffic? (Choose two.)

Accepted Answer

The connections occur at regular, fixed intervals with consistent timing.. C2 beaconing is characterized by automated, periodic check-ins with consistent timing and small, uniform payloads. These behavioral patterns reflect the malware's sleep-and-callback logic rather than user-driven traffic. Neither the use of HTTPS, the cloud hosting provider, nor the presence of a valid certificate distinguishes malicious beaconing from legitimate encrypted web traffic, so those characteristics must not be treated as indicators on their own.

Answer

The host has a valid digital certificate for the destination domain.

Answer

The traffic uses HTTPS on port 443 to blend with normal web traffic.

Answer

The destination IP address belongs to a cloud hosting provider.

Question 6

An incident handler is reviewing a suspicious executable found on a compromised Windows system. The file has a double extension, such as 'invoice.pdf.exe'. Which type of malware delivery technique is this most likely an example of?

Accepted Answer

Masquerading. Masquerading is the technique of making a malicious file appear benign, such as using a double extension to disguise an executable as a PDF. This exploits hidden file extensions in Windows to trick users. Phishing is a delivery vector, social engineering is a broader category, and rootkits are a different type of malware. The double extension is a direct example of masquerading.

Answer

Social engineering

Answer

Rootkit

Answer

Phishing

Question 7

You are triaging a Windows workstation suspected of a malware infection. Several indicators suggest the malware is using the Windows Registry for persistence. Which TWO registry locations should you examine first to identify autostart entries created by the malware? (Choose two.)

Accepted Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. Malware commonly establishes persistence on Windows through autostart registry locations. The Run key under CurrentVersion launches programs at user logon, while the Services key under CurrentControlSet configures services that start at boot, often with high privileges. Both are high-priority locations to inspect when hunting for registry-based persistence during malware triage.

Answer

HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Word\Recent

Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers

Answer

HKEY_CLASSES_ROOT\Installer\Products

Question 8

An employee's Windows workstation is suspected of being infected with malware after clicking a link in a spam email. You need to identify which process is making outbound network connections to an external IP address. Which built-in Windows tool should you use to correlate active network connections with their owning processes?

Accepted Answer

netstat -ano. Correlating active network connections to the responsible processes requires a tool that exposes both the connection details and the owning process ID. The netstat -ano command provides numeric addresses, ports, and PIDs, which can then be matched to process names. This built-in utility is a standard first step in live malware investigations on Windows for identifying suspicious outbound communication.

Answer

Performance Monitor

Answer

Task Manager

Answer

Event Viewer

Question 9

During a malware incident investigation on a Windows 10 workstation, you discover a scheduled task named 'MicrosoftEdgeUpdateTaskMachineCore' that launches 'C:\Users\Public\updater.exe' every 15 minutes. Legitimate Edge update tasks do not execute binaries from the Public profile. Which containment action best preserves volatile evidence while stopping the recurring malicious execution?

Accepted Answer

Disable the scheduled task with 'schtasks /Change /TN "MicrosoftEdgeUpdateTaskMachineCore" /DISABLE', then capture a memory image of the running process. Disabling the malicious scheduled task halts reinfection while leaving the running process and its volatile state intact for memory acquisition, which is the priority during containment of a recurring execution mechanism. Deleting the task, rebooting, or removing the binary destroys evidence and prevents proper root-cause analysis and scoping.

Answer

Delete 'C:\Users\Public\updater.exe' and remove the scheduled task definition from the registry hive offline

Answer

Run 'schtasks /Delete /TN "MicrosoftEdgeUpdateTaskMachineCore" /F' and reboot the workstation to clear the infection

Answer

Quarantine the workstation from the network and leave the scheduled task running so the attacker's behavior can be observed

Question 10

You are analyzing a Windows malware sample and observe that it creates a new service with an ImagePath pointing to a file in the user's AppData folder. The service is configured with a generic display name resembling a legitimate Windows component. What is the primary purpose of this behavior?

Accepted Answer

To establish persistence so the malware executes automatically at system startup.. Registering a Windows service whose binary resides in a user-writable path such as AppData is a classic persistence technique. Services start automatically at boot and often run under SYSTEM, so the malware survives reboots and gains elevated execution. The use of a legitimate-looking display name is a defense evasion tactic to avoid notice by casual administrators. Recognizing this helps handlers remove the service during eradication.

Answer

To escalate privileges by exploiting a vulnerable driver.

Answer

To encrypt files on the local system for ransomware impact.

Answer

To exfiltrate data to an external command-and-control server.

Question 11

A user reports that Microsoft Word documents on a shared drive are suddenly opening with a prompt to enable macros, and a new file named '~$invoice.docx' appears in the same directory. Analysis shows the macro contains the string 'AutoOpen' and references a remote template URL. Which malware category and delivery technique best describe this incident?

Accepted Answer

Macro-based malware using remote template injection. An AutoOpen macro that references a remote template URL is the hallmark of remote template injection, a document-based malware delivery technique. The macro executes when the document is opened, and the remote template pulls the malicious payload from an external server, evading static detection that only inspects the original file.

Answer

Fileless malware delivered via PowerShell stager

Answer

Ransomware delivered through a malicious PDF reader exploit

Answer

Worm spreading via SMB by copying itself to shared directories

Question 12

A malware incident has been contained and eradicated on an infected Windows server. Before returning the server to production, you need to verify that no malicious processes or unauthorized autostart entries remain. Which action best supports this validation?

Accepted Answer

Compare current autoruns, services, scheduled tasks, and running processes against a known-good baseline.. Validation after eradication requires confirming that no malicious persistence or processes remain. Comparing autoruns, services, scheduled tasks, and running processes against a known-good baseline exposes unauthorized changes that signature-based scans might overlook. This approach directly verifies the eradication was complete and supports a defensible decision to return the server to production.

Answer

Restore the server from a backup taken before the incident.

Answer

Reboot the server and confirm it boots successfully.

Answer

Run a full antivirus scan and review the scan report.

Question 13

You are handling a malware incident on a Windows server and need to determine whether the malware has established persistence. Which two registry locations should you inspect first because they are the most common autostart points used by malware? (Choose two.)

Accepted Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. The HKLM and HKCU Run keys are the most commonly abused registry autostart locations because they execute code at logon for all users or the current user respectively, require minimal effort to modify, and are widely used by commodity and targeted malware alike. Inspecting both ensures coverage of system-wide and per-user persistence.

Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

Answer

HKEY_CLASSES_ROOT\Installer\Products

Question 14

A helpdesk technician reports that a user's browser is redirecting searches to an unfamiliar site and displaying pop-up advertisements even when no browser is open. You suspect a potentially unwanted program or adware infection. Which initial step is most appropriate for an incident handler?

Accepted Answer

Capture volatile data such as running processes, network connections, and browser extensions before making changes. Capturing volatile data before any remediation preserves running processes, network connections, and browser extension details that would otherwise be lost. This evidence is essential for identifying the adware family, its persistence, and any broader compromise, enabling accurate scoping and complete eradication rather than a superficial cleanup.

Answer

Ask the user to clear browser cache and reset browser settings to default

Answer

Immediately reimage the workstation to guarantee complete removal

Answer

Run a full antivirus scan and delete everything it flags as malicious

Question 15

During a malware incident on a Windows Server 2019 host, an incident handler discovers that a scheduled task named 'MicrosoftEdgeUpdateTaskMachineUA' has been modified to run a binary from C:\Users\Public\svchost.exe every 15 minutes. The handler needs to preserve volatile evidence of this persistence mechanism before remediation. Which action should the handler take first?

Accepted Answer

Export the task definition using schtasks /query /tn "MicrosoftEdgeUpdateTaskMachineUA" /xml > task.xml. The scheduled task's XML definition is volatile because it can be changed or removed during remediation, so the handler must export it before taking any disruptive action. Capturing the exact trigger, action, and run-as account documents the attacker's persistence mechanism and supports scope analysis and legal evidence handling.

Answer

Restart the Windows Task Scheduler service to clear any injected code and reset the task to its default state.

Answer

Run the binary C:\Users\Public\svchost.exe in a sandbox to observe its behavior before deleting the task.

Answer

Delete the scheduled task immediately using schtasks /delete to stop the persistence.