212-89 Multiple Select — 10 Questions

Question 1

Which TWO of the following are safe practices when analyzing a suspicious email?

Accepted Answer

Ensuring the analysis environment is isolated from the network. Using virtual machines and disconnecting from the corporate network are safe practices.

Answer

Disabling all antivirus tools to observe behavior

Answer

Opening attachments in your primary email client

Answer

Clicking every link to check for live sites

Question 2

Which THREE of the following email security technologies should be configured to prevent domain spoofing?

Accepted Answer

DKIM. SPF, DKIM, and DMARC are the three pillars of email authentication to prevent spoofing.

Answer

SSL/TLS

Answer

HTTP/2

Question 3

Which THREE of the following are appropriate communication channels to keep users informed during an email phishing incident?

Accepted Answer

Corporate security intranet portal. Company-wide announcements, helpdesk tickets, and security awareness portals are appropriate channels.

Answer

Individual user personal phone numbers

Answer

Public social media accounts

Question 4

Which TWO of the following describe the role of an email gateway in incident response?

Accepted Answer

Filtering and blocking malicious content. Email gateways act as a filter for incoming threats and provide logs for post-incident investigation.

Answer

Replacing all passwords automatically

Answer

Manually deleting user account files

Answer

Encrypting all outgoing traffic

Question 5

Which TWO types of evidence are considered 'volatile'?

Accepted Answer

System memory (RAM).. RAM and network connections are lost when power is removed or the system is reset.

Answer

Optical disc contents.

Answer

Hard drive data.

Answer

Printed log files.

Question 6

Which TWO of the following are valid methods to identify a malicious attachment?

Accepted Answer

Performing behavioral analysis in a sandbox. Analyzing file hashes against threat intelligence and performing behavioral analysis in a sandbox are valid methods.

Answer

Forwarding the email to the entire company

Answer

Opening the attachment on a personal device

Answer

Deleting the attachment based on its size

Question 7

Which THREE of the following items should be included in an email incident report?

Accepted Answer

Chronological timeline of the incident. A description of the incident, the impact, and the remediation steps are required for a report.

Answer

Personal contact information of the attacker

Answer

Full history of every email ever sent to the user

Question 8

Which THREE categories of stakeholders should be considered for notification in a major data breach?

Accepted Answer

Legal and Compliance departments.. Legal, IT Management, and the Privacy Officer are critical stakeholders during a breach.

Answer

The local coffee shop staff.

Answer

The company's external social media followers.

Question 9

Which TWO criteria must a first responder satisfy when choosing a tool for a toolkit?

Accepted Answer

The tool must be known to have minimal impact on the target system.. Tools must be trusted and cause minimal impact on the subject system.

Answer

The tool must run on a cloud-based server.

Answer

The tool must be proprietary and expensive.

Answer

The tool must be able to delete the malware.

Question 10

Which TWO actions are recommended for evidence preservation in a digital incident?

Accepted Answer

Calculate cryptographic hashes for all collected files.. Hashing ensures integrity, and chain of custody ensures legal admissibility.

Answer

Reboot the system to clear temporary files.

Answer

Modify file permissions to prevent further access.

Answer

Delete all temporary logs to save space.