212-89 Multiple Select — 40 Questions

Question 1

You are handling a malware incident on a Windows server and need to determine whether the malware has established persistence. Which two registry locations should you inspect first because they are the most common autostart points used by malware? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. The HKLM and HKCU Run keys are the most commonly abused registry autostart locations because they execute code at logon for all users or the current user respectively, require minimal effort to modify, and are widely used by commodity and targeted malware alike. Inspecting both ensures coverage of system-wide and per-user persistence.

Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

Answer

HKEY_CLASSES_ROOT\Installer\Products

Question 2

Which THREE components are typically involved in a web application's logging infrastructure that an incident responder should audit?

Accepted Answer

Web server access and error logs. Option A (Web server access and error logs) is correct because these logs record every HTTP request, response code, source IP, and server-side errors, which are essential for reconstructing how an attacker interacted with the web application. Option B (WAF audit logs) is correct because a Web Application Firewall logs blocked, allowed, and flagged requests, revealing attempted exploits such as SQL injection or XSS that may not appear in normal server logs. Option D (Application-level audit logs) is correct because they capture business-logic events like authentication, authorization changes, and user actions, providing the internal context that infrastructure logs lack. Option C (Printer spooler logs) is not relevant since print services are unrelated to web application request handling or attack surfaces. Option E (Hardware router logs) is not part of the web application's logging infrastructure, as routers operate at the network layer and do not record application-level activity.

Answer

Printer spooler logs

Answer

Hardware router logs

Question 3

A malware incident has been identified on a corporate workstation. The incident response team is following the containment, eradication, and recovery phases. Which TWO of the following actions are considered part of the eradication phase? (Choose two.)

Accepted Answer

Applying security patches to the operating system. Eradication involves removing the malware and its components from the infected system. Deleting malicious files and registry keys eliminates the malware's presence and persistence. Applying security patches addresses the vulnerability that allowed the infection, preventing future occurrences. Containment (disconnecting from network) and recovery (restoring from backup, monitoring) are separate phases.

Answer

Monitoring network traffic for signs of re-infection

Answer

Restoring the system from a known good backup

Answer

Disconnecting the infected workstation from the network

Question 4

Which THREE of the following characterize potential lateral movement using RDP in a domain environment?

Accepted Answer

Unusual use of NTLM for RDP authentication. Option A is correct because in a domain environment RDP authentication normally uses Kerberos, so a shift to NTLM for RDP (e.g., via Restricted Admin mode or credential-based attacks) is a strong indicator of lateral movement attempts. Option D is correct because mstsc.exe is the native RDP client, and its use with unusual flags (such as /admin, /restrictedAdmin, or /v to non-standard hosts) can signal an attacker pivoting between systems. Option E is correct because RDP logins originating from workstations to servers are atypical in most domain environments, where administrative RDP typically flows from jump hosts or management stations, making such connections a hallmark of lateral movement. Option B is incorrect because SNMP is a network management protocol unrelated to RDP session behavior. Option C is incorrect because HTTPS traffic is encrypted web traffic and does not characterize RDP-based lateral movement.

Answer

Increased usage of SNMP

Answer

High volume of HTTPS traffic

Question 5

Which TWO actions are recommended for evidence preservation in a digital incident?

Accepted Answer

Calculate cryptographic hashes for all collected files.. Hashing ensures integrity, and chain of custody ensures legal admissibility.

Answer

Reboot the system to clear temporary files.

Answer

Modify file permissions to prevent further access.

Answer

Delete all temporary logs to save space.

Question 6

Which THREE of the following are common indicators of a phishing email?

Accepted Answer

Urgent or threatening language requiring immediate action. Option A is correct because phishing emails frequently use urgent or threatening language, such as warnings of account suspension or legal action, to pressure recipients into acting quickly without verifying the message. Option B is correct because a mismatch between the display name and the actual sender address is a classic spoofing indicator, since attackers often set a trusted-looking display name while the underlying SMTP From or Return-Path domain is different. Option D is correct because when the visible URL text differs from the actual hyperlink target (for example, displayed as https://bank.example.com but linking to http://malicious.example.net), it indicates an attempt to deceive the recipient about the destination. Option C is not a reliable indicator, because legitimate emails commonly use standard corporate branding and attackers can easily replicate logos and templates. Option E is not a reliable indicator, since phishing messages can be sent at any time, including during business hours, and timing alone does not indicate malicious intent.

Answer

The email uses standard corporate branding

Answer

The email is sent during business hours

Question 7

Which THREE of the following are key components of a network-based containment strategy?

Accepted Answer

Isolation of the compromised segment from the rest of the network. Option A is correct because isolating the compromised network segment (for example, by moving it to a quarantine VLAN or applying ACLs on the switch/router) prevents lateral movement of the attacker to other hosts while containment is underway. Option B is correct because forcibly terminating active sessions (resetting TCP connections, killing authenticated sessions, or invalidating tokens) cuts off the attacker's existing foothold and command-and-control channels. Option C is correct because egress filtering at the perimeter blocks outbound traffic to known malicious IPs/domains, stopping data exfiltration and C2 callbacks, which is a core part of containing a network-based incident. Option D is not a containment measure; extending DHCP lease times only affects address assignment duration and does nothing to stop an active intrusion. Option E is not a containment action either, since wholesale hardware replacement is a costly remediation/recovery step, not a strategy for limiting the spread of an ongoing network-based attack.

Answer

Increasing the DHCP lease time

Answer

Installing new hardware across the network

Question 8

Which THREE of the following tools would be most effective for performing live memory forensics on a compromised Windows workstation?

Accepted Answer

WinPmem. WinPmem (B) is a purpose-built, open-source memory acquisition driver for Windows that captures physical RAM to a raw image while preserving volatile evidence such as running processes, network connections, and injected code. Magnet RAM Capture (C) is a free forensic acquisition tool from Magnet Forensics that dumps physical memory on Windows systems into a .raw/.mem image suitable for later analysis. Volatility 3 (E) is the leading memory forensics framework that parses those acquired images to extract processes, handles, DLLs, registry hives, and malware artifacts, making it essential for the analysis phase of live memory forensics. CCleaner (A) is a system-cleaning utility that deletes temporary files and traces, which would destroy volatile evidence rather than preserve it. Windows Update (D) is a patching service with no forensic acquisition or analysis capability and is irrelevant to memory forensics.

Answer

CCleaner

Answer

Windows Update

Question 9

Which THREE pieces of information should be included in an incident triage report?

Accepted Answer

The date and time of the incident discovery.. Option A is correct because recording the date and time of incident discovery establishes the timeline anchor needed for triage prioritization, SLA tracking, and later forensic reconstruction of the event sequence. Option C is correct because identifying the systems and services impacted scopes the incident, enabling responders to determine business impact, prioritize containment, and decide whether escalation or isolation is required. Option D is correct because initial findings or indicators of compromise (IOCs) such as suspicious IP addresses, file hashes, or anomalous log entries give the triage team the technical evidence needed to classify the incident and guide the immediate response. Option B is not appropriate because private health records are sensitive PII/PHI that are irrelevant to triage and would introduce unnecessary privacy and compliance risk. Option E is not appropriate because a list of employees with building access is unrelated to the technical and operational facts needed to triage a security incident.

Answer

The private health records of the affected users.

Answer

The names of all employees who have access to the building.

Question 10

During a malware analysis, which TWO of the following indicators are typically used to identify persistence mechanisms in the Windows registry?

Accepted Answer

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services. Option C is correct because the HKLM\System\CurrentControlSet\Services key stores configuration for Windows services, including the ImagePath and Start values that malware commonly abuses to register a malicious service (for example, a kernel driver or auto-start service) so it launches at boot. Option E is correct because the HKLM\Software\Microsoft\Windows\CurrentVersion\Run key is a classic autostart location where entries execute programs at user logon, making it a primary persistence mechanism for malware. Option A is not a persistence indicator per se; HKCR\CLSID holds COM class registration data, which can be abused for hijacking but is not a standard auto-start persistence key. Option B is not a persistence mechanism; the Control Panel\Desktop key stores user interface settings such as wallpaper and screen saver configuration. Option D is not a persistence mechanism; MountPoints2 records per-user mounted volume information and is more relevant to forensic artifact tracking than to autostart persistence.

Answer

HKEY_CLASSES_ROOT\CLSID

Answer

HKEY_CURRENT_USER\Control Panel\Desktop

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Question 11

Which TWO of the following are common signs of a compromised switch in a local area network?

Accepted Answer

Unrecognized trunk ports enabled. Option A is correct because an unrecognized or unauthorized trunk port enabled on a switch is a classic indicator of compromise—attackers configure trunk links (e.g., 802.1Q) to carry traffic for multiple VLANs and perform VLAN hopping or intercept traffic that should remain segmented. Option D is correct because unexpected MAC address table growth indicates MAC flooding, where an attacker overwhelms the switch's CAM table with spoofed source MACs, forcing it into fail-open hub behavior so traffic is flooded to all ports for sniffing. The unmarked options do not belong: normal spanning-tree convergence (B) is expected healthy behavior, decreased CPU usage (C) is not a compromise sign (attacks typically raise CPU load), and a stable port security status (E) reflects normal, secure operation rather than an indicator of compromise.

Answer

Normal spanning-tree convergence

Answer

Decreased CPU usage on the switch

Answer

Stable port security status

Question 12

A security team is reviewing their incident handling process after a recent data breach. They want to ensure that their eradication phase is effective. Which TWO activities are essential during the eradication phase? (Choose two.)

Accepted Answer

Applying security patches to vulnerable systems. Eradication involves removing the threat and its root cause. Deleting malicious files eliminates the immediate malware, while applying patches closes the vulnerability that was exploited. These actions ensure the threat is fully removed and cannot easily recur. Other options are containment or recovery activities.

Answer

Blocking the attacker's IP address at the firewall

Answer

Restoring data from backups

Answer

Conducting a lessons learned meeting

Question 13

Which TWO criteria must a first responder satisfy when choosing a tool for a toolkit?

Accepted Answer

The tool must be known to have minimal impact on the target system.. Tools must be trusted and cause minimal impact on the subject system.

Answer

The tool must run on a cloud-based server.

Answer

The tool must be proprietary and expensive.

Answer

The tool must be able to delete the malware.

Question 14

During a malware incident investigation, you observe a Windows host establishing periodic outbound HTTPS connections to an unknown IP address every 60 seconds, with small, uniform packet sizes. Which two characteristics most strongly indicate this is command-and-control (C2) beaconing rather than legitimate traffic? (Choose two.)

Accepted Answer

The connections occur at regular, fixed intervals with consistent timing.. C2 beaconing is characterized by automated, periodic check-ins with consistent timing and small, uniform payloads. These behavioral patterns reflect the malware's sleep-and-callback logic rather than user-driven traffic. Neither the use of HTTPS, the cloud hosting provider, nor the presence of a valid certificate distinguishes malicious beaconing from legitimate encrypted web traffic, so those characteristics must not be treated as indicators on their own.

Answer

The host has a valid digital certificate for the destination domain.

Answer

The traffic uses HTTPS on port 443 to blend with normal web traffic.

Answer

The destination IP address belongs to a cloud hosting provider.

Question 15

A financial services firm has activated its incident response plan after detecting unauthorized access to an internal file server. The incident commander must decide which activities belong to the containment phase rather than recovery. (Choose two.)

Accepted Answer

Isolating the affected server from the production network by disabling its switch port.. Containment focuses on stopping the spread and limiting damage while preserving evidence, which isolation of the compromised host and blocking the attacker's command-and-control channels both accomplish. Restoring from backup, patching the exploited vulnerability, and re-enabling user access are recovery or eradication activities that occur only after the threat has been contained and removed from the environment.

Answer

Re-enabling user access to shared drives after verifying file integrity checksums.

Answer

Restoring the file server from the most recent clean backup and returning it to service.

Answer

Applying the vendor security patch that fixes the vulnerability used to gain initial access.

Question 16

A web application is under a distributed denial-of-service (DDoS) attack that is overwhelming the server with HTTP requests. As an incident handler, you need to identify the source of the attack and mitigate it. Which TWO log sources are most critical to analyze first to understand the attack pattern and its origin? (Choose two.)

Accepted Answer

Web server access logs. Web server access logs and firewall logs are the most critical for analyzing a DDoS attack. Access logs provide detailed HTTP request data, including source IPs and request patterns, while firewall logs show network-level connection attempts and blocked traffic. Together, they help identify the attack's source and characteristics. Other logs, such as database or OS logs, may show symptoms but not the direct attack traffic.

Answer

Application server error logs

Answer

Operating system event logs

Answer

Database server logs

Question 17

You are investigating a cross-site scripting incident on a customer-facing web application. The attacker injected a persistent payload that executes in the browsers of users viewing a product review page. Which TWO actions should you take to contain the incident and protect users while preserving evidence? (Choose two.)

Accepted Answer

Capture the malicious review content and associated database records before removing or sanitizing them.. Containment of a stored XSS incident requires preserving the malicious content as evidence while preventing it from executing in users' browsers. Capturing the database records and applying output encoding on the affected page achieves both goals and allows the team to check other user-generated content fields for similar flaws. Deleting the content, shutting down the application, or applying crude perimeter filters either destroys evidence or provides ineffective protection.

Answer

Immediately delete the malicious review from the database to stop the payload from executing.

Answer

Block all inbound HTTP requests containing angle brackets at the perimeter firewall.

Answer

Disable the entire web application until the development team rewrites the review module.

Question 18

A financial institution's incident response team is investigating a suspected network intrusion. They observe anomalous traffic from an internal database server to an unknown external IP address. Which TWO of the following actions are appropriate for network-based containment in this scenario? (Choose two.)

Accepted Answer

Block the external IP address at the perimeter firewall.. Blocking the external IP at the firewall and applying an ACL on the internal router are both network-based containment actions that disrupt the malicious traffic while preserving the server's functionality and evidence. They are targeted and reversible, unlike disconnecting or shutting down the server, which cause unnecessary disruption.

Answer

Run a full malware scan on the database server.

Answer

Disconnect the database server from the network immediately.

Answer

Shut down the database service to prevent further data leakage.

Question 19

Which TWO types of evidence are considered 'volatile'?

Accepted Answer

System memory (RAM).. RAM and network connections are lost when power is removed or the system is reset.

Answer

Optical disc contents.

Answer

Hard drive data.

Answer

Printed log files.

Question 20

When responding to a SQL injection incident, which TWO areas of the database server logs should be prioritized for review?

Accepted Answer

Database user activity/audit logs. Option C (database user activity/audit logs) is correct because audit logs record authentication events, privilege changes, and the specific accounts and source hosts involved in suspicious activity, which is essential for identifying who executed the injection and what they accessed. Option E (database query execution logs) is correct because they capture the actual SQL statements sent to the server, allowing responders to spot injected payloads such as UNION SELECT, OR 1=1, or stacked queries and to determine which tables or data were touched. Together these two log sources provide the attacker identity and the malicious query evidence needed for containment and forensic reconstruction. Option A (OS kernel logs) is not prioritized because it deals with hardware, driver, and system-level events rather than SQL activity. Option B (backup completion logs) only shows whether backup jobs succeeded and has no bearing on detecting or tracing an injection. Option D (network interface statistics) provides traffic counters and throughput data, not the application-layer SQL content or user context required for this investigation.

Answer

Operating system kernel logs

Answer

Database backup completion logs

Answer

Network interface statistics