20+ practice questions focused on Malware Incidents — one of the most tested topics on the Certified Incident Handler (212-89) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Malware Incidents PracticeYou are performing a live memory analysis using Volatility 3. You suspect a rootkit is hiding processes. Which plugin should you run to compare the process list from the EPROCESS block with the thread scheduler's list?
Explanation: windows.psscan in Volatility 3 scans physical memory for pool tags associated with EPROCESS structures, bypassing the active process linked list that rootkits typically unlink. Comparing its output against windows.pslist (which walks the EPROCESS linked list) reveals hidden processes — any process in psscan but not pslist is a strong rootkit indicator.
You are analyzing a malware sample that has infected a Windows system. The malware appears to be communicating with a remote server using DNS queries. You suspect it is using DNS tunneling to exfiltrate data. Which tool would be most effective for detecting and analyzing this DNS tunneling activity?
Explanation: DNS tunneling involves encoding data in DNS queries and responses, often using long or unusual domain names. Detecting it requires analyzing DNS traffic patterns and payloads. NSM tools like Zeek or Suricata can be configured to detect such anomalies, making them the most effective for this scenario. General packet capture tools lack the built-in detection capabilities.
An incident handler is investigating a malware infection on a Windows server. The malware is suspected to have established persistence. Which TWO of the following Windows registry locations are commonly used by malware to achieve persistence? (Choose two.)
Explanation: The Run key and Services key are two of the most common registry locations for malware persistence. The Run key executes programs at user logon, while the Services key allows malware to run as a system service at boot. Both are frequently leveraged due to their reliability and ease of use. Other keys like Winlogon can be used but are less common and riskier for the malware author.
You are analyzing a malware sample that communicates with its command-and-control server over HTTPS on port 443 but uses a hardcoded IP address and a self-signed certificate. The malware also beacons at irregular intervals to avoid pattern detection. Which network indicator is most reliable for detecting this malware across the enterprise?
Explanation: A hardcoded IP address and a self-signed certificate serial number are stable, specific indicators that the malware must use to communicate successfully. These values can be searched across firewall and proxy logs and TLS inspection platforms to identify all infected hosts, whereas port usage, encryption, timing, and user agents are too generic to be reliable.
During a malware incident, an analyst discovers a malicious DLL that is loaded by a legitimate Windows process. The DLL is not signed and resides in a user-writable directory. The analyst wants to confirm whether the DLL is being loaded via DLL search order hijacking. Which Windows registry location should the analyst examine to identify the DLL search order?
Explanation: DLL search order hijacking occurs when a malicious DLL is placed in a directory that is searched before the legitimate DLL's location. The KnownDLLs registry key lists DLLs that are always loaded from the system directory, bypassing the search order. If the malicious DLL is not in KnownDLLs, it may be hijacked. Examining this key is essential to confirm the hijacking mechanism.
+15 more Malware Incidents questions available
Practice all Malware Incidents questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Malware Incidents. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Malware Incidents questions on the 212-89 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Malware Incidents is tested as part of the Certified Incident Handler (212-89) blueprint. Practicing with targeted Malware Incidents questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free 212-89 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Malware Incidents is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Malware Incidents practice session with instant scoring and detailed explanations.
Start Malware Incidents Practice →