20+ practice questions focused on Network Incidents — one of the most tested topics on the Certified Incident Handler (212-89) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Network Incidents PracticeWhen analyzing logs from a Palo Alto Networks firewall, which specific threat log field is most useful for identifying the 'User-Agent' string used by a beaconing malware to blend in with legitimate web traffic?
Explanation: In Palo Alto threat logs, the application-specific details or specific threat-id logs often contain the HTTP headers including the User-Agent.
An incident responder is using NetFlow to identify a data exfiltration event. What specific field in a NetFlow v9 record provides the best indication of the total volume of data moved between two internal hosts?
Explanation: IN_BYTES in a NetFlow v9 record counts the total number of bytes observed in the flow, making it the direct measure of data volume transferred between hosts. For exfiltration analysis, comparing IN_BYTES across flows to external or unusual destinations reveals how much data left the network. It is the primary field for volumetric analysis in flow-based forensics.
You are configuring a Cisco ASA firewall to perform deep packet inspection to mitigate lateral movement via SMB exploits. Which feature must be enabled in the modular policy framework to drop packets containing known exploit patterns?
Explanation: The Cisco ASA uses the 'inspect smb' command within a policy-map to trigger the inspection engine for SMB protocols.
During a network incident, you need to isolate a compromised workstation by updating the switch port configuration. Which command would you use on a Cisco Catalyst switch to move a port to a restricted VLAN?
Explanation: The 'switchport access vlan [id]' command is the standard way to assign a switch port to a specific VLAN.
You are analyzing a PCAP file to detect 'Pass-the-Hash' activity. Which SMB message type should you specifically look for in the NTLM authentication exchange?
Explanation: Pass-the-Hash attacks authenticate using a stolen NTLM hash without knowing the plaintext password. In the NTLMSSP exchange, the NTLMSSP_AUTH message contains the NTLM response (the hash-based challenge response) that the server validates. Detecting this message type in SMB traffic is key because it carries the actual authentication attempt using the hash.
+15 more Network Incidents questions available
Practice all Network Incidents questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Network Incidents. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Network Incidents questions on the 212-89 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Network Incidents is tested as part of the Certified Incident Handler (212-89) blueprint. Practicing with targeted Network Incidents questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free 212-89 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Network Incidents is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Network Incidents practice session with instant scoring and detailed explanations.
Start Network Incidents Practice →