Certified Incident Handler (212-89) (212-89) — Questions 1–75

The -a switch lists all connections and listening ports, -n prevents DNS resolution so results are immediate and unaltered, -o shows the owning process ID, and -b displays the executable name. Running this before network isolation preserves ephemeral connections tied to malicious processes that would otherwise be lost or reset.

Disconnecting the host from the network immediately stops the ransomware from reaching shared drives and other systems, limiting spread. It also preserves the host's volatile memory and running state for forensic analysis. Unlike powering off, this action maintains evidence integrity while containing the incident. It is the fastest and least destructive way to isolate the infected system during active encryption.

Rules of Engagement define the scope, authority and boundaries for containment actions, so they belong within the Incident Response Plan. Updating the IRP addresses the deficiency directly, giving responders pre-approved containment limits that prevent the accidental service disruption seen during this P1 incident.

Documenting the physical state and initiating chain of custody before any interaction preserves the evidentiary value of the device. Photographs and written records establish that the laptop was received in a known condition, and the custody log creates an auditable trail that supports admissibility if the case proceeds to legal action.

The response body is encrypted binary data, which likely contains the actual C2 commands. To understand the protocol structure and extract commands, you must decrypt the payload using the malware's decryption algorithm. This requires reverse engineering the malware or knowing the key. Once decrypted, the structure and commands become visible, providing direct insight into the C2 communication.

Resource Monitor provides detailed real-time information about CPU, memory, disk, and network usage per process. It shows network connections and which process is using them, allowing the handler to identify the adware process and its communication. This is more comprehensive than Task Manager for correlating resource consumption with network activity, directly addressing the slow performance and pop-ups.

This is correct because the attacker used a compromised mailbox to silently divert CFO communications, a hallmark of BEC. The hidden rule enables invoice fraud and wire transfer manipulation by preventing the victim from seeing warnings or replies. The rule hiding messages from a senior executive is a classic post-compromise persistence and collection technique in business email compromise incidents.

Received headers are added as the message passes through each mail server, with the oldest entry at the bottom. Reading from bottom to top traces the path from the originating server to the final delivery. The bottom-most Received header typically contains the IP address of the sender's mail server, which is the closest to the true origin.

Tuning rules to match the application's legitimate input patterns — expected parameter formats, field lengths and character sets — lets the WAF distinguish genuine traffic from attacks, so benign requests are not blocked. This directly reduces false positives while preserving detection of genuine malicious payloads.

The incident response team must be activated first because it owns containment, eradication and recovery. Notifying executives, legal or communications before the responders delays technical action, allowing the incident to spread while no one is yet investigating or containing it.

BEC attacks impersonate executives to trick staff into wiring funds or changing payment details, so the primary business impact is direct financial loss through unauthorised transfers. Other consequences such as reputational damage or data theft are secondary to the immediate monetary fraud this scenario targets.

NTP drift skews local file system timestamps, so recording the offset lets investigators correct them before correlating against firewall, IDS and server logs. Without this, the timeline of intrusion events becomes unreliable, undermining attribution and scope determination during the first-response triage.

Applying missing patches closes the vulnerability that allowed the initial compromise, preventing immediate reinfection. Eradication is not complete without addressing the root cause. Patching the system and its dependencies ensures that the same attack vector cannot be reused, and it is a critical step before restoring the system to production.

Web server access logs capture the HTTP method and URL of requests. A POST request to a file upload endpoint is the primary way files are uploaded. By examining these logs, you can identify the timestamp, source IP, and target endpoint used for the upload. This directly addresses how the web shell was placed on the server.

The workstation is sending forged ARP replies to associate the DMZ server's IP with its own MAC address, causing traffic destined for the server to be redirected to the attacker. The mismatch between the Ethernet source MAC and the IP source in captured packets confirms this Layer 2 redirection, which is the defining behavior of ARP cache poisoning in a switched network.

Updating security controls and user awareness programmes directly addresses the root cause once containment and indicator identification are complete. This satisfies the stem's post-incident requirement by preventing recurrence, closing the gap that allowed the email incident, and hardening both technical defences and human behaviour against the same attack vector.

A sandboxed malware analysis service executes the sample in an instrumented, isolated environment and captures network traffic, dropped files, and process behavior. This allows the analyst to identify the payload's remote hosts and protocols without risking production systems. It is the most controlled and repeatable way to determine network behavior for a macro-enabled document in an incident response context.

Identification is where detected events are triaged and validated to determine whether they constitute a genuine incident. This validation point is when the organization effectively 'knows' an incident exists, which is what regulators and counsel use to start notification clocks. Documenting the time of this determination inside the incident ticket provides the defensible timestamp legal needs for breach reporting.

Containment aims to limit the scope and impact of an incident. Blocking malicious communication at the firewall prevents further spread or data exfiltration, which is a classic containment action. It isolates the threat without necessarily eradicating it, aligning with the goal of stopping the incident from expanding.

Hardware acquisition tools interface directly with the memory bus or use DMA to read RAM without executing code on the host, preserving the integrity of volatile data. This minimizes changes to the system state while capturing the exact contents needed for analysis. It is the preferred method when live memory capture is required and the system must remain powered on.

WinPmem and comparable tools are specifically designed to acquire a forensic image of physical memory while minimizing changes to the system. They produce a raw memory dump that can be analyzed for running processes, network connections, and injected code. This directly satisfies the requirement to capture volatile memory before shutdown, preserving evidence that would otherwise be lost.

The order of volatility places system memory, running processes, network connections, and other RAM-resident artifacts at the top. These are lost on shutdown or reboot, so they must be captured first. On a running Linux server, this includes process lists, open sockets, loaded modules, and memory images, all of which can reveal attacker activity not present on disk.

This is correct because the first step in handling a suspected phishing email is to preserve evidence and escalate. Collecting the full email with headers allows analysts to extract indicators, verify the sender, and determine if others received the same message. Reporting to the security team initiates the incident response process and enables blocking and user awareness actions.

Attackers increasingly host malicious documents on trusted cloud services because email gateways often allow links to well-known domains. The gateway sees a reputable URL and does not block it, while the hosted document contains the malicious macro. This technique leverages the trust placed in the cloud service's domain to evade reputation-based detection.

Unexplained outbound connections to unknown IP addresses indicate command-and-control beaconing or data exfiltration, a runtime behaviour rather than a static file signature. This makes it a behavioural indicator, distinguishing it from artefact-based detection such as file hashes or signatures.

Audit logs record file access and modification events via the kernel audit subsystem, capturing writes to web server configuration paths such as httpd.conf or nginx.conf. This directly satisfies the scenario's need to identify who altered configuration files, since standard access logs only record HTTP requests, not filesystem changes.

System memory (RAM) is volatile because its contents are lost when power is removed, satisfying the stem's requirement for evidence that degrades quickly. RAM holds running processes, encryption keys and network connections that vanish on shutdown, so it must be captured first, before disk imaging, to preserve forensic artefacts.

DMARC builds on SPF and DKIM alignment, letting the domain owner publish a policy telling receivers whether to quarantine, reject or monitor messages failing authentication. SPF and DKIM alone verify origin but carry no handling instructions.

A snapshot with memory captures the VM's volatile state, including running processes and RAM contents, alongside disk. This preserves forensic evidence that a disk-only snapshot or live login would alter, satisfying the requirement to capture the VM's state before any analysis begins.

Encoded PowerShell executes malicious instructions through a trusted, signed system binary, hiding intent in base64 and evading signature-based detection. This typifies Living off the Land, which abuses legitimate built-in tools rather than dropping custom malware, matching the EDR indicator described in the stem.

DGA domains are algorithmically generated and typically exhibit high entropy and poor reputation. Blocking such domains at the DNS resolver prevents resolution of future DGA domains without needing to know them in advance, effectively disrupting command-and-control communication. This is a proactive, scalable containment measure that does not rely on static blocklists and is appropriate for this scenario where the attacker rotates domains frequently.

Disconnecting the workstation from the network immediately stops the ransomware from communicating with its C2 server and prevents it from encrypting files on network shares or spreading to other systems. This is the first containment step to limit the scope of the incident. It also preserves the state for forensic analysis and potential decryption.

DKIM signs selected headers and the body, so any alteration to the message body after signing invalidates the hash comparison. This directly satisfies the stem's constraint that verification failed due to content modification in transit.

Capturing the live screen state preserves volatile visual evidence such as open windows, command prompts, and error messages that may disappear once the system is powered down or the user logs off. This documentation is a critical first step in first response, as it provides context and corroboration for later forensic analysis without altering the system.

Correlating the external IP with authentication logs determines whether the request was authenticated, which is critical to understanding if credentials were compromised or if an authentication bypass occurred. This directly establishes the scope and method of the compromise, guiding containment and remediation. Without this correlation, you cannot distinguish between a legitimate user and an attacker exploiting a vulnerability.

Export Objects reconstructs transferred files by reassembling the HTTP response body from the TCP stream, giving the analyst the original object. This directly satisfies the requirement to extract a file from a PCAP without manually following and decoding each stream.

A cryptographic hash is a fixed-length digest derived deterministically from the file's bytes. Any alteration—even a single character—produces a completely different digest. Matching the stored known-good value therefore confirms the current file's contents are byte-for-byte identical to the verified baseline.

RAM holds running processes, open network sockets, encryption keys, and volatile registry hives that vanish when power is removed. In a live USB exfiltration scenario, the responder must capture memory first because it contains the most perishable evidence, such as the process that accessed the USB device and any in-memory malware. This aligns with the order of volatility taught in incident handling.

Fixed-interval connections with low jitter are a hallmark of automated beaconing, where malware sleeps for a set period before checking in with its C2 server. Legitimate applications typically exhibit variable timing driven by user activity or event-driven updates. Consistent periodicity, especially combined with other anomalies, strongly supports a C2 beaconing determination during network forensic analysis.

Gratuitous ARP replies are sent without a request to update ARP caches. In ARP poisoning, the attacker sends gratuitous ARP replies to overwrite legitimate entries, claiming that their MAC address corresponds to an IP like the gateway. This is a direct indicator of ARP spoofing and is often observed in packet captures.

API hooking intercepts calls to system or library functions and redirects them to attacker-controlled code, letting malware hide files, registry keys or network activity while returning fabricated results. This manipulation of system calls defeats monitoring tools that rely on those APIs.

Application-level logs that capture request payloads and response metadata provide the detail needed to identify which API calls were made, what parameters were supplied, and how much data was returned. This directly supports determining whether sensitive records were accessed and which ones.

This is the definition of a softfail.

Whitelisting permitted source IP addresses on the jump server ensures only authorised administrative hosts can initiate connections, sharply reducing exposed services in the DMZ. This directly limits the attack surface, satisfying the stem's segmentation best-practise requirement for containing an incident.

Legal Counsel interprets applicable statutes, privacy regulations, and contractual obligations, then advises the team on evidence handling, notification duties, and disclosure limits. This keeps containment and investigation actions within legal boundaries, satisfying the requirement that incident handling align with organisational legal and privacy requirements.

The First Responder Toolkit contains write-blocked acquisition utilities that capture volatile memory, disk images and logs while preserving evidential integrity. Collecting artefacts without modifying the target system maintains the chain of custody, which is the toolkit's defining purpose during the initial incident response phase.

The first step in handling a suspected phishing email is to report it to the security team and preserve the original message, including full headers, so it can be analyzed. Instructing the user not to interact with the message prevents credential compromise. This aligns with the containment and evidence preservation phases of incident handling.

Creating a forensic image with dd preserves the exact state of the file system, including metadata such as timestamps, permissions, and inodes. Analyzing the image instead of the live system prevents accidental modification of metadata. This is the first step to ensure integrity because it captures a bit-for-bit copy that can be verified with hashes. Subsequent analysis on the image does not alter the original evidence.

Process Explorer displays a process's loaded modules, including the DLL path, version and digital signature, directly satisfying the requirement to identify which DLLs a legitimate process has loaded. Its lower pane lists all DLLs and memory-mapped files, exposing the malicious DLL's location for removal or analysis.

DGA generates large volumes of pseudo-random domain names, so the malware cycles through many candidates until one resolves to a live command-and-control server. This defeats static blocklists, which can only enumerate known domains, directly satisfying the scenario's constraint of evading pre-compiled C2 blocklists.

Context-aware output encoding ensures that user-supplied data is treated as text, not code, when inserted into HTML, JavaScript, or other contexts. It neutralizes malicious scripts by converting special characters to their safe HTML entities. This is the primary defense against XSS because it prevents the browser from interpreting injected content as executable, regardless of where the data is reflected or stored.

Out-of-band channels use separate infrastructure from the compromised production network, so an attacker with persistent access cannot intercept or monitor incident-response coordination. This satisfies the stem's requirement to keep team communications confidential during a major incident.

Recording a detailed physical description and unique identifiers such as serial numbers ties the evidence to the specific device, preventing substitution or ambiguity later. This supports the CoC requirement that every item be uniquely traceable throughout its custody.

Port 4444 is commonly associated with Metasploit and other penetration testing tools, and encrypted traffic to an external IP on this port is a strong indicator of command and control communication. The slow performance could be due to the malware's activities, such as data exfiltration or resource consumption. This combination of factors points to a compromised host communicating with an attacker-controlled server.

Examining the web server's process list identifies which executable initiated the MySQL connections, distinguishing legitimate application traffic from attacker tooling. NetFlow alone confirms volume and endpoints but not the originating process, so this step satisfies the need to attribute the port 3306 traffic before escalating or containing.

Oledump parses OLE compound-file structures and extracts embedded VBA macro streams from Word documents without executing them, exposing the source code for inspection. This satisfies the static-analysis constraint: the analyst reads the macro's code directly rather than detonating it in a sandbox.

Web server access and error logs record inbound requests, response codes and server-side faults, forming the primary evidence source for reconstructing an attack against a web application. Auditing them satisfies the requirement to examine the components handling client traffic directly.

Restoring to a sandbox or isolated VLAN lets you verify backup integrity and confirm malware is absent before production reconnection. This prevents reintroducing the infection or overwriting clean data, directly satisfying the stem's requirement for the most critical pre-restoration step.

Capturing network traffic and ARP tables preserves volatile evidence such as the attacker's MAC address, IP, and the frequency of spoofed ARP replies. Isolating the affected VLAN (e.g., by moving it to a quarantine VLAN or applying an ACL) contains the threat by preventing the attacker from reaching other segments, while still allowing forensic investigation. This approach balances immediate mitigation with evidence preservation, which is critical for incident response.

Blocking the command-and-control IP at the firewall prevents further communication from the compromised host and potentially other infected systems. This is a network-level containment measure that can be implemented quickly and does not require touching the endpoint, allowing the handler to maintain visibility while limiting the adversary's control channel.

Patching the exploited vulnerability closes the initial access vector, preventing immediate reinfection after cleaning. Eradication is incomplete if the entry point remains open, so remediation must include identifying the specific flaw and applying the vendor fix. This satisfies the stem's requirement to secure the entry point, not merely remove malware artefacts.

The pattern of many SYN packets to a single destination without SYN-ACK responses is classic for a SYN flood. The attacker sends numerous SYN requests, exhausting the server's connection table, causing it to become unresponsive. The lack of SYN-ACKs indicates the server is overwhelmed or the source IPs are spoofed. This is a denial-of-service attack aimed at making the service unavailable.

Blocking the sender and searching for other recipients limits the blast radius of the campaign and identifies colleagues who may have already acted on it. It is proportionate to a reported, unclicked phishing message and gives the handler the scope needed to decide whether further containment, such as credential resets, is warranted.

Post-mortem analysis requires assessing whether existing security controls performed as intended during the incident, identifying gaps that allowed delivery or detection failure. This evaluation directly informs remediation and control hardening, satisfying the review's requirement to determine why controls did not prevent or flag the email threat.

Stored XSS occurs when user input containing malicious script is persistently stored by the application (e.g., in a database, comment field, or log) and later rendered to other users without proper sanitization. The scenario describes exactly this: a comment field that stores the script and displays it to others, making it a persistent threat.

Get-NetTCPConnection is a PowerShell cmdlet that lists active TCP connections and their states. It provides similar information to netstat but in a structured, object-oriented format that can be easily exported or filtered. It is a legitimate tool for capturing volatile network connection data on Windows systems, especially in modern environments where PowerShell is available.

Process hollowing unmounts a legitimate executable's memory and injects malicious code into that reserved space, so the payload executes under a trusted process identity. This satisfies the scenario's requirement to conceal activity from the EDR solution, since monitoring sees a signed, benign parent rather than an unknown binary.

Writing to the Run key causes Windows to execute the listed program automatically at every user logon, so the malware survives reboots without any user action. This satisfies the persistence objective by embedding an autostart entry in the registry.

A bootable forensic collection drive lets the responder boot the suspect machine into a trusted environment, capturing volatile memory and disk images without altering the installed operating system. This satisfies the stem's physical toolkit requirement by enabling evidence preservation at the scene before any shutdown or tampering occurs.

Post-incident activity, also known as lessons learned, is the phase where the team reviews the incident to improve future response. It involves documenting the timeline, identifying the root cause, and recommending corrective actions. This phase ensures that the organization learns from the incident and updates its procedures, making it the correct phase for the described activity.

Log analysis establishes whether the traffic is malicious or benign before committing to containment or blocking, which could disrupt legitimate users. It satisfies the identification phase's need to characterise the activity, giving evidence to justify any escalation.

An IR policy grants the incident response team formal mandate, defining roles, escalation paths and decision rights. This authority framework lets responders act decisively during incidents without seeking ad hoc approval, which is its primary function.

Preparation builds the incident response capability before incidents occur: tools, communications channels, trained personnel, playbooks and authority. It establishes the resources and capabilities that later phases depend on, rather than detecting, containing or eradicating a specific incident.

Short, periodic connections to an external IP on TCP port 443 with small, consistent data transfers are characteristic of beaconing behavior. Malware often uses HTTPS to blend in with normal traffic, and the regular intervals and small payloads are designed to check for commands without attracting attention. This pattern strongly suggests command-and-control communication.

Task Scheduler allows programs to be executed at specific times or in response to events. Malware often creates scheduled tasks to maintain persistence. The presence of a suspicious executable in the Scheduled Tasks tab of Autoruns indicates that the malware is using Task Scheduler for persistence.