Certified Incident Handler (212-89) (212-89) — Questions 1–75

During the lessons learned phase of a P1 incident, you notice that the incident handling policy failed to define clear 'Rules of Engagement' for containment, leading to accidental service disruption. Which document should be updated to address this deficiency?

You are performing incident response on a web server compromised via Directory Traversal. What command is most useful for identifying the specific files accessed in the logs?

Which THREE factors should be considered when tuning a WAF to reduce false positives for an application?

When identifying stakeholders to notify during an incident, which group should be notified first?

What is the primary risk associated with 'Executive Spoofing' or BEC (Business Email Compromise)?

During initial triage, you identify that a system's time is significantly out of sync with the NTP server. Why is this critical to record during the first response?

Which action should be taken after an email incident is contained and the indicators are identified?

Which THREE of the following are considered 'behavioral' indicators of a malware infection?

Which log file should you examine if you suspect an attacker is modifying the web server configuration files?

Which TWO types of evidence are considered 'volatile'?

You have identified an active C2 beacon on a corporate server. You are instructed to implement 'Containment' via network segmentation. Which configuration change on a Cisco ASA firewall provides the most effective containment while still allowing for remote forensic forensic analysis?

Which protocol is used in conjunction with SPF and DKIM to provide instructions to the receiver on how to handle emails that fail authentication?

When investigating an incident on a virtualized platform (VMware), what is the first step to capture the state of the VM for analysis?

You are reviewing logs from an EDR and see an indicator of 'Living off the Land' (LotL). Which tool usage would be considered an LotL attack?

When DKIM signature verification fails, what is the most likely technical cause?

During network forensics, you need to reconstruct an HTTP file transfer from a PCAP. Which Wireshark feature allows you to extract the file object directly from the stream?

During an investigation, you need to verify the integrity of a system configuration file. You have the original known-good hash. What does it mean if the hash of the current file matches the known-good hash?

You are analyzing a malware sample that uses 'API Hooking'. What is the goal of this technique?

A user's session is hijacked. Which log attribute is most helpful in confirming the hijack occurred?

While analyzing an email header, you observe an SPF 'softfail'. What does this imply?

When segmenting a network to contain an incident, what is the best practice for a 'Jump Server' in a DMZ to limit the attack surface?

Which role in the Incident Response Team is primarily responsible for ensuring that the incident handling activities remain aligned with organizational legal and privacy requirements?

What is the 'First Responder Toolkit' used for during an incident?

You have identified a malicious DLL that is being loaded by a legitimate process. Which tool allows you to view which DLLs are loaded by a specific process?

You are analyzing a malware sample that uses Domain Generation Algorithms (DGA). What is the primary purpose of DGA in malware?

You are setting up a secure communication channel for the IR team during a major incident. Why is it recommended to use an out-of-band communication method?

Which THREE pieces of information should be recorded on a Chain of Custody (CoC) form when collecting a device?

You are using NetFlow to identify lateral movement. You see a high volume of connections from a web server to an internal database server on port 3306. What is the most appropriate next step in the investigation?

You are reviewing a suspicious macro in a Word document attachment. Which tool is best suited for static analysis of the macro code?

Which THREE components are typically involved in a web application's logging infrastructure that an incident responder should audit?

An incident responder is using NetFlow to identify a data exfiltration event. What specific field in a NetFlow v9 record provides the best indication of the total volume of data moved between two internal hosts?

A malware infection has encrypted several network shares. You decide to restore from backups. What is the most critical step to perform before restoring data to the production environment?

When eradicating malware, which TWO of the following steps are essential to ensure the host is fully cleaned and the entry point is secured?

Which TWO of the following steps are required when performing a post-mortem analysis of an email incident?

An analyst is reviewing logs from an EDR solution. They see a 'process hollowing' event. What is the primary purpose of this malware technique?

You are analyzing a malware sample using Cuckoo Sandbox. The report shows the malware is attempting to modify the 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run' registry key. What is the intent of this activity?

Which TWO items should be part of a first responder's physical toolkit?

During the identification phase, you notice a high volume of traffic from an unknown IP to your web server. What is the most appropriate action to take first?

What is the primary function of an Incident Response (IR) policy?

What is the primary purpose of the 'Preparation' phase in the incident response lifecycle?

Which TWO of the following actions are standard steps in the 'Analysis' phase of an incident?

Which THREE of the following email security technologies should be configured to prevent domain spoofing?

You are investigating a Linux server breach. You need to capture the current state of network connections without altering the evidence. Which command-line tool is preferred by first responders?

Which THREE of the following characterize potential lateral movement using RDP in a domain environment?

You are analyzing a malware sample in a lab. You notice the malware uses the 'CreateRemoteThread' API. What is the objective of this malware activity?

An organization uses Microsoft 365. Which feature should an admin use to globally remove a malicious phishing email from all user mailboxes?

You are analyzing a PCAP file to detect 'Pass-the-Hash' activity. Which SMB message type should you specifically look for in the NTLM authentication exchange?

What is the primary function of a Web Application Firewall (WAF) in an incident response scenario?

When conducting an interview with a potential witness during an investigation, what is the best practice to follow?

What is the purpose of 'Network Segmentation' during an active network incident?

Which of the following activities is best suited for the 'Recovery' phase of the incident handling process?

You are using Wireshark to analyze traffic from an infected host. You notice consistent beaconing activity to an external IP on port 443. How do you isolate this traffic in your capture?

Which THREE of the following should be included in an incident communication plan?

When managing the 'Lessons Learned' phase of the incident response lifecycle, which THREE activities should be conducted to ensure continuous improvement?

You are using an IDS/IPS to detect lateral movement. You notice that your NIDS is not alerting on SSH brute force attempts. Which configuration check is most important to perform?

You are utilizing NIST SP 800-61 Rev. 2 to structure your incident response team. During a critical ransomware outbreak, you need to assign a lead who coordinates with legal, PR, and executive leadership. Which role should you designate to ensure organizational communication is handled per the policy?

Which TWO of the following are considered 'Legal Considerations' during the Incident Handling process that must be integrated into the response plan?

If a phishing email bypassed the perimeter email gateway, what is the next logical step in the incident response process?

When analyzing a potentially malicious script, which THREE of the following techniques help in deobfuscating the code?

An attacker uses a 'Homograph Attack' to spoof a domain. How does the analyst detect this?

You are responding to a web-based attack. Which log source is most critical for identifying the origin of a SQL injection attempt?

You have identified an infected machine and need to perform a memory dump before it is wiped. Which tool is the industry standard for acquiring a full memory dump on a Windows machine for incident response?

When reviewing firewall logs, you see many 'deny' events from an internal host to an external IP. What is the most likely cause?

You are identifying a compromised host by checking for beaconing behavior. Which network metric is most indicative of heartbeat-style beaconing?

Which TWO of the following describe the role of an email gateway in incident response?

An analyst is investigating a suspected SQL injection attack on an IIS server. Which log file should they prioritize to identify the specific URL-encoded payload strings submitted by the attacker?

An attacker is using ICMP tunneling to exfiltrate data. What field in an ICMP echo request packet would contain the unauthorized data?

Which TWO of the following are essential components of an effective Incident Response (IR) plan?

You are performing an investigation on a compromised mobile device. What is the primary risk of connecting the device to a standard workstation without a write blocker?

An employee receives a suspicious email asking to verify account details by clicking a link. What is the most effective user behavior to mitigate this?

A malware sample was found to use a 'Mutex' to ensure only one instance of the malware runs at a time. What tool would you use to find the Mutex name on an infected host?

You are investigating a suspected rootkit. Which area of the operating system should you examine for unauthorized boot-time execution?

You are documenting an incident and need to record the time of the event. Why is accurate time synchronization critical?

When documenting the chain of custody for a seized laptop, which information is mandatory?

A web server log shows repeated '403 Forbidden' errors for a specific directory. What is the most likely cause during an incident?