Certified Incident Handler (212-89) (212-89) — Questions 76–150

Analysis determines what happened and how far the attacker reached. Scoping the compromise establishes which systems, accounts and data are affected, bounding containment and eradication work. This directly satisfies the phase's objective of understanding incident impact before remediation begins.

Web server access logs record all HTTP requests, including the URLs and parameters requested. When a web shell is accessed, the request to the shell's file (e.g., shell.php) will appear in these logs, often with unusual parameters or POST data. Analyzing access logs can reveal the attacker's IP, the time of access, and the commands executed via the shell, making it the primary source for detecting web shell activity.

Isolating the host stops any lateral movement or command-and-control traffic, and capturing memory first preserves volatile artifacts such as injected code and running processes. Removing the scheduled task and quarantining the binary addresses the self-healing persistence mechanism that re-creates the Run key, so the malware cannot respawn after cleanup.

DKIM adds a cryptographic signature to outbound mail, letting receivers verify the message genuinely originated from the signing domain and was not altered. This directly counters domain spoofing by proving authenticity, satisfying the requirement to prevent forged sender domains.

The `ss -tupn` command reads live socket tables directly from the kernel, listing TCP and UDP connections with numeric ports and owning processes. Unlike `netstat`, it does not write to disk or modify connection state, satisfying the requirement to capture current network connections without altering evidence.

The communication and escalation matrix in the IR plan defines who must be notified, in what order, within what timeframe, and through which channels. Following it ensures legal, regulatory, executive, and technical stakeholders are informed appropriately. It also prevents ad hoc notifications that could leak information or violate compliance requirements. The matrix is the authoritative guide during a confirmed breach.

RDP normally negotiates Kerberos in a domain, so NTLM authentication indicates fallback credentials, misconfiguration or an attacker lacking a valid ticket. This deviation from expected Kerberos behaviour is the anomaly that signals possible lateral movement.

CreateRemoteThread starts a new thread inside another process's address space, typically after allocating and writing shellcode there, so the injected code executes under the target process's context — the classic mechanism for process injection and defence evasion.

Search and Purge locates messages by sender, subject or URL across all mailboxes, then deletes them tenant-wide, including copies already delivered. This satisfies the global removal requirement that per-mailbox deletion or transport rules cannot achieve after delivery.

Attackers often create inbox rules to automatically delete or move emails that could alert the user or security team, such as notifications from banks or colleagues questioning suspicious requests. This helps them maintain persistence and avoid detection while carrying out fraud or data theft.

A DDoS attack uses multiple compromised systems to flood a target with traffic, overwhelming its resources. The scenario describes requests from many distributed IP addresses, which is the hallmark of a DDoS attack. This makes it difficult to mitigate by blocking a single source.

A WAF inspects HTTP traffic and blocks requests matching known attack signatures, such as SQL injection or cross-site scripting payloads, at the application layer. This containment capability limits exploitation during an incident, complementing network-layer controls.

Open-ended questions elicit narrative accounts rather than yes/no answers, preventing the interviewer from shaping responses through suggestion or confirmation bias. This satisfies the stem's requirement for best practice during witness interviews, where uncontaminated factual recall matters most. Closed or leading questions risk distorting testimony and reducing its evidentiary value.

This approach directly targets the suspected exfiltration channel. By reassembling the TXT record responses and decoding the base64 content, the analyst can extract the actual data being sent out. It leverages the fact that DNS TXT records can carry arbitrary data, and the base64 encoding suggests deliberate obfuscation. This method is precise and provides evidence of the exfiltrated content.

Post-incident activity includes reviewing the incident and documenting lessons learned. The timeline is typically finalized and analyzed here to improve future response. This phase ensures that all details are captured for reporting and legal purposes, making it the phase where documenting the timeline is a key deliverable.

SSRF against a cloud workload commonly targets the link-local metadata address to steal instance role credentials. Blocking that specific destination at the subnet or host firewall stops credential retrieval while the application remains available for investigation. Simultaneously capturing outbound traffic preserves the attacker's request patterns, source parameters, and timing, which supports scoping without destroying forensic artifacts.

A RAT is designed to maintain persistent, stealthy access to a compromised system, often using periodic beacons to a command-and-control server to check for instructions. The small, encrypted, hourly communication is a classic beaconing pattern used by RATs to avoid detection while maintaining control. This allows the attacker to issue commands or exfiltrate data on demand.

Segmentation splits the network into isolated zones through VLANs, ACLs or firewall policies, restricting lateral movement so the attacker cannot reach other systems. This directly delivers containment during an active incident by cutting communication paths, rather than merely detecting or documenting the intrusion.

Filtering on ip.addr matches packets where the beaconing IP appears as either source or destination, isolating the command-and-control conversation from unrelated traffic. This display filter satisfies the need to narrow the capture to the infected host's external communications on port 443, letting you inspect beacon timing and payloads.

Exporting the scheduled task definition with schtasks /query /tn ... /xml captures the exact trigger, action, and run-as account configured by the attacker, which is volatile because the task may be deleted or altered during remediation. This preserves the persistence mechanism's configuration for later analysis and legal purposes without executing the malicious binary.

Creating a Windows service with an ImagePath in a user-writable directory allows the malware to run automatically when the system boots, achieving persistence. The deceptive display name helps it blend with legitimate services. This is a common persistence technique that survives reboots and often runs with SYSTEM privileges if the service is configured accordingly, making it a high-value indicator for incident handlers.

Rules for communicating with law enforcement satisfy the legal and regulatory notification constraint in an incident communication plan. Breach notification statutes and sector regulators mandate specific timelines and designated points of contact, so the plan must define who contacts police, fraud units or national cybercrime agencies, and when.

LiME (Linux Memory Extractor) is a loadable kernel module designed for forensically sound memory acquisition on Linux. It captures physical memory to a file or over the network, minimizing the footprint on the target system. It handles large memory sizes and produces an image that can be analyzed with tools like Volatility. Loading a kernel module is a controlled action that does not require rebooting and preserves the system's running state. This is the preferred method for live Linux memory acquisition.

Reviewing the incident timeline exposes detection gaps, such as missed alerts or delayed escalation, that allowed the incident to persist. This satisfies the Lessons Learned phase's aim of continuous improvement by producing concrete, evidence-based recommendations for tuning monitoring and response procedures.

Volatile evidence such as RAM contents, running processes, and active network connections disappears on shutdown, so capturing it before isolation preserves critical forensic value. Isolating afterward limits further exfiltration, and continued monitoring detects whether the attacker pivots or triggers destructive actions. This sequence respects the principle of order of volatility while still containing the threat, balancing investigative needs against business risk.

The Incident Coordinator owns cross-functional communication during an outbreak, liaising with legal, PR and executive leadership as NIST SP 800-61 Rev. 2 prescribes. This satisfies the stem's constraint that organisational communication follows policy, since the role centralises stakeholder messaging rather than leaving it to technical responders handling containment.

Data breach notification statutes impose legal deadlines and content requirements for informing regulators and affected parties. Integrating them into the response plan ensures incident handling meets statutory obligations, satisfying the legal considerations the question asks for.

With the gateway already bypassed, containment is the immediate priority: removing the message from mailboxes and mail flow stops further user interaction and payload delivery. This limits scope before eradication and recovery, satisfying the stem's next-step requirement after perimeter failure.

The post-incident activity phase requires a review meeting with all involved parties to capture what worked, what failed, and what improvements are needed. Closing the incident without this review leaves root causes unaddressed and prevents the organization from improving future response. The CISO's request to close must be satisfied only after this review is documented and corrective actions are assigned.

The Windows Management Instrumentation Command-line (WMIC) utility can retrieve detailed process information, including full command-line arguments, using a simple query. This is a native tool available on most Windows systems and provides a comprehensive, scriptable way to capture process data without installing third-party software, making it ideal for first response.

Preparation is the phase where the organization builds everything needed before an incident happens: the response plan, communication procedures, toolkits, jump bags, and trained personnel. Developing the plan, buying forensic tools, and conducting training are all foundational preparation activities. Without this groundwork, later phases such as identification and containment are improvised, slow, and error-prone, which directly increases impact and recovery time.

When a web server sits behind a reverse proxy, it should only accept the X-Forwarded-For header from that proxy. If the server trusts the header from any source, attackers can spoof it to bypass IP-based restrictions. Restricting trust to known proxies ensures that the header is validated and cannot be manipulated by external clients.

The encryption of files, the new file extension, and the payment demand are hallmark indicators of ransomware. The initial vector was an email attachment, but the resulting incident type is ransomware because the impact is data encryption and extortion. This classification drives the appropriate response actions, including isolation, containment, and recovery from backups.

Regular, small DNS queries to a single external domain can indicate DNS tunneling for data exfiltration. Attackers encode data in DNS queries and responses, often at regular intervals to avoid detection. The small size and regularity are designed to blend with normal DNS traffic. Incident handlers should analyze the DNS query patterns and payload sizes for anomalies.

Centralized authentication and SIEM correlation across all servers is the most reliable way to identify every system the compromised account touched. It captures logon events, source IPs, and timestamps across the environment, revealing lateral movement paths. Relying on a single data source is insufficient; correlating authentication logs with SIEM events provides a comprehensive scope assessment.

A TCP SYN flood sends numerous SYN packets with spoofed source addresses to a target, causing the server to allocate resources for half-open connections. The server's connection table fills up, preventing legitimate connections. The observed high volume of SYNs without SYN-ACK replies and the full connection table are classic indicators of a SYN flood.

Process hollowing involves creating a new process in a suspended state, unmapping its original code (ZwUnmapViewOfSection), allocating new memory, writing malicious code, setting the thread context to point to the new code, and resuming the thread. This sequence is the hallmark of process hollowing, allowing the malware to masquerade as a legitimate process.

Malicious scripts frequently store payloads as encrypted or encoded strings that are decrypted at runtime. Identifying the decryption routine and extracting the embedded strings reveals the concealed commands, exposing the script's true behaviour without executing it.

Homograph attacks substitute visually similar Unicode characters for Latin letters, so the rendered domain looks legitimate. Browsers convert such internationalised domains into ASCII-compatible Punycode (xn-- prefix). Inspecting that Punycode representation exposes the non-Latin characters, revealing the spoofed domain that visual inspection alone would miss.

Web server access logs record each HTTP request with source IP, timestamp, URL and query string, so the injected SQL payload and originating address are captured there, unlike application or database logs that may omit the client's network origin.

Magnet RAM Capture is a free Windows tool that acquires a full physical memory image, capturing volatile artefacts such as running processes, network connections and injected code. It satisfies the requirement to dump memory on the infected Windows host before the machine is wiped.

Modified application files, templates, or uploaded webshells contain the attacker's changes and carry modification timestamps that place the defacement in time. A forensic copy preserves the exact content, permissions, and metadata for comparison against a known-good baseline. This evidence is essential to identify the persistence mechanism and to determine the full scope of altered pages.

Repeated deny events from one internal host toward a single external IP indicate beaconing behaviour typical of malware contacting its command-and-control server. The firewall blocks each attempt, satisfying the stem's scenario of many denies to an external address.

Consistent interval between connections exposes the periodic timing that heartbeat-style beaconing depends on: malware must check in at regular intervals to receive commands. This regularity distinguishes it from bursty legitimate traffic, satisfying the stem's requirement for the metric most indicative of beaconing behaviour.

The gateway inspects inbound and outbound mail, applying reputation, signature and content rules to quarantine or reject malicious messages before delivery. This filtering and blocking satisfies the stem's requirement, since it prevents threats reaching mailboxes and is a core incident-response containment control.

W3C Extended logs record the full query string of each HTTP request, including URL-encoded characters, so injected payloads such as %27 or %20 appear verbatim. IIS access logs therefore expose the attacker's submitted strings, unlike error or event logs.

ICMP echo requests carry arbitrary payload in the data field, which tunnelling tools abuse to smuggle exfiltrated content inside packets that firewalls often permit. The type, code and checksum fields hold fixed protocol values and cannot carry the unauthorised data.

Stakeholder contact details let the IR team escalate and coordinate immediately during an incident, satisfying the plan's requirement for defined communication paths. Without current names and numbers, containment stalls while responders hunt for the right owner.

Connecting the device lets the workstation mount it as a writable volume, so the operating system or sync services can update timestamps, journal entries and file metadata. That violates the forensic requirement to preserve the original evidence unaltered, which a hardware write blocker prevents by enforcing read-only access at the block level.

Using the organisation's 'Report Phishing' tool routes the suspicious message to security teams, enabling them to block the sender and warn other recipients. This satisfies the stem's mitigation constraint by preventing further exposure across the organisation, rather than merely protecting the single employee who received it.

Web server access logs record every HTTP request, including POST requests used to upload files. They contain timestamps, source IPs, and request URIs. By examining these logs, an incident responder can pinpoint the exact time a web shell was uploaded, typically via a POST to a vulnerable upload script. This is the most direct source for this information.

Handle, from Sysinternals, enumerates open handles per process, including named mutexes. Running handle.exe with a search string reveals which process holds the mutex, satisfying the requirement to identify the mutex name on the infected host.

The -a switch shows all active connections and listening ports, -n displays addresses and port numbers numerically (avoiding DNS lookups that could alter evidence), and -o includes the owning process ID (PID). This directly provides the mapping between network connections and processes, which is critical for identifying the RAT process. It is a built-in Windows command that does not require additional tools and minimally alters the system state.

The MBR and EFI system partition hold boot code executed before the OS loads, so a rootkit placed there gains persistent pre-OS execution and evades file-system scanning. Registry Run keys and services load later, making them less suitable for boot-time persistence.

Accurate time synchronisation, typically via NTP, ensures timestamps from firewalls, servers and endpoints align on a common clock. Without it, correlating events across disparate log sources during incident documentation becomes unreliable, since drift obscures the true sequence of activity.

A 403 means the server understood the request but refused authorisation, so the directory exists yet access is denied. Repeated hits indicate traversal or unauthorised access attempts being blocked, rather than a missing file or server fault.

Isolating the workstation is the immediate containment step that stops any further command-and-control traffic, lateral movement, or data exfiltration while preserving volatile evidence. This aligns with the incident response lifecycle, where containment follows detection and precedes eradication, and it protects other systems before deeper analysis begins.

XXE injection exploits an XML parser that resolves external entities, typically because entity resolution or DTD processing is left enabled. The flaw is insecure parser configuration, not the XML syntax itself, so hardening the parser disables the attack.

The incident response policy, especially the Rules of Engagement (RoE), defines the scope, authority, and constraints for incident handlers. It specifies what actions are permitted, who can authorize them, and under what conditions evidence may be collected. This document ensures that the handler's actions are legally defensible and aligned with organizational governance, making it the first reference before touching a workstation.

Minimal system impact preserves volatile evidence such as memory-resident artefacts and running processes, which forensic toolkits must capture before they are altered. This criterion directly satisfies the stem's requirement that a first responder choose tools that avoid disturbing the target system during live acquisition, keeping collected data forensically sound and admissible.

A granular exclusion targets only the specific parameter producing false positives, so legitimate sessions pass while the WAF continues inspecting all other traffic. This preserves protection rather than disabling the rule wholesale, satisfying the stem's dual requirement.

Stakeholder and legal counsel sign-off establishes the report as an authoritative, tamper-evident record, confirming findings were reviewed and accepted. Without that formal verification, insurers or courts may treat the document as unverified opinion rather than admissible evidence of the incident.

RAM is the most volatile evidence and is lost when the system is powered off or rebooted. Capturing memory first preserves running processes, network connections, encryption keys, and injected code that may never be written to disk. This aligns with the order of volatility and ensures critical incident artifacts are not destroyed before other collection steps.

Legal and compliance teams must be notified because they own statutory breach-reporting duties, assessing jurisdiction-specific deadlines and regulator obligations. They interpret contractual notification clauses and privacy legislation, determining what the organisation must disclose and when. This satisfies the stem's requirement to identify stakeholders whose remit directly governs breach notification decisions.

A large number of deny events from an internal host to various external IPs on different ports is indicative of port scanning activity. Malware often performs port scanning to discover vulnerable services on remote hosts. Since the workstation should only access a limited set of services, this behavior is anomalous and suggests compromise. The deny events are the firewall blocking the unauthorized scanning attempts.

Blocking propagation ports at the firewall severs the worm's transmission vector, halting lateral spread across the network. This containment action directly satisfies the stem's demand for the most immediate step, since the worm relies on open ports to reach new hosts. Patching or scanning takes longer and lets the infection continue.

A distributed IR team places handling capability at each geographic location while a central coordinator sets policy, standards and oversight. This matches the requirement for localised response with centralised control across a large, globally dispersed organisation, unlike centralised or coordinating structures.

Preserving encrypted samples and volatile memory captures the encryption artefacts and any residual keys or processes before remediation alters them. This satisfies the forensic requirement to secure evidence first, since recovery attempts overwrite memory and destroy indicators needed to identify the ransomware strain and decryption viability.

Attackers often create inbox rules to hide replies, forward messages to external addresses, or delete evidence. These rules can persist even after a password reset, allowing continued data exfiltration or concealment. Removing them is essential to fully contain the compromise and prevent ongoing unauthorized access to email content.

Urgent or threatening language pressuring immediate action is a classic social-engineering indicator, exploiting time pressure to bypass scrutiny. It satisfies the question's requirement for a common phishing indicator, alongside sender-domain anomalies and suspicious links or attachments. Such coercion frequently precedes credential harvesting or malware delivery.

The Services key stores configuration for Windows services, and malware often installs a malicious service here to gain persistence and run with SYSTEM privileges at boot. Reviewing service entries for unusual ImagePath values or recently created services helps identify this common and stealthy persistence mechanism.

Restricting the backup service account's permissions limits what that account can reach, so ransomware running under it cannot delete or encrypt backup repositories. This least-privilege control satisfies the stem's requirement to protect backups from ransomware encryption.

Attacks span tiers, so a payload visible in the WAF may appear only as anomalous queries in the database. Correlating web server, WAF and backend database logs by timestamp and request ID reconstructs the full kill chain, satisfying the need to establish what actually occurred rather than reviewing each source in isolation.

Ransomware families often use specific file extensions for encrypted files, such as .locky, .cerber, or .ryk. These extensions are a key indicator for identifying the family. By examining the extension, the team can quickly narrow down the ransomware variant and check if a known decryption tool exists. This is a standard first step in ransomware identification.

Password-protected archives are commonly used by attackers to evade antivirus scanning, as the contents cannot be inspected without the password. Including the password in the email body allows the recipient to open it, while security tools cannot scan the encrypted file. This is a red flag for malware delivery.