Certified Incident Handler (212-89) (212-89) — Questions 151–206

While investigating a server compromise, you need to ensure the digital evidence collected from the RAID array is admissible in court. What is the most critical requirement for the chain of custody?

You are investigating a compromised Linux host. Using 'tcpdump' to capture traffic on interface eth0 to analyze C2 communication on port 443, which command is most efficient for saving the output to a file for later analysis in Wireshark?

An attacker is bypassing WAF signatures by using Unicode encoding. Which WAF feature must be enabled to normalize the traffic before inspection?

Which tool would you use to perform a live analysis of HTTP traffic and inspect for malicious payloads in real-time?

Which THREE pieces of information should be included in an incident triage report?

Which TWO of the following are recommended when creating a forensic copy of a hard drive?

An incident handler is reviewing an alert from the Endpoint Detection and Response (EDR) system. What is the main goal of the 'Containment' phase?

An email header contains 'X-Forefront-Antispam-Report'. What can an analyst determine from this?

During a suspected ransomware incident, you are using EnCase Endpoint to perform remote triage. You need to collect volatile data without triggering the ransomware's anti-forensic triggers. Which action should you take first to ensure the integrity of evidence?

A department head demands to know the names of the employees involved in an internal data leak. Which policy document defines your obligation to disclose or withhold this information?

What is the primary purpose of a write blocker in a forensic investigation?

Which THREE actions should be avoided during the initial response phase to ensure evidence integrity?

Which documentation is required when transferring physical evidence from a responder to a forensic lab?

You are documenting a post-incident review. Which of the following should be included in the 'Timeline of Events' section?

Which TWO settings in a WAF policy are most effective at mitigating automated bot-driven web attacks?

In the context of the NIST Incident Response Life Cycle, which phase immediately follows the 'Detection and Analysis' phase, specifically focusing on limiting the scope of the compromise?

A first responder is using a 'Live Response' toolkit. What is the main characteristic of these tools?

Which THREE of the following represent critical log sources that should be correlated when investigating a potential network-based exfiltration incident?

What is the purpose of enabling 'Request Body Buffering' on a WAF during incident response?

Which TWO of the following indicators are primary artifacts to look for when investigating potential lateral movement on a Windows network?

You are performing a post-incident review. Which action is the most important to ensure that the 'Lessons Learned' process effectively improves future response capabilities?

Which syslog facility would typically be configured on a network device to send audit logs to a central server?

When an email incident is resolved, why is it necessary to update the organization's blocklist?

Which THREE of the following are legal considerations when handling an incident?

While investigating a breach, you need to verify the integrity of a system file. Which process is correct to ensure the file has not been altered?

Which TWO of the following are safe practices when analyzing a suspicious email?

You are analyzing an email and the URL redirects through multiple shortened link services. What is the recommended way to find the final landing page?

Which TWO of the following activities are considered 'Eradication' steps in the incident response lifecycle?

Which THREE of the following indicators are found in email-based malware delivery?

Which HTTP header is most critical to inspect when identifying the origin of an attack passing through a reverse proxy?

After eradicating a malware infection, you need to ensure the system is hardened against future occurrences. Which action is most effective against fileless malware?

What is the purpose of 'Sandboxing' in email security?

An analyst receives a report of a phishing email. Which email header field is most reliable for verifying the path taken by the email through intermediate mail transfer agents?

You have identified a potential Advanced Persistent Threat (APT) in your network. Which evidence preservation strategy is required to maintain the validity of the logs found in a SIEM?

You suspect a file on a Linux server is malicious. What command can you use to obtain the MD5 hash of the file?

You are configuring a SIEM for long-term storage of investigation logs. Which feature is most important to prevent evidence tampering?

You suspect a CSRF (Cross-Site Request Forgery) attack. What log entry pattern confirms this?

During a malware analysis, which TWO of the following indicators are typically used to identify persistence mechanisms in the Windows registry?

Which TWO of the following steps are considered best practices when performing network forensics on a live environment?

Which THREE of the following are effective network forensics techniques for identifying an attacker's C2 server infrastructure?

When notifying stakeholders during a major data breach, which TWO of the following groups must be informed according to standard incident communication plans to satisfy regulatory and operational needs?

Which THREE of the following items should be included in an email incident report?

When classifying the severity of an incident, which factor should carry the most weight in your decision-making process?

A stakeholder asks you to prioritize the recovery of a compromised system. According to incident response best practices, what is your first responsibility?

You are reviewing logs after an incident. You see a sequence of requests starting with 'admin.php', then 'admin.php?id=1', then 'admin.php?id=1 OR 1=1'. What is the attacker doing?

When dealing with digital evidence in a remote investigation, what is the standard procedure to ensure evidence integrity during network transfer?

Which TWO of the following are essential components of an effective Incident Communication Plan?

Which THREE of the following roles are typically included in an IR team?

An incident handler is analyzing a malware incident that used a phishing email. What is the most important field to check in the email header to determine the true origin of the email?

If a user receives an email with an attachment that is a 'compressed password-protected file', why is this a red flag?

You are establishing an Incident Response Plan (IRP). Which document should prioritize the technical steps for restoring services after a ransomware attack?

Which TWO of the following are valid methods to identify a malicious attachment?

Which TWO actions are recommended for secure evidence storage?

You are reviewing a failed incident case management report. The team failed to capture the 'Time of Detection' vs. 'Time of Occurrence'. Which metric is directly impacted by this lack of documentation?

You suspect a malware incident caused unauthorized data exfiltration. Which log source is most useful to identify the destination IP of the exfiltrated data?

Which document is essential to maintain during a malware incident to ensure accountability and track the actions taken by the incident response team?