Certified Incident Handler (212-89) (212-89) — Questions 151–225

Triage is the first activity in the incident handling process after detection: the analyst correlates the alert with other telemetry (proxy logs, EDR process trees, DNS logs) to confirm whether the C2 contact is real. Only after validation should the analyst classify severity and escalate. This avoids unnecessary wake-ups while still ensuring genuine incidents are escalated quickly.

A legal hold overrides routine lifecycle rules, so automatic deletion must be suspended for the affected data. This preserves potentially relevant evidence until the investigation concludes, satisfying the retention obligation without altering the wider policy.

Insecure deserialization occurs when untrusted data is used to abuse the logic of an application, inflict a denial-of-service attack, or execute arbitrary code. Here, the serialized object in a cookie was deserialized, leading to remote code execution (spawning a shell), which is a classic indicator of this vulnerability.

The email passed SPF but failed DMARC alignment, indicating a spoofed sender. Quarantining prevents further spread, and verifying via a separate channel (e.g., phone call) confirms the legitimacy of the request. This aligns with incident handling best practices for suspected business email compromise.

SMB ransomware propagation uses TCP 445, so ACLs blocking that port between segments halt lateral spread while leaving other traffic intact. This directly satisfies the containment constraint by severing the specific channel the infected host exploits.

This is correct because the DKIM-Signature header contains the cryptographic signature that covers specified headers and the body. Verifying this signature confirms the message was not altered in transit and was sent by an authorized server for the domain. In an incident investigation, a valid DKIM signature helps rule out content tampering, while a failed or missing signature raises suspicion.

Preserving the stored payload and its database context is essential for understanding the injection point, identifying the affected records, and supporting later analysis or legal action. Removing the content first would destroy evidence of how the attacker bypassed input validation and what other data may have been tampered with.

The double extension exploits Windows' default behaviour of hiding known file extensions, so 'invoice.pdf.exe' displays as 'invoice.pdf' in Explorer. The executable extension remains .exe, meaning the attachment runs code rather than opening as a document — satisfying the stem's suspicious-attachment indicator.

The post-incident review, often called lessons learned, aims to evaluate the response, identify what worked and what did not, and update policies, procedures, and training. This continuous improvement is the primary purpose of the phase, ensuring the organization is better prepared for future incidents.

Trunk ports carry traffic for multiple VLANs, so an unrecognised trunk enabled on an access switch lets an attacker reach other VLANs, bypassing segmentation. This unauthorised configuration change is a strong indicator that the switch has been compromised.

Chain of custody requires documented verification that evidence remained unaltered between collection, transport and storage. Tamper checks, such as sealed containers and hash validation, prove integrity, ensuring the evidence stays admissible in legal or disciplinary proceedings.

Physically unplugging the cable severs all network communication instantly, satisfying immediate isolation, while the workstation stays powered so volatile memory and running processes remain intact for later forensic capture. Wireless or software-based blocking risks missing alternate paths or triggering shutdown.

Application logs often record when input fails validation or when suspicious characters are detected. If the application has input sanitization or a web application firewall (WAF) in logging mode, it may log the XSS attempt. These logs provide context about whether the payload was blocked or allowed, and can help identify the specific parameter targeted.

The session ID or cookie value is the unique token identifying a user's authenticated session. Correlating this value across web server, proxy and application logs lets analysts follow the attacker's requests after the token is stolen, satisfying the requirement to track the hijacked session across multiple sources.

Isolation severs the compromised segment's Layer 2 and Layer 3 connectivity, preventing lateral movement to healthy subnets while the incident is investigated. This directly satisfies the containment requirement by limiting blast radius, and is a recognised key component alongside traffic filtering and endpoint quarantine in network-based containment strategies.

The netstat -ano command displays all active TCP and UDP connections, listening ports, and the owning process ID (PID) for each connection. This is exactly what the responder needs to correlate network activity with running processes. The -a shows all connections, -n displays addresses numerically, and -o gives the PID. This output is volatile and should be saved to external media for later analysis. It is a standard first response command on Windows systems.

When script block logging is enabled, PowerShell writes event ID 4104 to the Microsoft-Windows-PowerShell/Operational log, capturing the actual script text after decoding. This reveals the deobfuscated command and any embedded URL, even though the process has exited, making it the most reliable artifact for reconstructing the fileless execution chain.

Unusual or unauthorised access patterns indicate possible compromise, such as credential misuse or lateral movement, which warrants declaring an incident so containment and investigation can begin. This satisfies the criterion of a security-relevant anomaly deviating from normal baseline behaviour.

ICMP tunneling involves encapsulating data within ICMP echo requests and replies, often using oversized payloads to carry stolen data. A sudden spike in ICMP traffic with consistently large payloads to an external IP is a strong indicator of this technique. Attackers use ICMP tunneling to bypass firewalls that allow ping, making it a stealthy exfiltration method.

Capturing volatile data first preserves process lists, network connections, loaded modules, and browser extension details that disappear on reboot or cleanup. This evidence lets the handler identify the adware family, its persistence mechanism, and any command-and-control endpoints, which informs scoping and ensures eradication is complete rather than superficial.

Process Explorer integrates a VirusTotal lookup: selecting the process and choosing Options > Check VirusTotal submits the executable's hash to the service and returns its reputation, letting you assess the file before isolating the host.

IDS and SIEM systems continuously correlate network and host telemetry against known attack signatures and behavioural baselines, generating alerts when activity deviates. This directly satisfies the stem's requirement for a common incident identification source, since these platforms are purpose-built to surface potential security events for analyst triage.

PEview parses the Portable Executable structure and displays section headers, letting the analyst spot anomalies such as non-standard section names, high entropy, or unusual raw sizes that indicate packing. It directly addresses the need to inspect section headers.

PowerShell Remoting executes commands through the PowerShell engine, which writes script block and command invocation events to the Microsoft-Windows-PowerShell/Operational log. Event ID 4104 records the actual script content executed remotely, confirming command execution that WinRM transport logs alone cannot show.

An unbroken, documented access log proves the evidence was continuously controlled and untampered from seizure onward. This documented chain satisfies the admissibility requirement by letting the court verify integrity, defeating challenges that the device was altered or substituted.

A hard disk drive retains its stored data when power is removed, unlike RAM or cache, which lose contents on shutdown. This persistence satisfies the question's requirement for a non-volatile source, making it the appropriate example of storage that survives power loss.

A bit-stream image captures an exact, write-blocked replica of the storage media, preserving the original evidence intact for forensic examination and admissibility. Analysing the copy rather than the source minimises downtime on the suspect's live system while maintaining evidential integrity.

When a legitimate account is compromised, the attacker sends from the real mailbox and infrastructure, so SPF, DKIM, and DMARC all pass. The fraudulent banking request and the HTML attachment are content-level indicators, so the handler should treat it as a business email compromise and verify with the vendor through a separate channel.

Correlation joins discrete alerts sharing entities, timelines or indicators into a single narrative, exposing the sequence of attacker actions across otherwise isolated sources. That linkage directly satisfies the stem's investigative goal: revealing attack progression rather than reviewing unrelated events individually, so analysts can reconstruct the intrusion chain.

Forensic images must remain unaltered to retain evidentiary value, so the storage must enforce write-protection preventing modification and tamper-evident logging recording any access attempt. This preserves integrity and chain of custody, satisfying the requirement that the image be admissible and verifiable.

Event ID 5140 is generated when a network share is accessed. It records the share name, the account used, and the source IP address. In the context of suspected SMB lateral movement, a burst of 5140 events for administrative shares like ADMIN$ or C$ from a single workstation to multiple servers is a direct indicator of an attacker enumerating and accessing remote shares. This event provides concrete evidence of the lateral movement attempt.

DNS tunneling involves encoding data within DNS queries and responses, often using TCP port 53 for larger transfers. A large outbound data transfer to an external IP over TCP port 53 is a strong indicator of DNS tunneling, as legitimate DNS traffic is typically small and uses UDP. Attackers use this method to bypass firewalls that allow DNS traffic.

Shell metacharacters ';', '|', '&' and '`' allow command chaining, piping and substitution, so their appearance in Apache access logs signals attempted OS command injection. Searching for these satisfies the audit requirement to detect injection attempts against web-facing services.

Security Groups act as stateful virtual firewalls at the instance's elastic network interface, so restricting all inbound and outbound rules immediately severs the EC2 instance's traffic without terminating it — satisfying the containment requirement while preserving forensic state.

This is correct because submitting the file hash to a threat intelligence platform allows the responder to check if the file has been previously identified, what family it belongs to, and whether it is associated with known campaigns. This provides reputation data and helps determine if the incident is part of a broader attack, guiding containment and remediation efforts.

A phishing reporter needs clear, factual guidance without alarm or blame, so they understand what happened and what to do next. A professional, calm, informative tone preserves trust and encourages prompt reporting of future attempts.

Combining tcp.port == 3389 with ip.src == 192.168.1.50 restricts capture to RDP sessions originating from the suspect workstation, filtering out unrelated port 3389 traffic. This isolates the lateral-movement flow toward the domain controller for credential-dumping analysis.

Error logs capture the server-side exception trace for each failed request, letting you correlate the affected user's 500 responses and identify whether a misconfiguration, bug or attack caused them. This is the first diagnostic step before classifying the event as a security incident.

The single-character difference in the From domain is a classic look-alike domain technique used to deceive recipients. Even though SPF and DKIM passed for the partner's domain, those results do not apply to the look-alike domain in the visible From address. The handler should treat the message as suspicious, analyze the link, and check DMARC alignment for the look-alike domain to confirm the spoofing attempt.

netstat -ano lists active connections with their owning process ID, letting you correlate the foreign IP connection to the exact process. This maps network activity to a PID, which you then resolve to an executable, directly identifying the initiating process.

A WAF rule matching the offending User-Agent header drops those requests at the edge before they reach the application, directly satisfying the requirement to block the scanner. It is precise and low-cost, though the attacker could rotate the string, so pair it with rate-based rules.

Session fixation succeeds when the attacker plants a known session identifier and the victim's authentication does not regenerate it. An unchanged session ID across the login boundary therefore evidences the flaw; legitimate implementations issue a fresh identifier upon successful authentication.

A high volume of TCP SYN packets across many ports indicates port scanning, the primary network-discovery technique. The half-open SYN sweep maps listening services without completing handshakes, directly satisfying the stem's requirement for a network-based indicator of discovery activity.

Lessons Learned converts findings into durable change. Revising policies, procedures and controls addresses the root causes identified during the review, reducing the likelihood of the same incident recurring and satisfying the phase's forward-looking remediation objective.

Clearly defined roles and responsibilities ensure that team members know what is expected of them during an incident. This prevents confusion, avoids duplication of effort, and speeds up response. It is a fundamental component of any incident response plan, as it establishes accountability and streamlines coordination. Without it, response efforts can become chaotic, leading to delays and potential mistakes.

Database user activity and audit logs record executed statements, timestamps, source accounts and client addresses, exposing the injected query and the compromised credentials. Reviewing them reconstructs which accounts ran anomalous SQL, satisfying the need to identify the injection vector and affected data during the SQL injection response.

The repeated SYN packets to a single port on multiple external IPs, with no completed handshake, is classic TCP SYN scanning behavior. An incident handler identifies this as reconnaissance or an attempt to find an open service. The lack of response is expected because the scanner is probing many hosts, and the consistent destination port suggests a targeted service discovery.

Real-time logging preserves the exact sequence and timestamps of containment, escalation and recovery actions while they occur. That chronological record underpins the final incident report, supports root-cause analysis, and provides defensible evidence, satisfying the stem's need for an accurate timeline.

Enumerating every recipient of the same message defines the true scope and reveals endpoints that may already be compromised. Without this step, containment is based on guesswork and additional executions can occur on machines the handler did not know received the message.

Legally defensible chain of custody requires each transfer to record who released the evidence, who received it, the exact date and time, and where it was stored. These four elements let a court trace unbroken possession from seizure to presentation.

The X-Forwarded-For header preserves the originating client IP address, which the load balancer would otherwise mask by rewriting the source to its own address. This satisfies the stem's need to trace an attack's true source through the proxy layer.

The arp -a command displays the local ARP cache, listing IP-to-MAC mappings for recently contacted hosts. Inspecting these entries reveals duplicate or conflicting MAC addresses indicative of ARP spoofing on the local segment, satisfying the responder's need.

Forwarding to an external address directly evidences the attacker-created inbox rule, which silently redirects mail outside the organisation. This satisfies the stem's requirement for a symptom, since the unauthorised external recipient is the observable artefact of the rule, unlike mailbox quota or login anomalies.

Firewall and proxy logs contain detailed records of network connections, including source and destination IP addresses, ports, and timestamps. When aggregated in a SIEM, they enable correlation across multiple systems to identify all hosts that communicated with the C2 server. This provides a comprehensive view of the incident scope, allowing the analyst to quickly isolate other compromised endpoints. It is the most effective data source for network-based correlation during the identification phase.

Repeated requests for files such as 'passwd' or 'config.php' reveal an attacker probing outside the web root, satisfying the indicator of directory traversal. Traversal payloads commonly target these credential and configuration files, so their recurrence in a web access log signals deliberate path-escalation attempts rather than normal browsing.

The request parameter contains SQL syntax that alters the intended query, and the database log confirms the injected UNION statement executed and returned data. This is the defining behavior of SQL injection, where untrusted input is concatenated into a query without proper parameterization. The evidence directly confirms successful exploitation and data retrieval from the users table.

Containment succeeds only if the worm stops propagating, so the rate of new successful infections measures residual spread directly. Hosts cleaned or segments isolated are outputs, but this metric captures whether the strategy actually halts transmission across the network.

Rootkits often replace or trojanise system binaries, so hashing critical executables and comparing against a trusted baseline reveals tampering. This satisfies the need to gather evidence of intercepted system calls without altering the compromised host.

An overly permissive SPF record, such as one ending in `+all` or including wide CIDR ranges, authorises IP addresses beyond the organisation's legitimate senders. This satisfies the stem's constraint: mail passed SPF yet originated from an unauthorised IP, because that address fell within the record's authorised scope. Tightening the mechanism to `-all` and specific hosts prevents this.

The scenario states the exfiltration occurs through HTTP responses from the deserialization endpoint, and the payloads are base64-encoded. Filtering for successful responses to that endpoint isolates the relevant traffic, and decoding the base64 fields reveals the exfiltrated content. This directly follows the described attack channel and encoding.

Using a statically linked toolkit on read-only media ensures the tools you execute are not the potentially trojanized system binaries. Comparing outputs reveals discrepancies that indicate userland rootkit tampering, while the read-only medium guarantees your collection tools cannot be altered by the compromised host during the response.

The condition section with the OR operator evaluates both string identifiers, matching the file when either $a or $b is found. This satisfies the requirement to detect files containing the hex string or the string value.

PowerShell and similar built-in administrative tools write to event logs, prefetch, and command history, altering the target system's state and overwriting volatile evidence. This satisfies the stem's remote-agent constraint by showing that such tools compromise forensic integrity through unavoidable artefacts on the machine being examined.

LiME is a loadable kernel module designed for volatile memory acquisition on Linux. It allows capturing memory to a file or over the network without requiring a system reboot, minimizing disruption to running services. It is a widely accepted tool in incident response for live memory forensics, ensuring evidence integrity and minimal impact.

Because the cookie lacks HttpOnly, injected JavaScript can read document.cookie and send it to an external collector, often as a query string or image request. Egress proxy or firewall logs capture the destination domain and full URL, so they can reveal the exfiltration channel and the encoded cookie value, which is the key evidence needed to confirm theft.

A malicious URL embedded in the email body is a concrete, observable artefact indicating compromise intent, letting analysts block the domain and trace related messages. It qualifies as a host or network-based IOC within email incident triage.

Volatile data in RAM, including running processes, network connections, and possibly encryption keys, will be lost on shutdown or reboot. Capturing a live memory dump first preserves this evidence while the machine is still powered on. This aligns with the order of volatility principle and supports later malware analysis and potential decryption.

Listing potentially affected data or databases satisfies the stem's requirement to document breach scope, enabling impact assessment and notification duties. An incident report must identify which records the SQL injection exposed, since containment and regulatory escalation depend on knowing the compromised data sets, not merely the attack vector.

The primary objective of a lessons learned meeting is to review the incident and response to identify what worked well and what needs improvement. This includes updating policies, procedures, and training to prevent similar incidents. It is a constructive, forward-looking activity that enhances the organization's resilience and response capabilities.

An HTTP flood is a type of denial-of-service attack where the attacker sends many HTTP requests to overwhelm the server. The requests often target resource-intensive functions like search, with complex query strings to maximize CPU usage. The observed CPU spike and high volume of requests to a search function are classic signs of an HTTP flood.

A vulnerability scan verifies that the restored systems contain no residual exploitable weaknesses, such as unpatched software the malware leveraged, before they are reconnected to production. This confirms the environment is safe and prevents immediate reinfection during recovery.

DNS tunnelling encodes exfiltrated data into query names, producing subdomains far longer than legitimate hostnames and with high entropy from base64 or hex encoding. This pattern distinguishes tunnelling from normal recursive lookups, which resolve short, dictionary-like names.

Normalizing to a common time zone (typically UTC) and recording each system's clock offset allows the handler to correlate events accurately and defend the timeline. This method acknowledges discrepancies and provides transparency, which is essential for forensic soundness and potential legal proceedings. It does not require altering original evidence, preserving integrity.

The AutoOpen macro combined with a remote template URL is the signature of remote template injection, where a benign-looking document loads a malicious template from an attacker-controlled server, delivering macro code without embedding it in the original file. The '~$' lock file confirms an active Word session and is consistent with this document-based delivery technique.

Resetting the password and revoking active sessions immediately terminates the attacker's authenticated access, satisfying the containment requirement. Password reset alone leaves stolen tokens valid, so session invalidation is essential to stop ongoing exfiltration through the compromised account.