Certified Incident Handler (212-89) (212-89) — Questions 226–300

Calculating the hash preserves volatile evidence before the suspicious file in the Temp folder is altered or deleted, satisfying the need to establish integrity for later comparison against threat intelligence. Hashing is non-destructive, so it captures a unique fingerprint without modifying the artefact, unlike opening or executing it.

Data minimisation under GDPR requires limiting collection to what is adequate, relevant and necessary for the investigation. Gathering only logs and artefacts tied to the suspicious activity avoids sweeping unrelated personal data into the incident evidence set.

Event ID 4624 records the originating workstation's IP address in its network information fields. That address is the shared identifier matching the corresponding network flow records in the SIEM, letting the analyst join authentication events to specific traffic.

Beaconing is a hallmark of command-and-control traffic: compromised hosts contact the same external IP at regular intervals to poll for instructions. The predictable periodicity distinguishes it from ordinary browsing and satisfies the stem's request for commonly observed C2 indicators.

The HKLM Run key is one of the most frequently abused autostart locations because entries here execute at system startup for all users, giving malware high-privilege persistence without requiring a scheduled task or service. Inspecting it early reveals obvious load points and often identifies the dropped binary path, which then guides broader scoping and eradication efforts.

WinPmem is a Windows-compatible memory acquisition driver that captures physical RAM to a forensic image without altering running processes. It satisfies the live forensics constraint by preserving volatile evidence on an active workstation before shutdown destroys it.

EDR logs capture endpoint process, file and network telemetry, giving concrete artefacts such as hashes, command lines and C2 addresses for IoC extraction. This satisfies the need for host-level evidence tied to observed malicious activity, unlike policy documents or asset inventories.

Applying security patches can be part of eradication if the malware exploited a vulnerability. Patching the vulnerability removes the initial infection vector and prevents re-infection. It is a proactive step to eliminate the root cause and harden the system against the same attack.

Network connections are highly volatile and can disappear quickly, especially if an attacker closes a backdoor or the connection times out. The netstat -antp command shows active TCP connections, listening ports, and associated processes, which is critical for identifying command-and-control channels. Capturing this before other data aligns with the order of volatility, as network state is more ephemeral than process lists or disk information.

RAM is the most volatile evidence and contains running processes, network connections, and potentially encryption keys. Capturing it first preserves data that would be lost on shutdown or reboot. The responder should use a trusted memory acquisition tool from external media to avoid contamination. This aligns with the order of volatility and ensures that critical evidence is not destroyed by subsequent actions. Memory capture is a foundational step in first response for live systems.

WinPmem is a memory acquisition tool specifically designed for Windows systems. It can capture physical memory (RAM) to a file, preserving volatile data such as running processes and injected code. This makes it ideal for capturing evidence of fileless malware that exists only in memory before the system is shut down.

Cryptographic hashes produce a fixed-length digest of each collected file. Recomputing and comparing hashes later proves the evidence has not been altered, satisfying the stem's evidence-preservation requirement by establishing verifiable integrity for the digital incident investigation.

The netstat -ano command displays all active connections and listening ports, with the -o switch showing the owning process ID and -a showing all connections. This is a native Windows utility that requires no third-party installation, making it ideal for first response when tool deployment is restricted. It provides critical mapping between network activity and processes.

Web server access logs record every HTTP request, including the source IP, URL, user agent, and timestamp. During a DDoS attack, these logs reveal the volume, frequency, and patterns of requests, such as repeated requests to a single endpoint or from a specific IP range. Analyzing them helps identify the attack vectors and potentially the botnet's characteristics, enabling targeted mitigation.

A security intranet portal publishes authoritative advisories that users can revisit, avoiding the risk of a phishing-style email being mistaken for the real alert. It satisfies the stem's requirement for a trusted, verifiable channel during an active phishing incident.

Customer PII breaches trigger statutory notification duties and regulatory exposure, so Legal and Privacy officers must be engaged first to assess obligations under GDPR or similar regimes and direct containment communications. They satisfy the stem's requirement to notify the correct authority before technical or PR teams act.

A detailed access log establishes an unbroken, auditable record of custody, showing who held the RAID evidence at every point and preventing gaps that would let a court challenge its integrity. This directly satisfies the admissibility requirement by proving the evidence was never tampered with.

Masquerading involves disguising a malicious file as a legitimate or benign one. Using a double extension like 'invoice.pdf.exe' exploits the default Windows setting that hides known file extensions, making the file appear as a PDF document. This is a classic masquerading technique to trick users into executing malware. It is a specific type of deception focused on file appearance.

The -w flag correctly writes the captured traffic to a file.

Unicode encoding lets attackers disguise malicious payloads so signature matching fails. Enabling UTF-8/Unicode normalization converts encoded characters into their canonical form before the WAF inspects traffic, restoring signature detection and satisfying the stem's requirement to normalise requests prior to inspection.

Wireshark captures packets directly from a network interface in promiscuous mode, decoding HTTP requests and responses on the fly. This satisfies the real-time inspection constraint, letting you examine payload contents as traffic traverses the wire rather than relying on logs or offline capture files.

This directly addresses the information disclosure by separating what the user sees from what the developers need. Generic client-facing messages prevent attackers from learning internal paths, query structures, and framework versions, while server-side logging preserves the diagnostic detail. It is the standard secure error handling practice for production web applications.

Recording the date and time of incident discovery establishes the authoritative timeline anchor for the triage report. It supports containment decisions, regulatory notification deadlines and later forensic reconstruction, giving responders a precise reference point for measuring detection and response intervals.

A physical write-blocker sits between the suspect drive and the forensic workstation, blocking write commands at the hardware level so the source disk cannot be altered during imaging. This satisfies the stem's requirement to preserve evidential integrity, unlike software blockers that depend on the operating system correctly honouring them.

Blind SQL injection (boolean-based) occurs when the application does not return database results or errors, but the attacker can still infer data by sending queries that cause the application to behave differently based on whether a condition is true or false. By observing these differences, the attacker can extract information one bit at a time.

Containment focuses on stopping the spread of an active threat by isolating affected systems, disabling compromised accounts or blocking malicious traffic. This limits the scope and damage while preserving evidence, allowing subsequent eradication and recovery phases to proceed safely.

The X-Forefront-Antispam-Report header is inserted by Exchange Online Protection, Microsoft's cloud filtering engine, during mail flow. Its presence confirms the message passed through Microsoft 365's anti-spam and anti-malware pipeline, letting the analyst verify Microsoft's filtering scanned it rather than a third-party gateway.

XXE attacks target XML parsers that process user-supplied XML. If the parser is configured to resolve external entities, an attacker can include malicious entity definitions to read local files, perform SSRF, or cause denial of service. The parser is the initial component that interprets the malicious XML, making it the primary target.

Blocking outbound traffic to the C2 server's IP address on the specific port prevents the compromised system from communicating with the C2 server. This effectively stops data exfiltration and further command execution. It is the most direct and immediate action to sever the connection at the network perimeter.

A write blocker intercepts write commands at the hardware interface, allowing the examiner to read the drive while physically preventing any modification. This preserves the source media's integrity, satisfying the forensic requirement that evidence remain unaltered and admissible.

Escalation is driven by business impact and severity. When a critical system is affected and operations may be disrupted, management must be informed promptly to authorize resources, communicate with stakeholders, and make risk-based decisions. This aligns with the incident handling process, where escalation criteria are defined by impact, scope, and urgency rather than technical details alone.

Applying patches addresses the vulnerability that allowed the incident to occur. It is an eradication activity because it removes the root cause and prevents future exploitation. Patching is essential to ensure that the threat cannot re-enter through the same vector, thereby completing the eradication process.

The netstat -ano command lists all active connections with their numeric addresses, ports, and owning process IDs (PIDs). By matching the PID to a process in Task Manager or tasklist, the handler can identify which executable is connecting to the external IP. This is a fast, built-in method for correlating network activity with processes during a live malware investigation.

A Chain of Custody form records each transfer, handler, date and purpose, preserving evidence integrity and admissibility. It satisfies the scenario's requirement to document the handover from responder to forensic lab, ensuring an unbroken, auditable trail that courts accept.

Isolating a compromised host by disabling its switch port stops the attacker from moving laterally or exfiltrating additional data while preserving the system state for analysis. This is a textbook containment action because it limits damage and buys the team time. It is deliberately not a recovery step, since the system remains quarantined and unavailable to users until eradication and restoration are complete.

A timeline requires chronological sequencing, so recording detection, analysis, and containment in the order they occurred directly satisfies that constraint. This ordering lets reviewers reconstruct how quickly each phase followed the last, exposing delays between detection and containment that a thematic or severity-based grouping would obscure.

Mailbox auditing records New-InboxRule and Set-InboxRule events with the rule parameters, actor, and timestamp, and these records persist independently of the Outlook client. Because the attacker can remove the rule from the interface but cannot purge the audit trail, this is the authoritative source for proving the rule existed and identifying the compromised session.

A CAPTCHA challenge forces the client to solve a human-solvable puzzle, breaking the automation loop that scripted bots rely on. This satisfies the need to mitigate automated bot-driven attacks by distinguishing human sessions from programmatic requests at the WAF.

File inclusion attacks often use directory traversal to access files outside the web root. A log entry showing traversal sequences directly indicates an attempt to exploit a file inclusion vulnerability. This is the most direct evidence because it captures the malicious input in the request URI, which is typically logged in access logs.

Containment immediately follows Detection and Analysis in the NIST Incident Response Life Cycle, focusing on limiting the scope and impact of the compromise before eradication and recovery begin. It directly addresses the stem's requirement to limit the compromise's spread.

Live Response toolkits execute from external media such as a USB drive, keeping binaries and writes off the target's internal disk. This preserves volatile evidence and disk integrity, satisfying the first responder's need to investigate a running system with minimal alteration before full forensic imaging.

DNS query logs reveal domain lookups made by internal hosts, exposing contact with command-and-control or exfiltration domains. Correlating them with flow and proxy logs identifies which host resolved a suspicious destination, a critical pivot during network exfiltration investigations.

Request body buffering makes the WAF hold the complete HTTP request body before inspection, rather than streaming it. This lets the engine examine the entire payload for malicious content, satisfying the requirement to detect attacks hidden deeper in the body during incident response.

Blocking the external IP at the perimeter firewall severs the connection to the suspected malicious endpoint, preventing further data exfiltration or command-and-control. This is a targeted containment measure that can be implemented quickly without disrupting the internal network. It also allows the responder to continue monitoring the internal server for other outbound connections.

Documenting the root cause converts the incident into evidence, and defining specific, actionable process changes turns that evidence into revised procedures, runbooks and controls. Without concrete changes, the review produces observations only, so future response capability does not actually improve.

Eradication involves removing the cause of the incident, such as malware, and addressing vulnerabilities that allowed it. Applying patches and updating antivirus signatures helps eliminate the malware and prevent reinfection. This is a core eradication activity, ensuring that the threat is fully removed and the system is hardened before recovery. It directly addresses the root cause and is essential for restoring a trusted state.

DMARC combines SPF and DKIM results and applies alignment against the visible From domain. A DMARC pass means either SPF or DKIM aligned with the domain in the From header, which directly answers whether the vendor's domain authorized the message. Checking the DMARC result first therefore gives the handler the most reliable indication of sender authorization in this wire-transfer scenario.

Network devices commonly use the local0 through local7 facilities for custom log destinations, since these are reserved for local use and avoid clashing with system facilities like auth or daemon. Configuring local0 lets the device forward audit logs to the central syslog server without conflicting with standard facility assignments.

Updating the blocklist adds the sender addresses, domains, or subject patterns tied to the resolved campaign, so future messages matching those indicators are filtered automatically. This directly satisfies the stem's requirement of preventing the same campaign from recurring, rather than merely documenting the incident after closure.

Breach notification statutes impose mandatory timelines and reporting thresholds that vary by jurisdiction, so incident handlers must identify and meet each applicable requirement. This is a legal obligation, satisfying the question's call for legal considerations.

A SHA-256 hash produces a fixed-length digest of the file's contents; any alteration changes the digest entirely. Comparing the computed value against a trusted baseline proves integrity, unlike timestamps or file size, which an attacker can preserve.

Photographing the screen and peripherals documents the current state of the system without altering it. This is a non-intrusive way to capture volatile evidence such as open applications, error messages, and network activity. It is a fundamental first step in first response, ensuring that visual context is preserved before any further actions that might change the system state.

Isolating the analysis environment prevents malicious payloads—macros, exploit documents or beaconing malware—from reaching production systems or contacting command-and-control infrastructure. Sandboxing or an air-gapped virtual machine satisfies the stem's safe-practise requirement by containing any execution during inspection, so the analyst can examine headers, attachments and URLs without risking the corporate network.

A URL unshortening service resolves each redirect hop server-side, revealing the final landing page without exposing your own host to the destination. This satisfies the stem's requirement to trace a chain of multiple shortened links safely, since manually following each hop risks drive-by compromise or geolocation-based cloaking.

Re-imaging infected workstations removes the root cause by rebuilding the compromised host from a trusted image, eliminating malware, persistence mechanisms and unauthorised changes. This satisfies eradication's goal of eliminating the threat before recovery, rather than merely containing or documenting the incident.

Embedded hyperlinks whose anchor text or display differs from the actual href target conceal the true destination, directing recipients to attacker-controlled domains. This obfuscation is a hallmark of phishing and malware delivery, satisfying the question's requirement for an email-based delivery indicator.

Constrained Language Mode restricts PowerShell to a safe subset, blocking the .NET reflection and dynamic invocation APIs that fileless malware abuses to run in memory. This hardening prevents script-based payloads from executing without touching disk.

olevba is a specialized tool for parsing OLE files and extracting VBA macros from Office documents. It can display macro source code, detect suspicious keywords, and identify obfuscation techniques without executing the macro, making it ideal for static analysis in incident response.

Sandboxing detonates suspicious attachments and URLs in an isolated virtual environment, letting analysts observe runtime behaviour such as file writes, registry changes and network callbacks. This satisfies the stem's requirement to safely execute and observe file behaviour, catching zero-day malware that signature-based filtering misses.

Received headers are prepended by each mail transfer agent as the message traverses the path, so their sequence records the actual hops taken; unlike From or Return-Path, they are added by servers rather than supplied by the sender.

Applying a cryptographic hash (for example SHA-256) to exported logs creates a verifiable integrity baseline, proving the SIEM data has not been altered since collection. This satisfies the stem's requirement for evidence preservation, because any tampering during forensic handling becomes detectable, keeping the logs admissible and forensically sound.

md5sum computes the MD5 message digest of the specified file and prints the 128-bit hash alongside the filename, giving an integrity value for comparison against known-good or threat-intelligence hashes. It is a standard coreutils utility present on virtually all Linux distributions.

Network-level isolation stops lateral spread and re-infection communications while the host remains live for memory capture and persistence hunting. Examining autostart, scheduled task, and service locations identifies how the ransomware re-establishes itself. This satisfies containment by limiting impact without destroying the evidence needed to find the root cause, and it keeps the option of full eradication once the mechanism is understood.

Comparing current system state against a documented baseline reveals unauthorized autostart entries, rogue services, suspicious scheduled tasks, and unexpected processes. This manual validation catches persistence mechanisms that signature-based tools may miss. It directly addresses the need to confirm eradication before returning the server to production and supports accountability in the incident response process.

WORM media physically prevents modification or deletion after writing, directly satisfying the evidence-integrity requirement for long-term investigation log retention. Unlike standard storage, where administrators or attackers could alter records, WORM enforces immutability at the hardware or firmware level, preserving forensic admissibility across the entire retention period.

CSRF exploits a victim's authenticated session from a foreign origin, so the forged request carries a Referer pointing to an attacker-controlled domain rather than the application's own. That cross-domain mismatch is the confirming signature in the logs.

The Services registry key under CurrentControlSet stores service definitions, including auto-start entries that malware abuses to launch at boot. Its presence in this hive is a recognised persistence indicator, satisfying the question's request for a registry-based persistence location.

A documented chain of custody records who handled each PCAP, when, and how, preserving evidential integrity so findings remain admissible. This satisfies the live-forensics requirement that collected packet captures be verifiable and untampered throughout investigation and any subsequent legal proceedings.

Reverse DNS maps a destination IP back to a registered hostname via PTR records, often exposing provider-assigned names or compromised domains tied to C2 infrastructure. This satisfies the stem's identification goal by correlating observed traffic destinations with naming that direct forward lookups would miss.

Legal Counsel or the Privacy Officer must be informed to assess notification duties under data protection law, manage regulator and affected-party communication, and limit liability. This satisfies the regulatory element of the stem's incident communication requirements.

A chronological timeline establishes the sequence of events from initial detection through containment and recovery, letting investigators reconstruct what happened and when. It satisfies the reporting requirement for an accurate, ordered account of the incident's progression.

Severity reflects consequence, so business availability and data integrity weigh heaviest: they determine operational and regulatory harm. Detection source or attacker identity says little about actual damage, making impact the decisive axis for prioritising response.

Before containment, eradication or recovery, the responder must verify that an incident actually occurred, distinguishing genuine compromise from false positives. Confirming the incident satisfies the stem's requirement to prioritise recovery only after validation, per incident response best practice.

The progression from a plain page request to appending a numeric parameter, then a boolean tautology, shows systematic probing of the id parameter for improper input handling. The 'OR 1=1' payload is a classic SQL injection test, confirming the attacker is enumerating injection flaws.

Encrypting the transfer channel prevents interception or tampering in transit, while destination-side hash verification confirms the copy matches the source bit-for-bit. Together they preserve evidence integrity and chain of custody across the network, which the remote scenario demands.