Certified Incident Handler (212-89) (212-89) — Questions 301–321

A current contact list for internal and external stakeholders is essential because the plan's notification and escalation duties depend on reaching the right parties quickly. Without accurate details, escalation paths stall and regulatory or customer notifications breach mandated timelines, directly undermining the communication plan's purpose during an incident.

Human Resources participates in IR teams because incidents often involve insider threats, employee misconduct or disciplinary and legal consequences. HR advises on privacy, employment law and staff communications, satisfying the stem's expectation that a typical IR team spans technical, legal and organisational functions rather than engineers alone.

X-Forwarded-For is the de facto standard header used by proxies to convey the originating IP address of a client. When a reverse proxy forwards a request, it appends the client IP to this header. Inspecting it in the web server logs allows you to trace back to the true source, provided the proxy is configured to pass it and the logs capture it.

In a production environment where downtime is unacceptable, the memory acquisition tool must be stable and not cause a system crash. A crash would not only disrupt services but also destroy the volatile evidence. Tools that operate in kernel mode or use specialized drivers must be thoroughly tested to ensure they do not conflict with existing software. This factor is paramount to balance forensic needs with operational continuity.

The Received header records each mail transfer agent hop, with the originating server listed bottom-up. Examining these entries reveals the true sending IP and relay path, which the From header can spoof, making it the key field for tracing origin.

The Cookie header carries the session identifier (e.g., JSESSIONID, PHPSESSID) that the server uses to associate a request with an authenticated session. By examining this header in the access logs, you can pinpoint the exact token used by the attacker, compare it with the legitimate user's token, and confirm session hijacking. This is the most direct evidence of session token reuse in web application incidents.

Password-protected archives block gateway inspection because the scanner cannot derive the decryption key, so antivirus and sandbox engines see only ciphertext. This directly satisfies the stem's constraint: the attachment evades content scanning, letting malware reach the user's endpoint unchecked while appearing as a routine compressed file.

A playbook provides specific, repeatable steps for handling a defined incident type.

Detonating the attachment in an isolated sandbox observes its actual runtime behaviour, such as process creation, registry writes or outbound connections, revealing malicious intent that static signatures miss. This satisfies the stem's requirement for a valid identification method.

Disassembling the encryption routine allows the handler to see the exact cryptographic APIs and constants used, such as AES, RSA, or Salsa20. By examining the code flow and calls to Windows CryptoAPI or custom implementations, the algorithm can be identified with high confidence. This is the most direct and reliable method to determine the encryption algorithm and assess potential weaknesses.

The arp -a command displays the current ARP cache, listing IP addresses and their corresponding physical (MAC) addresses. This is essential for identifying potential ARP spoofing or mapping network segments during an incident. On a compromised Windows server, capturing the ARP cache before reboot preserves evidence of local network relationships and possible attacker presence. It directly answers the requirement.

The netstat -antp command displays all TCP connections with numeric addresses, listening ports, and the associated process IDs. On a live Linux system, this captures the current network state, including established connections that may indicate command-and-control or exfiltration channels. The -p flag requires root privileges but provides the critical mapping to the responsible process. This output is volatile and must be saved to external media immediately, as it will change as connections open and close.

RAM is the most volatile evidence and contains running processes, network connections, encryption keys, and injected code that vanish when power is lost. Capturing memory first preserves this ephemeral data before any other action alters it. The supervisor's instruction aligns with the order of volatility, which prioritizes CPU registers and cache, then RAM, before less volatile storage. A memory image also enables later timeline and malware analysis.

SPF, DKIM, and DMARC validate the sending domain, not the display name. A newly registered lookalike domain can publish its own valid SPF, DKIM, and DMARC records, causing all checks to pass for that domain. Because the display name is what users see, the message can pass authentication while still impersonating the CEO, which is the core BEC technique.

A locked cabinet with access control physically restricts who can reach the evidence, preventing tampering or theft. This satisfies the chain-of-custody and integrity requirements for secure evidence storage by limiting access to authorised personnel only.

MTTD measures elapsed time between an incident's occurrence and its detection. Without documented Time of Occurrence and Time of Detection, that interval cannot be calculated, so the metric is directly undermined. Other metrics, such as MTTR, depend on response and recovery timestamps instead.

Disabling the task halts the recurring execution of the masquerading binary without destroying the running process or its volatile memory, and the subsequent memory capture preserves injected code, network sockets, and encryption keys that would be lost on reboot. This satisfies containment while retaining evidence needed for root-cause analysis and scope determination.

This approach preserves the original artifact for analysis, captures volatile evidence such as running processes and network connections that would be lost on reboot, and contains the threat by preventing execution and inbound access. It follows the incident handling sequence of identification, containment, and evidence preservation before eradication.

Firewall logs record permitted outbound connections with source, destination IP and port, so they reveal which external address received the exfiltrated traffic. Host-based logs show local activity but rarely the external destination, and application logs lack network detail.

An incident log records each action, timestamp and decision taken by the response team during the malware incident, providing the chronological audit trail needed to demonstrate accountability and support later review or legal proceedings. It satisfies the stem's accountability and action-tracking requirement.

Capturing a memory image is the highest priority because RAM contents are lost upon power-off or reboot. This step preserves running processes, encryption keys, and network connections that are critical for understanding the incident. It should be done before any other collection to avoid losing volatile data. Using a validated tool ensures the image is forensically sound and can be analyzed later.