scenario questions

You are a first responder dispatched to a compromised Windows 10 workstation. The system is still powered on and the user is logged in. Before isolating the machine from the network, you need to capture the current state of active network connections and the processes that own them. Which command should you run first?

During the containment phase of a ransomware incident, you must decide whether to disconnect the infected host from the network or keep it connected for monitoring. The host is encrypting files on a shared network drive. Which action should you take FIRST to limit the spread while preserving evidence?

During the lessons learned phase of a P1 incident, you notice that the incident handling policy failed to define clear 'Rules of Engagement' for containment, leading to accidental service disruption. Which document should be updated to address this deficiency?

You are the first responder assigned to a suspected insider data theft case on a corporate Windows laptop. The machine is powered off and was handed to you by security personnel. Which step should you take first to preserve the integrity of the evidence?

During a network incident, you observe that an internal host is communicating with an external IP address on TCP port 8080. The traffic is HTTP and contains periodic GET requests to '/update.php' with a custom User-Agent string 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' but the response body is encrypted binary data. You suspect this is command-and-control (C2) communication. Which network forensic artifact would most directly reveal the C2 protocol structure and commands being sent?

A user reports their Windows 10 workstation is running very slowly and displaying unexpected pop-up ads in the browser. The incident handler suspects an adware infection. After isolating the machine, which Windows tool should the handler use to identify the malicious process consuming CPU and its associated network connections?

An attacker compromises a user's Microsoft 365 mailbox and creates an inbox rule that moves all messages from the CFO to the 'RSS Feeds' folder and marks them as read. The user never sees these messages. Which type of email incident does this behavior most directly represent?

During an email incident investigation, an analyst needs to determine the originating IP address of a message that passed through multiple mail servers. The message headers contain several 'Received' fields. Which action should the analyst take to identify the true origin?

Which THREE factors should be considered when tuning a WAF to reduce false positives for an application?

When identifying stakeholders to notify during an incident, which group should be notified first?

What is the primary risk associated with 'Executive Spoofing' or BEC (Business Email Compromise)?

During initial triage, you identify that a system's time is significantly out of sync with the NTP server. Why is this critical to record during the first response?

You are leading the eradication phase of a malware incident. Which TWO activities are essential to ensure the malware is completely removed and the system is restored to a trusted state? (Choose two.)

During an incident involving a web application, you discover that an attacker has uploaded a web shell to the server. You need to determine how the attacker uploaded the file. Which log source would provide the MOST relevant information about the upload mechanism?

During a network incident, your IDS alerts on a series of TCP packets with the SYN flag set and a source IP of 10.20.5.14, but packet captures on the internal switch show that the actual Ethernet source MAC address belongs to a workstation in the finance VLAN, while the IP 10.20.5.14 is assigned to a server in the DMZ. The workstation's ARP cache lists the DMZ server's IP as being at the workstation's own MAC address. Which network-based attack technique is the workstation most likely performing?

Which action should be taken after an email incident is contained and the indicators are identified?

During an email incident investigation, an analyst extracts a suspicious macro-enabled document from a reported message. The document contains obfuscated VBA code that downloads a payload from a remote host. The analyst wants to safely determine the payload's network behavior without allowing execution on a production workstation. Which approach BEST supports this goal?

A handler is documenting a confirmed breach of a customer database. Legal counsel needs to know the earliest point at which the organization 'knew' the incident occurred for regulatory reporting deadlines. During which phase of the incident handling process does this formal determination of incident occurrence typically get made?

During an incident, a security analyst discovers that a compromised workstation is communicating with a known malicious IP address. The analyst wants to block the IP at the perimeter firewall. Which phase of the incident handling process does this action fall under?

A first responder arrives at a workstation where an employee is suspected of exfiltrating data via a USB device. The machine is powered on with a screensaver active. The responder must capture the current physical memory contents for later analysis. Which action should the responder take first?

During the first response to a compromised Windows workstation, you must capture volatile memory before shutting the system down. Which tool or technique is designed to acquire the full physical memory image while preserving its integrity for later analysis?

An incident handler is preparing to collect volatile evidence from a compromised Linux server that is still running. The handler must decide which data to capture first before memory-resident artifacts are lost. Which of the following should be collected FIRST?

A user reports that they received an email from 'IT Support' asking them to click a link to reset their password. The link goes to a domain that looks similar to the company's but has a different top-level domain. The user did not click the link. What is the FIRST action the incident handler should take?

An analyst is investigating an email incident where several users received messages with a link to a legitimate file-sharing service. The link points to a document hosted on that service, and the document contains a macro that downloads a payload. The email gateway did not block the message because the link domain is reputable. Which technique is the attacker most likely using to evade email security controls?

Which THREE of the following are considered 'behavioral' indicators of a malware infection?

Which log file should you examine if you suspect an attacker is modifying the web server configuration files?

Which TWO types of evidence are considered 'volatile'?

Which protocol is used in conjunction with SPF and DKIM to provide instructions to the receiver on how to handle emails that fail authentication?

When investigating an incident on a virtualized platform (VMware), what is the first step to capture the state of the VM for analysis?

You are reviewing logs from an EDR and see an indicator of 'Living off the Land' (LotL). Which tool usage would be considered an LotL attack?

A healthcare organization's endpoint detection tool alerts on a workstation that is repeatedly connecting to a domain generated by a domain generation algorithm (DGA). The incident handler wants to proactively block future DGA domains before they are weaponized. Which containment strategy is most effective?

A user reports that their Windows 10 workstation is displaying a message claiming that all files have been encrypted and demanding payment in Bitcoin. The incident handler suspects ransomware. Which immediate action should the handler take first to prevent further encryption?

When DKIM signature verification fails, what is the most likely technical cause?

You are the first responder dispatched to a workstation suspected of being compromised by a phishing payload. The user is still logged in and a suspicious process is actively communicating over the network. Before you begin any data collection, what should you do first?

During an incident involving a compromised web application, you review an Apache access.log entry that shows a request for /admin/config.php with a response code of 200, but the request originated from an external IP address never seen before. The application is configured to require authentication for that path. Which incident response action is MOST appropriate to determine the scope of the compromise?

During network forensics, you need to reconstruct an HTTP file transfer from a PCAP. Which Wireshark feature allows you to extract the file object directly from the stream?

During an investigation, you need to verify the integrity of a system configuration file. You have the original known-good hash. What does it mean if the hash of the current file matches the known-good hash?

A first responder arrives at a workstation where a user is suspected of exfiltrating data via a USB drive. The machine is still powered on. The responder must preserve the most volatile evidence first. Which artifact should be captured immediately?

During a malware incident investigation, you observe a Windows host establishing periodic outbound HTTPS connections to an unknown IP address every 60 seconds, with small, uniform packet sizes. Which two characteristics most strongly indicate this is command-and-control (C2) beaconing rather than legitimate traffic? (Choose two.)

A network incident responder is analyzing a suspected ARP poisoning attack on a local subnet. Which two indicators would most likely be observed in the network traffic or ARP cache? (Choose two.)

You are analyzing a malware sample that uses 'API Hooking'. What is the goal of this technique?

A web application incident has been confirmed, and the responder needs to determine whether the attacker accessed sensitive customer records through a vulnerable API endpoint. Which log source should be examined first to identify the specific API calls and parameters used?

While analyzing an email header, you observe an SPF 'softfail'. What does this imply?

When segmenting a network to contain an incident, what is the best practice for a 'Jump Server' in a DMZ to limit the attack surface?

Which role in the Incident Response Team is primarily responsible for ensuring that the incident handling activities remain aligned with organizational legal and privacy requirements?

What is the 'First Responder Toolkit' used for during an incident?

A user reports an email claiming to be from the IT helpdesk that asks them to click a link and re-enter their credentials because their mailbox is full. The user has not clicked the link. According to the Certified Incident Handler process, what is the most appropriate immediate action?

A first responder is documenting a compromised Linux server. The server's system clock is accurate, but the file timestamps show inconsistencies. The responder needs to preserve the file system metadata for later analysis. Which action should be taken first to ensure the integrity of the metadata?

You have identified a malicious DLL that is being loaded by a legitimate process. Which tool allows you to view which DLLs are loaded by a specific process?

You are analyzing a malware sample that uses Domain Generation Algorithms (DGA). What is the primary purpose of DGA in malware?

A web application is experiencing an incident where attackers are injecting malicious JavaScript into stored user comments. The application reflects the input without proper sanitization. Which mitigation technique, when implemented correctly, is most effective at preventing this type of attack from executing in victims' browsers?

You are setting up a secure communication channel for the IR team during a major incident. Why is it recommended to use an out-of-band communication method?

Which THREE pieces of information should be recorded on a Chain of Custody (CoC) form when collecting a device?

An incident responder notices that a workstation is communicating with an external IP address on port 4444, and the traffic is encrypted. The workstation's user reports that the computer is running slowly. Which type of network incident is most likely indicated?

You are using NetFlow to identify lateral movement. You see a high volume of connections from a web server to an internal database server on port 3306. What is the most appropriate next step in the investigation?

You are reviewing a suspicious macro in a Word document attachment. Which tool is best suited for static analysis of the macro code?

Which THREE components are typically involved in a web application's logging infrastructure that an incident responder should audit?

A malware infection has encrypted several network shares. You decide to restore from backups. What is the most critical step to perform before restoring data to the production environment?

During a network incident, you observe a large volume of ARP replies from a single MAC address claiming to be the default gateway. Which containment action should you take first to mitigate the immediate threat while preserving evidence for forensic analysis?

An incident handler is preparing the containment strategy for a compromised workstation that is communicating with a command-and-control server. Which TWO actions are appropriate immediate containment measures? (Choose two.)

When eradicating malware, which TWO of the following steps are essential to ensure the host is fully cleaned and the entry point is secured?

A network incident responder is analyzing a packet capture and notices a large number of TCP SYN packets sent from various source IP addresses to a single destination IP address on port 80, but no corresponding SYN-ACK packets. The destination server is unresponsive. Which type of network incident is most likely occurring?

An employee receives a message that appears to come from the CEO asking for an urgent gift card purchase, and the reply-to address is a free webmail account. The employee reports it without clicking anything. Which containment action is most appropriate at this stage?

Which TWO of the following steps are required when performing a post-mortem analysis of an email incident?

During a web application incident, an analyst observes that an attacker is injecting malicious JavaScript into a comment field that is stored and later displayed to other users. Which type of web application incident is this?

You are a first responder tasked with collecting volatile data from a compromised Windows system. Which two of the following commands or tools are appropriate for capturing network connection information? (Choose two.)

An analyst is reviewing logs from an EDR solution. They see a 'process hollowing' event. What is the primary purpose of this malware technique?

You are analyzing a malware sample using Cuckoo Sandbox. The report shows the malware is attempting to modify the 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run' registry key. What is the intent of this activity?

Which TWO items should be part of a first responder's physical toolkit?

An organization is conducting a post-incident review after a major data breach. The team must document the incident timeline, root cause, and corrective actions. Which phase of the incident handling process does this activity belong to?

During the identification phase, you notice a high volume of traffic from an unknown IP to your web server. What is the most appropriate action to take first?

What is the primary function of an Incident Response (IR) policy?

What is the primary purpose of the 'Preparation' phase in the incident response lifecycle?

During a network incident, you observe a compromised host repeatedly connecting to an external IP on TCP port 443. The traffic is encrypted, but the connection duration is unusually short and the bytes transferred are small and consistent. Which of the following is the MOST likely explanation for this traffic pattern?

A malware incident has been detected on a Windows server. The incident handler needs to identify the persistence mechanism used by the malware. The handler runs the 'Autoruns' tool and observes an entry in the 'Scheduled Tasks' tab that points to a suspicious executable in the user's AppData folder. Which Windows feature is being abused for persistence?

Which TWO of the following actions are standard steps in the 'Analysis' phase of an incident?

A web application is suspected of being compromised through a file inclusion vulnerability. The attacker has uploaded a web shell to the server. Which type of log should you examine to find evidence of the web shell being accessed and executed?

During a malware incident on a Windows 10 workstation, you observe that a scheduled task named "UpdaterSvc" executes a binary in C:\Users\Public\svchost.exe every 15 minutes and re-creates its own registry Run key if deleted. The user reports the malware reappears after each cleanup. Which containment action BEST addresses this persistence while preserving forensic evidence?

Which THREE of the following email security technologies should be configured to prevent domain spoofing?

You are investigating a Linux server breach. You need to capture the current state of network connections without altering the evidence. Which command-line tool is preferred by first responders?

An organization's incident response plan defines a communication protocol for notifying stakeholders during an incident. A major security breach has just been confirmed, and the incident handler must decide who to notify and how. Which of the following is the PRIMARY factor that should guide the notification process?

Which THREE of the following characterize potential lateral movement using RDP in a domain environment?

You are analyzing a malware sample in a lab. You notice the malware uses the 'CreateRemoteThread' API. What is the objective of this malware activity?

An organization uses Microsoft 365. Which feature should an admin use to globally remove a malicious phishing email from all user mailboxes?

An incident handler is investigating a suspected email compromise and discovers a new inbox rule that automatically moves messages containing specific keywords to the Deleted Items folder. What is the most likely purpose of this rule?

A web application is experiencing a denial-of-service attack characterized by a flood of HTTP requests from a large number of distributed IP addresses. Which type of attack is this most likely to be?

What is the primary function of a Web Application Firewall (WAF) in an incident response scenario?

When conducting an interview with a potential witness during an investigation, what is the best practice to follow?

A security analyst is reviewing a packet capture from a suspected compromised workstation. The analyst notices a series of DNS queries for random-looking subdomains such as 'a1b2c3d4.evil.com', 'e5f6g7h8.evil.com', and 'i9j0k1l2.evil.com'. Each query is followed by a TXT record response containing long base64-encoded strings. The analyst suspects data exfiltration. Which network forensic technique would best confirm and extract the exfiltrated data from this traffic?

A security analyst is documenting an incident that involved unauthorized access to a database. The analyst needs to record the timeline of events. Which phase of the incident handling process includes documenting the timeline?

An incident responder suspects a server-side request forgery (SSRF) incident against an internal web application that fetches remote images by URL. The application runs in a cloud VPC and can reach the instance metadata service. Which immediate containment action BEST reduces the risk of credential theft while preserving evidence?

A company's security team detects that a server is communicating with a known malicious IP address every hour. The traffic is encrypted and small in size. The incident handler suspects a malware infection with a beaconing mechanism. Which type of malware is most likely responsible for this behavior?

What is the purpose of 'Network Segmentation' during an active network incident?

You are using Wireshark to analyze traffic from an infected host. You notice consistent beaconing activity to an external IP on port 443. How do you isolate this traffic in your capture?

During a malware incident on a Windows Server 2019 host, an incident handler discovers that a scheduled task named 'MicrosoftEdgeUpdateTaskMachineUA' has been modified to run a binary from C:\Users\Public\svchost.exe every 15 minutes. The handler needs to preserve volatile evidence of this persistence mechanism before remediation. Which action should the handler take first?

You are analyzing a Windows malware sample and observe that it creates a new service with an ImagePath pointing to a file in the user's AppData folder. The service is configured with a generic display name resembling a legitimate Windows component. What is the primary purpose of this behavior?

Which THREE of the following should be included in an incident communication plan?

A first responder is preparing to acquire a forensic image of a running Linux server's physical memory. The server has 64 GB of RAM and is critical to business operations. The responder must ensure the integrity of the memory image and minimize disruption. Which of the following is the most appropriate action?

When managing the 'Lessons Learned' phase of the incident response lifecycle, which THREE activities should be conducted to ensure continuous improvement?

During a live intrusion, the incident commander must choose a containment strategy. Taking the affected system offline immediately would destroy volatile memory evidence and alert the attacker, while leaving it online risks further data exfiltration. Which approach best balances evidence preservation with damage limitation?

You are utilizing NIST SP 800-61 Rev. 2 to structure your incident response team. During a critical ransomware outbreak, you need to assign a lead who coordinates with legal, PR, and executive leadership. Which role should you designate to ensure organizational communication is handled per the policy?

Which TWO of the following are considered 'Legal Considerations' during the Incident Handling process that must be integrated into the response plan?

If a phishing email bypassed the perimeter email gateway, what is the next logical step in the incident response process?

A hospital's incident response team has just finished eradicating a ransomware infection that encrypted several clinical workstations. The CISO asks the handler to formally close the incident and release the team. According to the incident handling process, which activity must occur BEFORE the incident can be declared closed?

A first responder is called to investigate a suspected malware infection on a Windows workstation. The responder needs to quickly determine which processes are currently running and their associated command-line arguments. Which native Windows tool should the responder use?

An organization's incident response team is drafting its first formal incident handling capability. Management asks which phase of the process should include developing the incident response plan, acquiring forensic tools, and training the team before any real event occurs.

A web application is experiencing an incident where an attacker is manipulating HTTP headers to bypass IP-based access controls. The attacker sets the X-Forwarded-For header to a trusted internal IP address. Which mitigation should an incident handler recommend to prevent this bypass?

A helpdesk technician receives a call from an employee who says they opened an email attachment that appeared to be an invoice, and now their computer is showing a message demanding payment to unlock files. The employee's documents are encrypted and have a new file extension. The technician escalates to the incident response team. Which classification BEST describes this incident?

A network incident has been declared due to a suspected data exfiltration. You are reviewing network flow data to identify the exfiltration channel. Which TWO of the following characteristics are most indicative of data exfiltration over a covert channel? (Choose two.)

During an incident investigation, the handler discovers that an attacker used a compromised service account to move laterally across multiple servers. The handler needs to determine the full scope of affected systems. Which of the following is the MOST reliable method to identify all systems the attacker accessed using that account?

A security analyst is reviewing network traffic and observes a high volume of TCP SYN packets from various spoofed source IP addresses to a single destination server, with no corresponding SYN-ACK replies. The server's connection table is nearly full. Which type of network incident is most likely occurring?

An incident handler is analyzing a malware sample that uses process hollowing. The handler observes that a legitimate process, such as svchost.exe, is running but its memory contains malicious code. Which Windows API sequence is most characteristic of process hollowing?

When analyzing a potentially malicious script, which THREE of the following techniques help in deobfuscating the code?

An attacker uses a 'Homograph Attack' to spoof a domain. How does the analyst detect this?

You are responding to a web-based attack. Which log source is most critical for identifying the origin of a SQL injection attempt?

You have identified an infected machine and need to perform a memory dump before it is wiped. Which tool is the industry standard for acquiring a full memory dump on a Windows machine for incident response?

You are handling a web defacement incident on an internet-facing content management system. The page content was altered, and the attacker likely used a compromised administrative account. Which TWO artifacts should you collect FIRST to establish an accurate timeline and preserve evidence? (Choose two.)

When reviewing firewall logs, you see many 'deny' events from an internal host to an external IP. What is the most likely cause?

You are identifying a compromised host by checking for beaconing behavior. Which network metric is most indicative of heartbeat-style beaconing?

Which TWO of the following describe the role of an email gateway in incident response?

An analyst is investigating a suspected SQL injection attack on an IIS server. Which log file should they prioritize to identify the specific URL-encoded payload strings submitted by the attacker?

An attacker is using ICMP tunneling to exfiltrate data. What field in an ICMP echo request packet would contain the unauthorized data?

Which TWO of the following are essential components of an effective Incident Response (IR) plan?

You are performing an investigation on a compromised mobile device. What is the primary risk of connecting the device to a standard workstation without a write blocker?

An employee receives a suspicious email asking to verify account details by clicking a link. What is the most effective user behavior to mitigate this?

An incident responder is investigating a web application breach and needs to determine the exact time an attacker uploaded a web shell. Which log source would most directly provide this information?

A malware sample was found to use a 'Mutex' to ensure only one instance of the malware runs at a time. What tool would you use to find the Mutex name on an infected host?

A first responder arrives at a workstation that is suspected of being compromised by a Remote Access Trojan (RAT). The user reports the machine has been running slowly and the network activity LED is constantly blinking. The responder decides to capture volatile network connection data before any other action. Which of the following commands should the responder use to display active network connections and the associated process IDs on a Windows system?

You are investigating a suspected rootkit. Which area of the operating system should you examine for unauthorized boot-time execution?

You are documenting an incident and need to record the time of the event. Why is accurate time synchronization critical?

A web server log shows repeated '403 Forbidden' errors for a specific directory. What is the most likely cause during an incident?

A helpdesk technician reports that multiple users received an email with an attached PDF that, when opened, prompted them to enable macros. One user enabled macros and their workstation is now showing unusual outbound connections. As the incident handler, which action should you take FIRST according to the incident response lifecycle?

A web application's logs indicate an attacker successfully performed an XML External Entity (XXE) injection. What was likely the source of this vulnerability?

You are an incident handler assigned to a case involving a suspected insider threat. Before collecting evidence from an employee's workstation, you must ensure your actions are legally defensible and compliant with company policy. Which document should you consult FIRST to determine your authority to search and seize the workstation?

Which TWO criteria must a first responder satisfy when choosing a tool for a toolkit?

During a Cross-Site Scripting (XSS) incident, you notice the WAF is blocking legitimate user sessions. What is the most effective tuning step to prevent false positives while maintaining protection?

You are preparing a final report for an incident. Which element is mandatory for ensuring the report serves as a valid document for future insurance or legal claims?

During a live incident, an analyst needs to capture volatile data from a compromised Windows server before containment. The server has 32 GB of RAM and is still running. Which action should the analyst perform FIRST to preserve the most volatile evidence?

Which THREE categories of stakeholders should be considered for notification in a major data breach?

A security analyst is reviewing firewall logs and notices a large number of 'deny' events from an internal host to various external IP addresses on different ports. The internal host is a user workstation that should only access a limited set of external services. Which of the following is the MOST likely cause of these deny events?

A system has been infected by a worm that is spreading across the network. What is the most immediate action to stop the spread?

An organization is establishing an Incident Response (IR) team. According to NIST, which team structure is most suitable for a large, globally distributed organization that requires localized response capability with centralized oversight?

You are handling a ransomware incident. Which step should be taken before attempting any file recovery?

An organization is responding to an email incident where a user's mailbox is suspected to be compromised and used to send internal phishing emails. Which two actions should the incident handler take to contain the compromise and prevent further spread? (Choose two.)

Which THREE of the following are common indicators of a phishing email?

You are triaging a Windows workstation suspected of a malware infection. Several indicators suggest the malware is using the Windows Registry for persistence. Which TWO registry locations should you examine first to identify autostart entries created by the malware? (Choose two.)

Which THREE of the following are effective methods for protecting backup systems from being encrypted by ransomware?

Which THREE actions are essential when performing log review after a web application attack?

A financial institution's incident response team is investigating a malware outbreak that encrypts files and demands payment. The team needs to identify the malware family to determine if a decryption tool is available. Which two characteristics should the team analyze to identify the ransomware family? (Choose two.)

A user reports receiving an email with a .zip attachment that is password-protected and the password is included in the email body. The email claims to be an invoice from a known vendor. What is the most likely reason for this?

A junior SOC analyst receives an alert at 03:00 showing a workstation contacting a known command-and-control (C2) IP address. The analyst is unsure whether this is a true incident or a false positive and wants guidance before waking the on-call incident handler. According to the incident handling process, what should the analyst do FIRST?

You are dealing with a legal hold request for data related to an investigation. How should you handle the data retention policy for this specific case?

During an investigation of a compromised e-commerce web application, you observe that the attacker sent a single HTTP request containing a serialized object in the 'cart' cookie. The application deserialized the data and subsequently spawned a shell process on the server. Which web application vulnerability was exploited?

A user reports an email that appears to come from the CFO but the message was sent from an external IP address. The message passed SPF but failed DMARC alignment. What should the incident handler do first?

Which technique should an incident responder use to prevent an infected host from spreading ransomware via SMB to other segments in the network?

During an email incident investigation, you need to determine whether a message was altered in transit. You have the full email headers. Which header field should you examine to verify the cryptographic signature that validates the message content and ensures it was not modified after sending?

You are investigating a cross-site scripting incident on a customer-facing web application. The attacker injected a persistent payload that executes in the browsers of users viewing a product review page. Which TWO actions should you take to contain the incident and protect users while preserving evidence? (Choose two.)

You are analyzing an email with a suspicious attachment. You notice the file name is 'invoice.pdf.exe'. What does this indicate?

After an incident has been resolved, the incident handler is conducting a post-incident review. Which activity is the PRIMARY purpose of this phase?

Which TWO of the following are common signs of a compromised switch in a local area network?

Which THREE of the following are critical requirements for maintaining a valid Chain of Custody?

During an incident, you need to isolate a compromised workstation from the network immediately. Which action is the most effective containment strategy while preserving volatile memory?

A web application is experiencing a suspected cross-site scripting (XSS) incident. You are reviewing web server and application logs to identify the attack. Which TWO log sources are MOST likely to contain evidence of the XSS payload being submitted and executed? (Choose two.)

Which TWO pieces of information must be collected to successfully track a session hijacking attack across multiple log sources?

Which THREE of the following are key components of a network-based containment strategy?

A first responder is collecting evidence from a compromised Windows server. The server is still running, and the responder needs to preserve the current state of network connections and the associated processes. Which command should the responder use to capture this information?

You are investigating a suspected fileless malware incident on a Windows server. EDR telemetry shows that powershell.exe was spawned by winword.exe and executed an encoded command that downloaded a script from a remote host. The process has already exited. Which artifact is MOST likely to contain the decoded command and the URL contacted?

Which TWO of the following are common indicators that an incident should be declared?

A network administrator notices a sudden spike in ICMP echo requests from an internal host to an external IP address. The payload size of these ICMP packets is consistently larger than normal ping requests. Which of the following is the MOST likely cause of this activity?

A helpdesk technician reports that a user's browser is redirecting searches to an unfamiliar site and displaying pop-up advertisements even when no browser is open. You suspect a potentially unwanted program or adware infection. Which initial step is most appropriate for an incident handler?

During a malware incident response, you identify a suspicious process with PID 4452 using Sysinternals Process Explorer. You need to verify the file's reputation before isolation. Which action allows you to do this directly within the tool?

Which TWO of the following are common sources for incident identification?

You are performing forensic analysis on a suspicious file. You need to determine if it is a packed executable. Which tool is most effective for viewing the file's section headers to identify anomalies?

A security analyst is investigating lateral movement using PowerShell Remoting (WinRM). Which Windows Event Log should be prioritized to confirm the execution of remote commands?

You are managing chain of custody for a physical server seized during an investigation. What is the most critical action to ensure the evidence remains admissible in court?

Which of the following is an example of a non-volatile data source?

You suspect an incident involves an insider threat. Which step should be taken FIRST to preserve the integrity of the potential evidence while minimizing system downtime?

A user reports an email from a known vendor that asks them to confirm banking details by replying with a completed form attached as an HTML file. The message passed SPF, DKIM, and DMARC because it came from the vendor's legitimate mail server. As the incident handler, what is the most accurate conclusion about this email?

You are using a SIEM to correlate events during an investigation. What is the primary advantage of correlation in incident analysis?

You are choosing a destination for forensic image storage. What is the most critical characteristic of this storage?

A financial institution's SOC detects anomalous SMB traffic from a workstation to multiple servers, including attempts to access ADMIN$ shares. Which TWO of the following artifacts should an incident responder prioritize to confirm lateral movement via SMB? (Choose two.)

A security analyst is investigating a suspected data exfiltration incident. The analyst reviews NetFlow records and notices a large outbound data transfer from an internal server to an external IP address over TCP port 53. Which of the following is the MOST likely explanation for this activity?

You are auditing Apache logs to detect potential OS command injection. Which characters should you search for in the access logs?

You are performing initial containment on a cloud-based AWS EC2 instance. The instance is under a DDoS attack. What is the most effective way to isolate this specific resource?

An incident responder is investigating a suspected email-borne malware incident. The email contained a link that downloaded a file. The responder needs to determine the file's reputation and whether it has been seen in other campaigns. Which action should the responder take?

An analyst is drafting an email to a user who reported a phishing attempt. What is the most important tone to maintain?

During an investigation into lateral movement, you notice an unusual RDP connection from a workstation to a domain controller. Which Wireshark filter would be most effective in isolating only the RDP traffic associated with that specific source IP to identify potential credential dumping activity?

A developer reports that a specific user is receiving 500 Internal Server Errors. Where is the first place to look to determine if this is an incident?

An incident handler is analyzing a reported email that appears to come from a trusted partner. The message passed SPF and DKIM for the partner's domain, but the handler notices the display name matches the partner while the actual From address uses a look-alike domain with a single character difference. The message also contains a link to a document-sharing site. Which conclusion is MOST accurate?

You are performing a triage on a server and see unauthorized outbound connections to a foreign IP. What is the best way to determine which process initiated the connection?

An attacker is using a specific User-Agent to scan your web application. How do you block them effectively?

A web application is vulnerable to session fixation. What is the primary indicator of this attack in the logs?

Which TWO of the following are common network-based indicators of a compromised host attempting to perform network discovery?

Which TWO of the following are primary objectives of the 'Lessons Learned' phase?

During the preparation phase, an organization is developing its incident response plan. Which TWO of the following are essential elements that should be included to ensure effective incident handling? (Choose two.)

When responding to a SQL injection incident, which TWO areas of the database server logs should be prioritized for review?

During a network incident, you capture traffic and notice a workstation repeatedly sending TCP SYN packets to a single external IP on port 443, but the external host never responds. The workstation then sends the same SYN to a different external IP on port 443. Which network artifact best characterizes this behavior?

During an incident, why is it important to keep the 'Incident Log' updated in real-time?

You are handling a confirmed email incident involving a malicious attachment that executed on several endpoints. Which TWO actions should you take to scope the incident and prevent further execution across the organization? (Choose two.)

When documenting evidence for a forensic investigation, you are required to establish a chain of custody. Which information is considered mandatory for each entry in the chain of custody log to satisfy legal requirements?

Which TWO log file attributes are essential for identifying the source of an attack coming through a load balancer?

During an incident, a responder needs to capture the ARP cache to identify potential local spoofing. Which tool provides this information?

Which of the following is a symptom of an 'Email Forwarding Rule' attack?

A security analyst receives an alert about a possible data exfiltration from a compromised workstation. The analyst needs to determine the scope of the incident by identifying other systems that may have communicated with the same command-and-control (C2) server. Which data source is most effective for this correlation during the identification phase?

Which THREE indicators in a web access log suggest a directory traversal attempt?

During a web application incident, you review logs and find requests containing the string 'UNION SELECT username, password FROM users' in the id parameter. The database server log shows the corresponding query executed successfully and returned rows. Which type of web application attack does this evidence confirm?

You are assessing the effectiveness of a containment strategy for a worm spreading through the network. What is the most effective metric to use?

During the triage of a Linux server, you suspect a rootkit is intercepting system calls. Which THREE actions are appropriate for the first responder to perform to gather evidence of the rootkit?

An analyst identifies that an email originated from an unauthorized IP address despite passing SPF. What is the most likely cause?

During a web application incident, you discover that an attacker is exfiltrating data through HTTP responses by abusing a deserialization endpoint. The endpoint returns serialized objects that include base64-encoded fields. Which technique should you use to identify the exfiltrated data within captured network traffic?

During a first response to a Linux web server suspected of compromise, you notice that the root account's command history file has been truncated and that the system binaries /bin/ps and /bin/netstat have modification times newer than the kernel package. You must preserve trustworthy evidence. Which action best addresses the integrity concern before you rely on those binaries?

You are using YARA to detect a specific strain of ransomware. You want to match a file if it contains a specific hex string OR a specific string value. How do you construct this in your rule?

You need to capture forensic data from a Windows machine using a remote agent. What is the risk of using built-in administrative tools like PowerShell for this?

During a forensic investigation of a compromised Linux server, you need to collect volatile data from memory. The server is running critical services and cannot be taken offline. Which method is most appropriate for capturing memory while minimizing disruption?

While responding to a confirmed cross-site scripting (XSS) incident on a public web application, you need to determine whether the attacker exfiltrated session cookies. The application uses HTTPS and sets cookies without the HttpOnly flag. Which evidence source is MOST likely to reveal the stolen cookie values?

Which THREE of the following could be considered 'indicators of compromise' (IOCs) for an email incident?

A finance workstation running Windows 10 begins displaying a full-screen message demanding Bitcoin payment and encrypts files with the .locky extension. The user reports the machine is still powered on and connected to the corporate network. As the incident handler, which action should you take FIRST to preserve volatile evidence?

Which THREE items should be included in an incident report following a successful SQL injection attack?

After a major security breach, you are tasked with conducting a lessons learned meeting. Which of the following is the PRIMARY objective of this meeting?

A security analyst notices that an internal web server is receiving a large number of HTTP requests with unusually long and complex query strings, causing the server's CPU usage to spike. The requests appear to be targeting a search function. Which type of network incident is most likely occurring?

During the 'Recovery' phase of the malware incident, what must be done to ensure the environment is safe before reconnecting the restored systems?

You suspect a DNS tunneling attack for data exfiltration. In your DNS server logs, which characteristic is the strongest indicator of a tunnel rather than standard recursive lookups?

An incident handler is documenting the timeline of a security breach. The handler discovers that system clocks on different servers are not synchronized. Which action should the handler take to ensure the timeline is accurate and defensible?

A user reports that Microsoft Word documents on a shared drive are suddenly opening with a prompt to enable macros, and a new file named '~$invoice.docx' appears in the same directory. Analysis shows the macro contains the string 'AutoOpen' and references a remote template URL. Which malware category and delivery technique best describe this incident?

You are analyzing an incident where a user account is being used to exfiltrate data. What is the most immediate action to contain the account?

A user reports their system is running slowly, and you observe a suspicious file in 'C:\Users\[User]\AppData\Local\Temp'. What is the most appropriate first step in your investigation?

You are performing an incident investigation involving a suspected insider threat. Under GDPR compliance, you must ensure that your data collection methods adhere to the 'data minimization' principle. Which action best aligns with this requirement?

You are performing log correlation in a SIEM. You want to match Windows Event ID 4624 (Logon) with network traffic. Which field is the primary 'join key' to correlate the event with a specific network flow?

When reviewing network traffic for C2 communication, which THREE of the following indicators are commonly observed?

You are handling a malware incident on a Windows server and need to determine whether the malware has established persistence. Which two registry locations should you inspect first because they are the most common autostart points used by malware? (Choose two.)

Which THREE of the following tools would be most effective for performing live memory forensics on a compromised Windows workstation?

Which TWO of the following sources of information are most helpful for building an Indicators of Compromise (IoC) list during an investigation?

A malware incident has been identified on a corporate workstation. The incident response team is following the containment, eradication, and recovery phases. Which TWO of the following actions are considered part of the eradication phase? (Choose two.)

You are the first responder to a Linux server that is suspected of being compromised. You need to collect volatile data in the order of volatility. Which command should you run first to capture the most volatile data?

A first responder is called to a small office where an employee's laptop is suspected of being infected with malware. The laptop is powered on and the employee is logged in. The responder needs to preserve the most volatile evidence before any other action. Which of the following should the responder do first?

A user's Windows 10 workstation is suspected of being infected with fileless malware that resides only in memory and executes PowerShell commands. The incident handler needs to capture volatile evidence from the system before it is powered off. Which tool is specifically designed for acquiring a memory dump from a Windows system?

Which TWO actions are recommended for evidence preservation in a digital incident?

During an incident response engagement, a first responder is collecting volatile data from a compromised Windows server. The responder needs to capture the current network connections, including the process ID associated with each connection, without installing any third-party tools. Which native Windows command should the responder use?

A web application is under a distributed denial-of-service (DDoS) attack that is overwhelming the server with HTTP requests. As an incident handler, you need to identify the source of the attack and mitigate it. Which TWO log sources are most critical to analyze first to understand the attack pattern and its origin? (Choose two.)

Which THREE of the following are appropriate communication channels to keep users informed during an email phishing incident?

Which team should be notified first in the event of a confirmed external data breach involving customer PII?

While investigating a server compromise, you need to ensure the digital evidence collected from the RAID array is admissible in court. What is the most critical requirement for the chain of custody?

An incident handler is reviewing a suspicious executable found on a compromised Windows system. The file has a double extension, such as 'invoice.pdf.exe'. Which type of malware delivery technique is this most likely an example of?

You are investigating a compromised Linux host. Using 'tcpdump' to capture traffic on interface eth0 to analyze C2 communication on port 443, which command is most efficient for saving the output to a file for later analysis in Wireshark?

An attacker is bypassing WAF signatures by using Unicode encoding. Which WAF feature must be enabled to normalize the traffic before inspection?

Which tool would you use to perform a live analysis of HTTP traffic and inspect for malicious payloads in real-time?

A web application is returning verbose error messages that include full stack traces and database query fragments to users. An attacker is using these messages to map the application's internal structure. Which remediation step should the incident handler recommend to the development team?

Which THREE pieces of information should be included in an incident triage report?

Which TWO of the following are recommended when creating a forensic copy of a hard drive?

During a web application incident, an analyst discovers that an attacker is using SQL injection to extract data from a backend database. Which SQL injection technique involves the attacker inferring data by asking the database true/false questions and observing the application's response?

An incident handler is reviewing an alert from the Endpoint Detection and Response (EDR) system. What is the main goal of the 'Containment' phase?

An email header contains 'X-Forefront-Antispam-Report'. What can an analyst determine from this?

A web application incident responder is investigating a suspected XML External Entity (XXE) attack. Which component of the web application is most likely to be the initial target of the attack?

During a malware incident, you observe that a compromised system is communicating with a known command-and-control (C2) server at 203.0.113.45 over TCP port 443. You need to block this communication at the network perimeter to prevent further data exfiltration. Which action should you take?

What is the primary purpose of a write blocker in a forensic investigation?

An organization's CSIRT is activated for a suspected ransomware outbreak. The incident handler must decide whether to escalate the incident to management. According to the incident handling process, which factor is the MOST appropriate trigger for immediate escalation?

A security team is reviewing their incident handling process after a recent data breach. They want to ensure that their eradication phase is effective. Which TWO activities are essential during the eradication phase? (Choose two.)

An employee's Windows workstation is suspected of being infected with malware after clicking a link in a spam email. You need to identify which process is making outbound network connections to an external IP address. Which built-in Windows tool should you use to correlate active network connections with their owning processes?

Which documentation is required when transferring physical evidence from a responder to a forensic lab?

A financial services firm has activated its incident response plan after detecting unauthorized access to an internal file server. The incident commander must decide which activities belong to the containment phase rather than recovery. (Choose two.)

You are documenting a post-incident review. Which of the following should be included in the 'Timeline of Events' section?

An attacker compromises a user's Microsoft 365 mailbox and creates a hidden inbox rule that moves any message containing 'wire transfer' to the RSS Feeds folder and marks it as read. The security team must determine which native artifact best proves the rule existed even after the attacker deletes it from Outlook on the web. What should the team review?

Which TWO settings in a WAF policy are most effective at mitigating automated bot-driven web attacks?

A web application is suspected of being compromised through a file inclusion vulnerability. The attacker used the vulnerability to read sensitive files on the server. Which web server log entry would provide the MOST direct evidence of the file inclusion attempt?

In the context of the NIST Incident Response Life Cycle, which phase immediately follows the 'Detection and Analysis' phase, specifically focusing on limiting the scope of the compromise?

A first responder is using a 'Live Response' toolkit. What is the main characteristic of these tools?

Which THREE of the following represent critical log sources that should be correlated when investigating a potential network-based exfiltration incident?

What is the purpose of enabling 'Request Body Buffering' on a WAF during incident response?

A financial institution's incident response team is investigating a suspected network intrusion. They observe anomalous traffic from an internal database server to an unknown external IP address. Which TWO of the following actions are appropriate for network-based containment in this scenario? (Choose two.)

You are performing a post-incident review. Which action is the most important to ensure that the 'Lessons Learned' process effectively improves future response capabilities?

After containing a malware incident, the incident response team needs to remove the malware from infected systems and restore them to a trusted state. Which activity is part of the eradication phase?

An incident handler is reviewing a suspicious email reported by a finance employee. The message appears to come from a known vendor, requests an urgent wire transfer, and contains a PDF attachment. The handler wants to determine whether the sender's domain was authorized to send on behalf of the vendor. Which email authentication result should the handler check FIRST to make this determination?

Which syslog facility would typically be configured on a network device to send audit logs to a central server?

When an email incident is resolved, why is it necessary to update the organization's blocklist?

Which THREE of the following are legal considerations when handling an incident?

While investigating a breach, you need to verify the integrity of a system file. Which process is correct to ensure the file has not been altered?

A first responder arrives at a scene where a laptop is suspected to contain evidence of a data breach. The laptop is powered on and logged in. What is the first step the responder should take to preserve volatile evidence?

Which TWO of the following are safe practices when analyzing a suspicious email?

You are analyzing an email and the URL redirects through multiple shortened link services. What is the recommended way to find the final landing page?

Which TWO of the following activities are considered 'Eradication' steps in the incident response lifecycle?

Which THREE of the following indicators are found in email-based malware delivery?

After eradicating a malware infection, you need to ensure the system is hardened against future occurrences. Which action is most effective against fileless malware?

During an email incident investigation, you need to analyze a malicious macro embedded in a Word document without executing it. Which tool is most appropriate for extracting and examining the macro code?

What is the purpose of 'Sandboxing' in email security?

An analyst receives a report of a phishing email. Which email header field is most reliable for verifying the path taken by the email through intermediate mail transfer agents?

You have identified a potential Advanced Persistent Threat (APT) in your network. Which evidence preservation strategy is required to maintain the validity of the logs found in a SIEM?

You suspect a file on a Linux server is malicious. What command can you use to obtain the MD5 hash of the file?

A healthcare provider's incident response team is notified that a clinical workstation is repeatedly re-infecting with ransomware 20 minutes after each cleanup. Volatile evidence has been preserved, and the business owner has authorized taking the endpoint offline. The team suspects a persistent mechanism that re-establishes the payload. Which action BEST aligns with the Containment phase of the incident handling process while preserving the ability to identify the persistence mechanism?

A malware incident has been contained and eradicated on an infected Windows server. Before returning the server to production, you need to verify that no malicious processes or unauthorized autostart entries remain. Which action best supports this validation?

You are configuring a SIEM for long-term storage of investigation logs. Which feature is most important to prevent evidence tampering?

You suspect a CSRF (Cross-Site Request Forgery) attack. What log entry pattern confirms this?

During a malware analysis, which TWO of the following indicators are typically used to identify persistence mechanisms in the Windows registry?

Which TWO of the following steps are considered best practices when performing network forensics on a live environment?

Which THREE of the following are effective network forensics techniques for identifying an attacker's C2 server infrastructure?

When notifying stakeholders during a major data breach, which TWO of the following groups must be informed according to standard incident communication plans to satisfy regulatory and operational needs?

Which THREE of the following items should be included in an email incident report?

When classifying the severity of an incident, which factor should carry the most weight in your decision-making process?

A stakeholder asks you to prioritize the recovery of a compromised system. According to incident response best practices, what is your first responsibility?

You are reviewing logs after an incident. You see a sequence of requests starting with 'admin.php', then 'admin.php?id=1', then 'admin.php?id=1 OR 1=1'. What is the attacker doing?

When dealing with digital evidence in a remote investigation, what is the standard procedure to ensure evidence integrity during network transfer?

Which TWO of the following are essential components of an effective Incident Communication Plan?

Which THREE of the following roles are typically included in an IR team?

A web application is behind a reverse proxy that forwards client requests. During an incident, you need to identify the true source IP of an attacker who is sending malicious requests. The web server logs show the IP of the reverse proxy instead of the client. Which HTTP header should you inspect in the web server logs to find the original client IP?

During a first response to a compromised server, you need to capture the contents of RAM. The server is a critical production system that cannot be taken offline. Which factor is most important to consider when selecting a memory acquisition tool for this scenario?

An incident handler is analyzing a malware incident that used a phishing email. What is the most important field to check in the email header to determine the true origin of the email?

During an incident involving a compromised e-commerce web application, you need to determine whether an attacker used a stolen session cookie to access a user's account. Which HTTP header should you examine first in the web server access logs to identify the session token used in the malicious requests?

If a user receives an email with an attachment that is a 'compressed password-protected file', why is this a red flag?

You are establishing an Incident Response Plan (IRP). Which document should prioritize the technical steps for restoring services after a ransomware attack?

Which TWO of the following are valid methods to identify a malicious attachment?

An incident handler is analyzing a malware sample that appears to be a ransomware variant. The sample encrypts files with a specific extension and drops a ransom note. The handler wants to determine the encryption algorithm used to potentially find weaknesses. Which artifact from the malware analysis is most directly useful to identify the encryption algorithm?

During a network intrusion investigation, a first responder needs to capture volatile network configuration data from a compromised Windows server before it is rebooted. Which command should be used to display the current ARP cache?

A first responder is documenting a compromised Linux server that is still running. The responder needs to record the system's current network state to later identify unauthorized connections and potential data exfiltration. Which two commands should the responder use to capture this volatile information? (Choose two.)

A junior responder arrives at a compromised Windows 10 workstation. Before touching the keyboard, they photograph the screen. The system is still powered on and a suspicious process is visible in Task Manager. The responder's supervisor asks them to capture the most volatile evidence first. Which action should the responder take next?

An incident responder is examining a suspected business email compromise (BEC) message. The message passed SPF, DKIM, and DMARC alignment checks. The From display name is the CEO's name, but the actual envelope sender is a lookalike domain registered two days ago. Which characteristic of this message most directly explains why the authentication checks succeeded while the message is still malicious?

Which TWO actions are recommended for secure evidence storage?

You are reviewing a failed incident case management report. The team failed to capture the 'Time of Detection' vs. 'Time of Occurrence'. Which metric is directly impacted by this lack of documentation?

During a malware incident investigation on a Windows 10 workstation, you discover a scheduled task named 'MicrosoftEdgeUpdateTaskMachineCore' that launches 'C:\Users\Public\updater.exe' every 15 minutes. Legitimate Edge update tasks do not execute binaries from the Public profile. Which containment action best preserves volatile evidence while stopping the recurring malicious execution?

You are handling a confirmed incident in which an attacker uploaded a web shell named 'image_thumb.php' to a public-facing Apache server running PHP. The file is being invoked repeatedly via HTTP POST requests. Which action should you take FIRST to contain the threat while preserving forensic evidence?

You suspect a malware incident caused unauthorized data exfiltration. Which log source is most useful to identify the destination IP of the exfiltrated data?

Which document is essential to maintain during a malware incident to ensure accountability and track the actions taken by the incident response team?

You are a first responder called to a scene where a laptop is running and logged in. You need to preserve the most volatile evidence. What should you do first?