Courseiva
Free · No account needed · No credit card

Certified Incident Handler (212-89) Practice Test

321 questions with instant explanations, domain breakdown, and wrong-answer analysis. Built for the real exam.

Instant feedback after each answer
Full explanations included
Domain score breakdown
Real exam: 180 min

Sample questions with explanations

This is exactly what you see during practice — question, options, and a full explanation after you answer.

Q1Email Incidentshard
Full explanation →

When DKIM signature verification fails, what is the most likely technical cause?

AThe sender's IP address is on a blocklist
The body of the message was modified in transitCorrect
CThe user clicked a phishing link
DThe SPF record is missing

DKIM uses a cryptographic signature over specified headers and the message body. If the body is modified in transit, the hash computed by the receiver will not match the signature, causing verification to fail. This is the most likely technical cause of DKIM failure.

Q2Email Incidentsmedium
Full explanation →

An organization uses Microsoft 365. Which feature should an admin use to globally remove a malicious phishing email from all user mailboxes?

AConditional Access policies
BExchange Transport Rules
Search and Purge in Microsoft 365 DefenderCorrect
DMail Flow Connector configuration

Search and Purge in Microsoft 365 Defender (formerly Office 365 Advanced Threat Protection) allows administrators to search for and delete malicious emails from all user mailboxes. This feature is designed specifically for incident response to remove phishing or malware emails gl…Read full explanation

Q3Email Incidentsmedium
Full explanation →

You are analyzing an email with a suspicious attachment. You notice the file name is 'invoice.pdf.exe'. What does this indicate?

The file is a double-extension obfuscation attemptCorrect
BThe file is a legitimate script file
CThe file is encrypted with a password
DThe file is a genuine PDF that requires an executable

A filename like 'invoice.pdf.exe' uses a double extension to disguise an executable as a PDF. Windows hides known file extensions by default, so the file may appear as 'invoice.pdf' to the user, but it actually runs as an .exe. This is a classic social-engineering technique to tr…Read full explanation

What's covered

Questions are tagged by exam domain. Practice a specific domain or mix them all.

Untimed Practice

Answer at your own pace. Explanation and domain tag shown immediately after each answer.

Timed Practice

Countdown timer starts immediately. Results and domain scores shown at the end — just like the real exam.

Why practice here?

Full explanations on every question

Not just the right answer — you get exactly why each wrong option is wrong, so you learn the concept, not the answer.

Domain score breakdown

After each session see your score by exam domain so you know exactly where to focus study time.

100% free, forever

No subscription, no trial, no email wall. Start a session in under 10 seconds.

Exam-style questions

Scenario-based, precise wording, realistic distractors — written to match what you actually see on exam day.

← All 212-89 questions212-89 exam guideStudy guidePractice by domain