How should I use these First Response practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just First Response questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the First Response domain.

212-89 · topic practice

First Response practice questions

Practise Certified Incident Handler (212-89) First Response practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: First Response

Practice 10 questions Browse domain →

What the exam tests

What to know about First Response

First Response questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common First Response exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

First Response questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full First Response explanation →

You are using EnCase Endpoint Investigator to triage a suspicious endpoint. You need to identify unauthorized processes currently running. Which feature should you utilize?

Trap 1: File Signature Analysis.

This is used to verify file integrity, not check running processes.

Trap 2: Registry Analysis feature.

Registry analysis is for persistent configuration data, not current process state.

Trap 3: Event Log Collector.

Event logs are for historical analysis, not current process monitoring.

First Response practice questions

What to know about First Response

Common First Response exam traps

First Response questions

You are using EnCase Endpoint Investigator to triage a suspicious endpoint. You need to identify unauthorized processes currently running. Which feature should you utilize?

You are responding to an incident involving a compromised Windows server. You need to collect volatile data using a trusted toolkit. Which tool is standard for collecting running services and loaded DLLs?

You are handling a database compromise. The database logs show evidence of SQL injection. What is the appropriate initial containment step for the database?

Which THREE steps are involved in the standard triage process for a compromised endpoint?

You are managing a live incident and need to preserve the network state of a Linux server. You must capture active network connections and the routing table. Which tool and flag combination is preferred by first responders to ensure minimal impact on the target system's binary integrity?

You are investigating a Linux server breach. You need to capture the current state of network connections without altering the evidence. Which command-line tool is preferred by first responders?

When documenting the chain of custody for a seized laptop, which information is mandatory?

You are performing initial containment on a cloud-based AWS EC2 instance. The instance is under a DDoS attack. What is the most effective way to isolate this specific resource?

You are performing an investigation on a compromised mobile device. What is the primary risk of connecting the device to a standard workstation without a write blocker?

A stakeholder asks you to prioritize the recovery of a compromised system. According to incident response best practices, what is your first responsibility?

As a first responder, you arrive at a compromised workstation showing signs of active malware beaconing. Which action should be performed first according to the Order of Volatility?

You discover a suspicious scheduled task on a server. Which Windows tool allows you to export this task for analysis without relying on the GUI?

Which documentation is required when transferring physical evidence from a responder to a forensic lab?

When investigating an incident on a virtualized platform (VMware), what is the first step to capture the state of the VM for analysis?

You are analyzing an incident where a user account is being used to exfiltrate data. What is the most immediate action to contain the account?

You are responding to a web-based attack. Which log source is most critical for identifying the origin of a SQL injection attempt?

A first responder is using a 'Live Response' toolkit. What is the main characteristic of these tools?

While investigating a breach, you need to verify the integrity of a system file. Which process is correct to ensure the file has not been altered?

Which of the following is an example of a non-volatile data source?

Track your progress over time

Start a First Response only practice session

Related 212-89 topic practice pages

Network Incidents practice questions

Malware Incidents practice questions

Incident Handling Process practice questions

Web Application Incidents practice questions

Email Incidents practice questions

First Response practice questions

212-89 fundamentals practice questions

212-89 scenario practice questions

212-89 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid