How should I use these First Response practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just First Response questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the First Response domain.

212-89 · topic practice

First Response practice questions

First Response covers the initial actions a handler takes on a suspected compromised host: securing the scene, containing accounts and systems, and collecting volatile evidence before it is lost. Questions present Windows or Linux scenarios and ask you to choose the correct first command, containment step, or preservation action, testing order-of-volatility reasoning and tool selection.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Editorial oversight:Johnson Ajibi· MSc IT Security, IEEE Senior Member

20 questionsDomain: First Response

Practice 10 questions Browse domain →

What the exam tests

What to know about First Response

You must be able to prioritize volatile data collection and choose the correct containment action for a compromised account or host. The single most important thing is capturing memory and network state before anything else, since powering off or imaging disk first destroys the evidence.

Order of volatility: memory and network state before disk, using tools like Volatility or dd

Windows live response commands such as netstat -ano, tasklist, and wmic process

Linux volatile data collection with ps, netstat, lsof, and /proc inspection

Account containment actions including disabling, password reset, and session termination

Watch out for

Common First Response exam traps

▸Collecting disk images or logs before memory and network connections, destroying the most volatile evidence first
▸Choosing account deletion instead of disabling, which removes evidence and may not stop active sessions
▸Running commands that write to the compromised host's disk, altering timestamps and artifacts

Practice set

First Response questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Read the full First Response explanation →

When documenting the chain of custody for a seized laptop, which information is mandatory?

Trap 1: The name of the suspected attacker.

This is often unknown during the initial collection phase.

Trap 2: The user's password for the laptop.

Passwords are not part of the physical chain of custody documentation.

Trap 3: The operating system version.

While useful, it is not a mandatory requirement for the chain of custody record itself.

First Response practice questions

What to know about First Response

Common First Response exam traps

First Response questions

When documenting the chain of custody for a seized laptop, which information is mandatory?

You are using EnCase Endpoint Investigator to triage a suspicious endpoint. You need to identify unauthorized processes currently running. Which feature should you utilize?

You are responding to an incident involving a compromised Windows server. You need to collect volatile data using a trusted toolkit. Which tool is standard for collecting running services and loaded DLLs?

As a first responder, you arrive at a compromised workstation showing signs of active malware beaconing. Which action should be performed first according to the Order of Volatility?

You are handling a database compromise. The database logs show evidence of SQL injection. What is the appropriate initial containment step for the database?

You discover a suspicious scheduled task on a server. Which Windows tool allows you to export this task for analysis without relying on the GUI?

A user reports a 'missing' file that was present earlier. What is the first thing you should check in a forensic triage?

Which THREE steps are involved in the standard triage process for a compromised endpoint?

Which THREE actions should be avoided during the initial response phase to ensure evidence integrity?

During a suspected ransomware incident, you are using EnCase Endpoint to perform remote triage. You need to collect volatile data without triggering the ransomware's anti-forensic triggers. Which action should you take first to ensure the integrity of evidence?

You are managing a live incident and need to preserve the network state of a Linux server. You must capture active network connections and the routing table. Which tool and flag combination is preferred by first responders to ensure minimal impact on the target system's binary integrity?

You have identified an active C2 beacon on a corporate server. You are instructed to implement 'Containment' via network segmentation. Which configuration change on a Cisco ASA firewall provides the most effective containment while still allowing for remote forensic forensic analysis?

You are assembling a 'First Responder Toolkit' for a remote incident team. Which THREE items are essential for collecting volatile data and ensuring legal defensibility on a Windows system?

A first responder is preparing to collect evidence from a compromised laptop that is still powered on. The responder must ensure that the evidence will be admissible in a court of law. Which TWO actions should the responder take to maintain the integrity of the evidence? (Choose two.)

During an incident involving a compromised domain controller, you need to collect volatile data from memory. The server is running critical authentication services and cannot be restarted. Which tool should you use to capture the memory image without disrupting operations?

A first responder is preparing to collect volatile data from a compromised Windows workstation. Which TWO actions should be performed to maintain the integrity of the evidence? (Choose two.)

A first responder is called to investigate a suspected insider threat on a Linux server. The server is still running, and the responder needs to identify which user accounts are currently logged in and from which IP addresses. Which command should be used?

You are investigating a Linux server breach. You need to capture the current state of network connections without altering the evidence. Which command-line tool is preferred by first responders?

You are performing initial containment on a cloud-based AWS EC2 instance. The instance is under a DDoS attack. What is the most effective way to isolate this specific resource?

Track your progress over time

Start a First Response only practice session

Related 212-89 topic practice pages

Incident Handling Process practice questions

Network Incidents practice questions

Malware Incidents practice questions

Web Application Incidents practice questions

Email Incidents practice questions

First Response practice questions

212-89 fundamentals practice questions

212-89 scenario practice questions

212-89 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid