How should I use these Malware Incidents practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Malware Incidents questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Malware Incidents domain.

212-89 · topic practice

Malware Incidents practice questions

Practise Certified Incident Handler (212-89) Malware Incidents practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Malware Incidents

Practice 10 questions Browse domain →

What the exam tests

What to know about Malware Incidents

Malware Incidents questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Malware Incidents exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Malware Incidents questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Malware Incidents explanation →

You are using Wireshark to analyze traffic from an infected host. You notice consistent beaconing activity to an external IP on port 443. How do you isolate this traffic in your capture?

Trap 1: tcp.port == 80

This would only show HTTP traffic, not the specific beaconing traffic.

Trap 2: frame.len > 1000

This isolates large packets, not specific C2 beaconing.

Trap 3: http.request

This only shows HTTP requests, potentially missing encrypted beaconing.

Study all Malware Incidents common traps →

A
ip.addr == [IP_ADDRESS]
This filter restricts the display to traffic involving the specific IP.
B
tcp.port == 80
Why wrong: This would only show HTTP traffic, not the specific beaconing traffic.
C
frame.len > 1000
Why wrong: This isolates large packets, not specific C2 beaconing.
D
http.request
Why wrong: This only shows HTTP requests, potentially missing encrypted beaconing.

Malware Incidents practice questions

What to know about Malware Incidents

Common Malware Incidents exam traps

Malware Incidents questions

You are using Wireshark to analyze traffic from an infected host. You notice consistent beaconing activity to an external IP on port 443. How do you isolate this traffic in your capture?

You are analyzing a malware sample using Cuckoo Sandbox. The report shows the malware is attempting to modify the 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run' registry key. What is the intent of this activity?

You are performing a live memory analysis using Volatility 3. You suspect a rootkit is hiding processes. Which plugin should you run to compare the process list from the EPROCESS block with the thread scheduler's list?

A malware infection has encrypted several network shares. You decide to restore from backups. What is the most critical step to perform before restoring data to the production environment?

You are using YARA to detect a specific strain of ransomware. You want to match a file if it contains a specific hex string OR a specific string value. How do you construct this in your rule?

During an incident, you need to isolate a compromised workstation from the network immediately. Which action is the most effective containment strategy while preserving volatile memory?

An analyst is reviewing logs from an EDR solution. They see a 'process hollowing' event. What is the primary purpose of this malware technique?

During a malware incident response, you identify a suspicious process with PID 4452 using Sysinternals Process Explorer. You need to verify the file's reputation before isolation. Which action allows you to do this directly within the tool?

You are analyzing a malware sample in a lab. You notice the malware uses the 'CreateRemoteThread' API. What is the objective of this malware activity?

You are reviewing logs from an EDR and see an indicator of 'Living off the Land' (LotL). Which tool usage would be considered an LotL attack?

You have identified an infected machine and need to perform a memory dump before it is wiped. Which tool is the industry standard for acquiring a full memory dump on a Windows machine for incident response?

A user reports their system is running slowly, and you observe a suspicious file in 'C:\Users\[User]\AppData\Local\Temp'. What is the most appropriate first step in your investigation?

After eradicating a malware infection, you need to ensure the system is hardened against future occurrences. Which action is most effective against fileless malware?

An incident handler is analyzing a malware incident that used a phishing email. What is the most important field to check in the email header to determine the true origin of the email?

You are analyzing a malware sample that uses Domain Generation Algorithms (DGA). What is the primary purpose of DGA in malware?

A malware sample was found to use a 'Mutex' to ensure only one instance of the malware runs at a time. What tool would you use to find the Mutex name on an infected host?

Which document is essential to maintain during a malware incident to ensure accountability and track the actions taken by the incident response team?

You are performing forensic analysis on a suspicious file. You need to determine if it is a packed executable. Which tool is most effective for viewing the file's section headers to identify anomalies?

You suspect a malware incident caused unauthorized data exfiltration. Which log source is most useful to identify the destination IP of the exfiltrated data?

A system has been infected by a worm that is spreading across the network. What is the most immediate action to stop the spread?

Track your progress over time

Start a Malware Incidents only practice session

Related 212-89 topic practice pages

Network Incidents practice questions

Malware Incidents practice questions

Incident Handling Process practice questions

Web Application Incidents practice questions

Email Incidents practice questions

First Response practice questions

212-89 fundamentals practice questions

212-89 scenario practice questions

212-89 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid