How should I use these Network Incidents practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Network Incidents questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Network Incidents domain.

212-89 · topic practice

Network Incidents practice questions

Practise Certified Incident Handler (212-89) Network Incidents practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Network Incidents

Practice 10 questions Browse domain →

What the exam tests

What to know about Network Incidents

Network Incidents questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Network Incidents exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Network Incidents questions

20 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Read the full Network Incidents explanation →

When analyzing logs from a Palo Alto Networks firewall, which specific threat log field is most useful for identifying the 'User-Agent' string used by a beaconing malware to blend in with legitimate web traffic?

Trap 1: rule-name

This indicates which security policy allowed the traffic.

Trap 2: action

Action indicates whether the traffic was allowed or dropped.

Trap 3: source-ip

Source-ip identifies the host, not the application context.

Study all Network Incidents common traps →

A
rule-name
Why wrong: This indicates which security policy allowed the traffic.
B
http-user-agent
This field explicitly captures the User-Agent string from the HTTP request.
C
action
Why wrong: Action indicates whether the traffic was allowed or dropped.
D
source-ip
Why wrong: Source-ip identifies the host, not the application context.

Network Incidents practice questions

What to know about Network Incidents

Common Network Incidents exam traps

Network Incidents questions

When analyzing logs from a Palo Alto Networks firewall, which specific threat log field is most useful for identifying the 'User-Agent' string used by a beaconing malware to blend in with legitimate web traffic?

You are configuring a Cisco ASA firewall to perform deep packet inspection to mitigate lateral movement via SMB exploits. Which feature must be enabled in the modular policy framework to drop packets containing known exploit patterns?

During a network incident, you need to isolate a compromised workstation by updating the switch port configuration. Which command would you use on a Cisco Catalyst switch to move a port to a restricted VLAN?

An attacker uses 'ARP Spoofing' to perform a Man-in-the-Middle attack. Which command on a Cisco switch would prevent this by mapping MAC addresses to specific ports?

An incident responder is using NetFlow to identify a data exfiltration event. What specific field in a NetFlow v9 record provides the best indication of the total volume of data moved between two internal hosts?

You suspect a DNS tunneling attack for data exfiltration. In your DNS server logs, which characteristic is the strongest indicator of a tunnel rather than standard recursive lookups?

You are performing log correlation in a SIEM. You want to match Windows Event ID 4624 (Logon) with network traffic. Which field is the primary 'join key' to correlate the event with a specific network flow?

During an investigation into lateral movement, you notice an unusual RDP connection from a workstation to a domain controller. Which Wireshark filter would be most effective in isolating only the RDP traffic associated with that specific source IP to identify potential credential dumping activity?

You are investigating a compromised Linux host. Using 'tcpdump' to capture traffic on interface eth0 to analyze C2 communication on port 443, which command is most efficient for saving the output to a file for later analysis in Wireshark?

When segmenting a network to contain an incident, what is the best practice for a 'Jump Server' in a DMZ to limit the attack surface?

A security analyst is investigating lateral movement using PowerShell Remoting (WinRM). Which Windows Event Log should be prioritized to confirm the execution of remote commands?

You are analyzing a PCAP file to detect 'Pass-the-Hash' activity. Which SMB message type should you specifically look for in the NTLM authentication exchange?

Which technique should an incident responder use to prevent an infected host from spreading ransomware via SMB to other segments in the network?

You are identifying a compromised host by checking for beaconing behavior. Which network metric is most indicative of heartbeat-style beaconing?

Which syslog facility would typically be configured on a network device to send audit logs to a central server?

An attacker is using ICMP tunneling to exfiltrate data. What field in an ICMP echo request packet would contain the unauthorized data?

During network forensics, you need to reconstruct an HTTP file transfer from a PCAP. Which Wireshark feature allows you to extract the file object directly from the stream?

When reviewing firewall logs, you see many 'deny' events from an internal host to an external IP. What is the most likely cause?

You are using NetFlow to identify lateral movement. You see a high volume of connections from a web server to an internal database server on port 3306. What is the most appropriate next step in the investigation?

What is the purpose of 'Network Segmentation' during an active network incident?

Track your progress over time

Start a Network Incidents only practice session

Related 212-89 topic practice pages

Network Incidents practice questions

Malware Incidents practice questions

Incident Handling Process practice questions

Web Application Incidents practice questions

Email Incidents practice questions

First Response practice questions

212-89 fundamentals practice questions

212-89 scenario practice questions

212-89 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid