Certified Incident Handler 212-89 practice test

You suspect a CSRF (Cross-Site Request Forgery) attack. What log entry pattern confirms this?

After a major security breach, you are tasked with conducting a lessons learned meeting. Which of the following is the PRIMARY objective of this meeting?

A security analyst notices that an internal web server is receiving a large number of HTTP requests with unusually long and complex query strings, causing the server's CPU usage to…

You suspect a DNS tunneling attack for data exfiltration. In your DNS server logs, which characteristic is the strongest indicator of a tunnel rather than standard recursive lookup…

An incident handler is documenting the timeline of a security breach. The handler discovers that system clocks on different servers are not synchronized. Which action should the ha…

You are using YARA to detect a specific strain of ransomware. You want to match a file if it contains a specific hex string OR a specific string value. How do you construct this in…

You are analyzing an incident where a user account is being used to exfiltrate data. What is the most immediate action to contain the account?

Which role in the Incident Response Team is primarily responsible for ensuring that the incident handling activities remain aligned with organizational legal and privacy requiremen…

You are handling a malware incident on a Windows server and need to determine whether the malware has established persistence. Which two registry locations should you inspect first…

Which THREE components are typically involved in a web application's logging infrastructure that an incident responder should audit?

A malware incident has been identified on a corporate workstation. The incident response team is following the containment, eradication, and recovery phases. Which TWO of the follo…

You are the first responder to a Linux server that is suspected of being compromised. You need to collect volatile data in the order of volatility. Which command should you run fir…

Which THREE of the following characterize potential lateral movement using RDP in a domain environment?

Which TWO actions are recommended for evidence preservation in a digital incident?

During an incident response engagement, a first responder is collecting volatile data from a compromised Windows server. The responder needs to capture the current network connecti…

You are dealing with a legal hold request for data related to an investigation. How should you handle the data retention policy for this specific case?

Which THREE of the following are common indicators of a phishing email?

An incident handler is reviewing a suspicious executable found on a compromised Windows system. The file has a double extension, such as 'invoice.pdf.exe'. Which type of malware de…

You are investigating a compromised Linux host. Using 'tcpdump' to capture traffic on interface eth0 to analyze C2 communication on port 443, which command is most efficient for sa…

Which THREE of the following are key components of a network-based containment strategy?

Which tool would you use to perform a live analysis of HTTP traffic and inspect for malicious payloads in real-time?

During an investigation into lateral movement, you notice an unusual RDP connection from a workstation to a domain controller. Which Wireshark filter would be most effective in iso…

A web application is vulnerable to session fixation. What is the primary indicator of this attack in the logs?

A web application is returning verbose error messages that include full stack traces and database query fragments to users. An attacker is using these messages to map the applicati…