Certified Incident Handler (212-89) (212-89) — Questions 76–150

A web application's logs indicate an attacker successfully performed an XML External Entity (XXE) injection. What was likely the source of this vulnerability?

Which TWO criteria must a first responder satisfy when choosing a tool for a toolkit?

During a Cross-Site Scripting (XSS) incident, you notice the WAF is blocking legitimate user sessions. What is the most effective tuning step to prevent false positives while maintaining protection?

You are preparing a final report for an incident. Which element is mandatory for ensuring the report serves as a valid document for future insurance or legal claims?

A user reports a 'missing' file that was present earlier. What is the first thing you should check in a forensic triage?

Which THREE categories of stakeholders should be considered for notification in a major data breach?

A system has been infected by a worm that is spreading across the network. What is the most immediate action to stop the spread?

An organization is establishing an Incident Response (IR) team. According to NIST, which team structure is most suitable for a large, globally distributed organization that requires localized response capability with centralized oversight?

You are handling a ransomware incident. Which step should be taken before attempting any file recovery?

Which THREE of the following are common indicators of a phishing email?

Which THREE of the following are effective methods for protecting backup systems from being encrypted by ransomware?

Which THREE actions are essential when performing log review after a web application attack?

You are dealing with a legal hold request for data related to an investigation. How should you handle the data retention policy for this specific case?

Which technique should an incident responder use to prevent an infected host from spreading ransomware via SMB to other segments in the network?

Which TWO of the following techniques would an attacker likely use to hide lateral movement traffic within a network?

You are analyzing an email with a suspicious attachment. You notice the file name is 'invoice.pdf.exe'. What does this indicate?

Which TWO of the following are common signs of a compromised switch in a local area network?

Which THREE of the following are critical requirements for maintaining a valid Chain of Custody?

During an incident, you need to isolate a compromised workstation from the network immediately. Which action is the most effective containment strategy while preserving volatile memory?

When performing manual phishing triage, which action should an analyst perform first after identifying a suspicious URL in an email body?

Which TWO pieces of information must be collected to successfully track a session hijacking attack across multiple log sources?

Which THREE of the following are key components of a network-based containment strategy?

Which TWO of the following are common indicators that an incident should be declared?

During a malware incident response, you identify a suspicious process with PID 4452 using Sysinternals Process Explorer. You need to verify the file's reputation before isolation. Which action allows you to do this directly within the tool?

Which TWO of the following are common sources for incident identification?

You are performing forensic analysis on a suspicious file. You need to determine if it is a packed executable. Which tool is most effective for viewing the file's section headers to identify anomalies?

A security analyst is investigating lateral movement using PowerShell Remoting (WinRM). Which Windows Event Log should be prioritized to confirm the execution of remote commands?

You are managing chain of custody for a physical server seized during an investigation. What is the most critical action to ensure the evidence remains admissible in court?

Which of the following is an example of a non-volatile data source?

You suspect an incident involves an insider threat. Which step should be taken FIRST to preserve the integrity of the potential evidence while minimizing system downtime?

You are using a SIEM to correlate events during an investigation. What is the primary advantage of correlation in incident analysis?

You are choosing a destination for forensic image storage. What is the most critical characteristic of this storage?

You are auditing Apache logs to detect potential OS command injection. Which characters should you search for in the access logs?

You are performing initial containment on a cloud-based AWS EC2 instance. The instance is under a DDoS attack. What is the most effective way to isolate this specific resource?

An analyst is drafting an email to a user who reported a phishing attempt. What is the most important tone to maintain?

During an investigation into lateral movement, you notice an unusual RDP connection from a workstation to a domain controller. Which Wireshark filter would be most effective in isolating only the RDP traffic associated with that specific source IP to identify potential credential dumping activity?

A developer reports that a specific user is receiving 500 Internal Server Errors. Where is the first place to look to determine if this is an incident?

You are performing a triage on a server and see unauthorized outbound connections to a foreign IP. What is the best way to determine which process initiated the connection?

An attacker is using a specific User-Agent to scan your web application. How do you block them effectively?

A web application is vulnerable to session fixation. What is the primary indicator of this attack in the logs?

Which TWO of the following are common network-based indicators of a compromised host attempting to perform network discovery?

Which TWO of the following are primary objectives of the 'Lessons Learned' phase?

When responding to a SQL injection incident, which TWO areas of the database server logs should be prioritized for review?

During an incident, why is it important to keep the 'Incident Log' updated in real-time?

You are assembling a 'First Responder Toolkit' for a remote incident team. Which THREE items are essential for collecting volatile data and ensuring legal defensibility on a Windows system?

You discover a suspicious scheduled task on a server. Which Windows tool allows you to export this task for analysis without relying on the GUI?

When documenting evidence for a forensic investigation, you are required to establish a chain of custody. Which information is considered mandatory for each entry in the chain of custody log to satisfy legal requirements?

Which TWO log file attributes are essential for identifying the source of an attack coming through a load balancer?

During an incident, a responder needs to capture the ARP cache to identify potential local spoofing. Which tool provides this information?

Which of the following is a symptom of an 'Email Forwarding Rule' attack?

An attacker is using a slow-rate HTTP POST request to exhaust server resources. Which ModSecurity directive should be adjusted to mitigate this behavior?

Which THREE indicators in a web access log suggest a directory traversal attempt?

You are assessing the effectiveness of a containment strategy for a worm spreading through the network. What is the most effective metric to use?

During the triage of a Linux server, you suspect a rootkit is intercepting system calls. Which THREE actions are appropriate for the first responder to perform to gather evidence of the rootkit?

An analyst identifies that an email originated from an unauthorized IP address despite passing SPF. What is the most likely cause?

As a first responder, you arrive at a compromised workstation showing signs of active malware beaconing. Which action should be performed first according to the Order of Volatility?

When analyzing an XSS attack, you find that the payload is being injected through a hidden form field. Which WAF policy is best suited to block this?

You are using YARA to detect a specific strain of ransomware. You want to match a file if it contains a specific hex string OR a specific string value. How do you construct this in your rule?

You need to capture forensic data from a Windows machine using a remote agent. What is the risk of using built-in administrative tools like PowerShell for this?

Which THREE of the following could be considered 'indicators of compromise' (IOCs) for an email incident?

Which THREE items should be included in an incident report following a successful SQL injection attack?

You are performing a live memory analysis using Volatility 3. You suspect a rootkit is hiding processes. Which plugin should you run to compare the process list from the EPROCESS block with the thread scheduler's list?

During the 'Recovery' phase of the malware incident, what must be done to ensure the environment is safe before reconnecting the restored systems?

You suspect a DNS tunneling attack for data exfiltration. In your DNS server logs, which characteristic is the strongest indicator of a tunnel rather than standard recursive lookups?

You are analyzing an incident where a user account is being used to exfiltrate data. What is the most immediate action to contain the account?

A user reports their system is running slowly, and you observe a suspicious file in 'C:\Users\[User]\AppData\Local\Temp'. What is the most appropriate first step in your investigation?

You are performing an incident investigation involving a suspected insider threat. Under GDPR compliance, you must ensure that your data collection methods adhere to the 'data minimization' principle. Which action best aligns with this requirement?

You are performing log correlation in a SIEM. You want to match Windows Event ID 4624 (Logon) with network traffic. Which field is the primary 'join key' to correlate the event with a specific network flow?

During a suspected data breach, you must collect volatile memory. Which tool and command is the industry-standard starting point for capturing an image of RAM in a Windows-based incident?

When reviewing network traffic for C2 communication, which THREE of the following indicators are commonly observed?

Which THREE of the following tools would be most effective for performing live memory forensics on a compromised Windows workstation?

Which TWO of the following sources of information are most helpful for building an Indicators of Compromise (IoC) list during an investigation?

Which TWO actions are recommended for evidence preservation in a digital incident?

Which THREE of the following are appropriate communication channels to keep users informed during an email phishing incident?

Which team should be notified first in the event of a confirmed external data breach involving customer PII?