Free 212-89 sample questions

Correct answer: Nmap (Network Mapper)

Nmap (Network Mapper) is the most well-known free and open-source network scanning tool for port scanning, OS detection, and service enumeration. It provides comprehensive network discovery and security auditing capabilities that are essential for incident handlers. Wireshark is a packet analyzer, Snort is an intrusion detection system, and SAINT is a commercial vulnerability scanner, none of which provide the broad network mapping functionality that Nmap offers.

Correct answer: Virus

A virus is malicious code that infects computer files, corrupts or deletes data, and specifically requires a host file to propagate and spread. This host dependency is the key characteristic that distinguishes viruses from other malware types. Trojans disguise themselves as legitimate software but do not require host files, worms self-replicate across networks without needing host files, and rootkits hide malicious activity rather than requiring hosts for propagation.

Correct answer: Magnitude

Risk is commonly formulated as Risk = Events × Probability × Magnitude, where Magnitude represents the potential impact or harm that could result from an incident. The magnitude component quantifies the severity of consequences, making the risk formula complete. Probability is already mentioned in the formula, while consequences and significance are general terms that do not fit the specific mathematical risk formulation structure.

Correct answer: High level incident

High level incidents involve sensitive information disclosure to competitors, insider threats, or data breaches that require immediate senior management involvement and significant resources. The scenario describes a disgruntled employee passing sensitive access control information to a competitor, which represents a serious security breach requiring high-level incident response procedures. Middle and low level incidents involve less critical issues, while ultra-high incidents are typically reserved for catastrophic system-wide failures or major data breaches affecting thousands of records.

Correct answer: Incident Recovery

Incident Recovery is the process of rebuilding and restoring computer systems affected by an incident to normal operational status, including all processes, policies, and tools. This phase focuses specifically on system restoration and business continuity. Incident Management is the overall framework, Incident Response refers to the immediate reaction and containment actions, and Incident Handling encompasses the entire lifecycle but does not specifically refer to the restoration phase.

Correct answer: Macro Virus

Macro viruses specifically infect Microsoft Office documents like Word files by embedding malicious code in the document macros. These viruses execute when the document is opened and macros are enabled, making them particularly dangerous for document-based attacks. Micro viruses and file infectors target executable files, while boot sector viruses infect the master boot record of storage devices, none of which specifically target Word document files.

Correct answer: Access control policy

Access control policies specifically authorize groups of users to perform defined sets of actions on designated resources, establishing who can access what and under what conditions. This is the fundamental purpose of access control in organizational security. Audit trail policies track user activities, while other policy types serve different security functions but do not directly authorize user actions on resources.

Correct answer: RTIR

RTIR (Request Tracker for Incident Response) is a specialized incident tracking, reporting, and handling tool designed specifically for security incident management teams. It provides structured workflows for incident lifecycle management, reporting capabilities, and collaboration features essential for incident response. CRAMM is a risk assessment methodology, NETSTAT is a network utility command, and EAR/Pilar are not incident tracking tools.

Correct answer: Identify and report security loopholes to the management for necessary actions

Internal auditors in incident response teams are responsible for identifying and reporting security loopholes to management for necessary actions, ensuring organizational compliance and control effectiveness. Their expertise in evaluating internal controls makes them valuable for identifying systemic weaknesses that led to incidents. Configuring security controls, blocking network traffic, and coordinating containment are operational tasks typically handled by security engineers and incident handlers rather than auditors.

Correct answer: Digital evidence

Digital evidence refers to any information of probative value that is stored or transmitted in digital form during a computer crime, making it legally admissible in court proceedings. This encompasses all electronic data that can prove or disprove facts related to cyber incidents. Computer emails are just one type of digital evidence, digital investigation is the process of examining evidence, and digital forensic examiner is the person who analyzes the evidence, not the evidence itself.

Correct answer: Identification

The Identification stage of incident response involves analyzing incidents for their nature, intensity, and effects, which includes auditing system and network log files to understand what occurred. This stage focuses on determining whether a security event is actually an incident requiring response. Incident recording documents the incident, reporting communicates findings, and containment focuses on limiting the incident spread rather than initial analysis.

Correct answer: All the above

Incident Response Plans require all of the above components: financial and management support for resources and authority, expert team composition with skilled personnel from various disciplines, and adequate resources including technology, tools, and budget. A comprehensive incident response plan cannot be effective without any of these critical elements, as each component is essential for successful incident handling and organizational preparedness.