212-89 Sample Questions & Answers

The Identification stage of incident response involves analyzing incidents for their nature, intensity, and effects, which includes auditing system and network log files to understand what occurred. This stage focuses on determining whether a security event is actually an incident requiring response. Incident recording documents the incident, reporting communicates findings, and containment focuses on limiting the incident spread rather than initial analysis.

Incident Response Plans require all of the above components: financial and management support for resources and authority, expert team composition with skilled personnel from various disciplines, and adequate resources including technology, tools, and budget. A comprehensive incident response plan cannot be effective without any of these critical elements, as each component is essential for successful incident handling and organizational preparedness.

Adware is software that displays advertising banners while running and delivers ads through pop-up windows or bars on computer screens or browsers, often generating revenue for developers through ad display. Unlike malicious malware, adware primarily focuses on advertising rather than system damage. Trojans disguise malicious functionality, rootkits hide system presence, viruses self-replicate and infect files, and worms spread across networks, none of which primarily focus on advertising display.

According to Evidence Preservation policy, a forensic investigator should make at least two image copies of digital evidence to ensure data integrity and provide backup protection against corruption or damage during analysis. One copy serves as a working copy for examination while the other remains pristine for verification and legal presentation. Single copies risk evidence loss, while three or more copies may be excessive for most investigations, but two copies specifically provide the minimum redundancy needed for proper evidence preservation and chain of custody maintenance.

The most common types of intellectual property include all the mentioned forms: copyrights protecting creative works, trademarks protecting brand identifiers, patents protecting inventions, and trade secrets protecting confidential business information. Each type provides different legal protections for intangible assets. Since intellectual property encompasses multiple categories of legal protection for different types of creative and business assets, all the above represents the complete range of common intellectual property types that organizations must protect.

Business Recovery Plan is the comprehensive strategy that enables organizations to continue functioning after disastrous events through redundant hardware/software, fault-tolerant systems, and robust backup procedures. This plan specifically focuses on operational continuity and system restoration. While disaster recovery plans address immediate response, business impact analysis evaluates potential losses, and contingency plans provide alternative procedures, the Business Recovery Plan encompasses the full spectrum of organizational continuity measures.

Organizations often fail to report information security incidents primarily due to fear of negative publicity, which could damage their reputation, customer trust, and stock value. This concern about public perception frequently outweighs the benefits of incident reporting and information sharing. While costs, legal concerns, and technical challenges may be factors, the fear of reputational damage remains the predominant reason organizations avoid incident disclosure.

SURFnet-CERT is the Computer Emergency Response Team that serves as an Internet provider to higher education institutions and research institutions in the Netherlands, handling all computer security incidents involving their customers. This specialized CERT focuses on the academic and research community. Other CERTs serve different constituencies: CERT/CC coordinates global incident response, AusCERT serves Australia, and JPCERT serves Japan, but none specifically focus on Dutch higher education institutions.

Computer Security Incident Response Teams (CSIRTs) provide all the services mentioned including incident handling, vulnerability management, security awareness training, threat intelligence sharing, forensic analysis, and coordination with other security teams. CSIRTs offer comprehensive security services to support organizational incident response capabilities. Since the question asks about CSIRT services in general and multiple options would be correct, all the above represents the complete range of services these teams typically provide.

The Health Insurance Portability and Accountability Act (HIPAA) ensures the integrity, confidentiality, and availability of electronic protected health information (ePHI) of patients through comprehensive privacy and security requirements. HIPAA establishes national standards for protecting medical records and personal health information in healthcare organizations. Other acts like FISMA, SOX, and GLBA address different regulatory requirements but do not specifically focus on patient health information protection.

According to NIST SP 800-61, Functional Impact refers to the negative impact on the organization's ability to provide services (e.g., None, Low, Medium, High). Information Impact refers to confidentiality/integrity loss, and Recoverability Effort refers to the resources required to recover.

The Diamond Model of Intrusion Analysis explicitly consists of four core features: Adversary, Capability, Infrastructure, and Victim. It is used to analyze intrusion events and pivot between these points to discover more about the attack.

SOPs or Playbooks (sometimes called Runbooks) are the specific, step-by-step technical guides within an IRP that detail how to handle specific incident scenarios like ransomware or DDoS to ensure consistency and completeness.

False. The Cloud Service Provider (CSP) is responsible for security 'of' the cloud (physical, infrastructure, compute hosts), while the customer is responsible for security 'in' the cloud (data, IAM, OS configuration in IaaS).

The Gramm-Leach-Bliley Act (GLBA) specifically applies to financial institutions and mandates the protection of consumer financial information. HIPAA applies to healthcare, and FISMA applies to federal agencies.

Isolating the system from the network (physically or logically via VLAN) stops lateral movement and Command & Control (C2) communication while keeping the system powered on. This preserves the contents of RAM (volatile memory) for forensic acquisition. Powering off destroys RAM data.

The primary goal of the Lessons Learned phase is to produce a report that documents the incident timeline, evaluates the team's performance, identifies gaps (what went wrong), and provides actionable recommendations to improve future response and security posture.

Eradication involves removing the root cause (malware, bad accounts) and mitigating vulnerabilities to prevent re-infection. Restoration happens in the Recovery phase, and Evidence Preservation happens in Containment/First Response.

Eradication involves removing the root cause (malware, bad accounts) and mitigating vulnerabilities to prevent re-infection. Restoration happens in the Recovery phase, and Evidence Preservation happens in Containment/First Response.

Validation is a critical part of Recovery. Before fully closing the incident, the team must verify that the remediation was successful. Monitoring the system for recurrence of the specific symptom (C2 beaconing) is the best validation method.

When dealing with insider threats, especially within IT, standard corporate channels (Email, Slack, VoIP) may be monitored by the suspect. Out-of-Band (OOB) communication is required to maintain operational security.