212-89 Practice Questions

At a major healthcare provider, staff received phishing emails impersonating HR. Reporting via email failed due to mail system issues. The IR team introduced VOIP and SMS-based reporting mechanisms. Which preparatory step was implemented?

A colleague wants to minimize their security responsibility because they are in a small organization. They are evaluating a new application that is offered in different forms. Which form would result in the least amount of responsibility for the colleague?

Liam, a network engineer, configures firewalls to prevent outbound file transfers over unauthorized FTP and HTTP channels. Despite this, an insider used encrypted traffic via HTTPS to exfiltrate data. A review revealed that no deep packet inspection was in place. Which insider threat eradication control could have helped prevent this?

After noticing unusual behavior in certain employee inboxes, such as unexplained message redirection to unfamiliar external services, the IR team suspected account compromise. Despite resetting credentials and terminating active sessions, the unauthorized transfers persisted through embedded configuration anomalies. Analysts moved to eliminate lingering traces and neutralize the exploitation pathway using precision remediation techniques. Which of the following best supports the eradication effort?

Emily, a member of the cybersecurity response team, receives an alert indicating suspicious login attempts on the company’s internal HR portal. Upon inspection, she finds several failed login attempts from a foreign IP address targeting administrative accounts. Further investigation reveals that one of the accounts was compromised and its privileges were escalated. What indicator most strongly suggests this is an unauthorized access incident?

Which of the following digital evidence temporarily stored on a digital device that

requires a constant power supply and is deleted if the power supply is interrupted?

Which stage of the incident response and handling process involves auditing the system and network log files?

Which of the following is a volatile evidence collecting tool?

EnviroTech, a global environmental research institute, faced anomalies in six months of satellite weather data. Unauthorized data modification entries were found in logs, occurring in microbursts with minimal traces. While the intent was unclear, the implications were significant. What's the optimal response?

ClobalTech, an avant-garde tech giant, became victim to a massive data breach. The perpetrator was identified as an inside employee who had been with the company for over a decade. The breach unveiled sensitive client data that severely tarnished the company's reputation. ClobalTech is now revamping its security strategy. What should be its primary emphasis?