Free 212-89 Practice Test

In a healthcare context, the primary objective of an incident response framework is to minimize disruption and restore critical systems swiftly. A ransomware attack directly halts access to patient data, which can delay diagnoses, treatments, and emergency services. Therefore, maintaining operational continuity is paramount to ensure uninterrupted patient care and prevent potential harm or loss of life. This immediate impact on human well-being underscores the critical importance of a robust response plan, making it the most significant factor compared to regulatory, financial, or reputational consequences.

B. Reporting is a mandatory compliance task, but the framework's primary purpose is operational recovery to protect patient safety, not just fulfill legal obligations.
C. Overhauling infrastructure is a long-term strategic decision made after recovery and root cause analysis, not the immediate focus of incident handling.
D. Reputational damage is a serious consequence, but in healthcare, the immediate risk to patient safety and life takes precedence over public perception.

1. National Institute of Standards and Technology (NIST). (2012). Special Publication 800-61 Rev. 2: Computer Security Incident Handling Guide. Section 2.3.3

"Incident Response

" emphasizes minimizing loss and destruction and mitigating weaknesses to restore IT services.

2. Kruse

C. S.

Frederick

B.

Jacobson

T.

& Monticone

D. K. (2017). Cybersecurity in healthcare: A systematic review of modern threats and trends. Technology and Health Care

25(1)

1-10. https://doi.org/10.3233/THC-161263. The paper highlights that the primary impact of cyberattacks in healthcare is the disruption of services essential for patient care.

3. Coventry

L.

& Branley

D. (2018). Cybersecurity in healthcare: A narrative review of trends

threats and ways forward. Maturitas

113

48-52. https://doi.org/10.1016/j.maturitas.2018.04.008. This review emphasizes that the core mission of healthcare organizations is patient care

making operational continuity the top priority during a security incident.

The process described involves taking raw outbound network traffic data and organizing it into "time-ordered domain sequences" based on "user activities within a certain time period." This is the definition of user-specific sessionization. Sessionization is a critical data preprocessing step that reconstructs a user's sequence of actions (in this case, visiting domains) from discrete log entries. This creates structured sessions that can then be analyzed for patterns, such as the sequence of events characteristic of a watering hole attack where a user visits a legitimate site and is then redirected to a malicious one.

A. Filtering invalid host names: This is a data cleaning step to remove malformed or non-resolvable domain entries, not to create time-ordered user activity sequences.
B. Identifying unpopular domains: This is a frequency analysis technique applied after preprocessing to find anomalies, not the process of creating the user sessions themselves.
C. Host name normalization: This step standardizes domain names (e.g., www.example.com to example.com) for consistent analysis but does not involve sequencing user activities over time.

1. Lee

S.

Kim

J.

Lee

S.

& Kim

J. (2017). WOHD: A Watering Hole Attack Detection System Based on User Browsing Behavior. In Applied Sciences

7(9)

868. This paper describes a system for detecting watering hole attacks and explicitly states: "The first step is to reconstruct user sessions from the raw web proxy logs. A session is a sequence of web requests made by a user within a certain time period." (Section 3.1

Paragraph 1). DOI: https://doi.org/10.3390/app7090868

2. Kambourakis

G.

& Tsochou

A. (2020). A Comprehensive Technical Review on the Watering Hole Attack. In IEEE Access

8

169636-169656. The review discusses detection methods based on analyzing web traffic and user behavior

which inherently requires preprocessing steps like sessionization to group related user activities for sequential analysis. (Section IV. B. Detection Methods). DOI: https://doi.org/10.1109/ACCESS.2020.3023802

3. Zarras

A.

& D'ovidio

F. (2014). Automated discovery of watering-hole attacks. Proceedings of the 23rd International Conference on World Wide Web. The methodology involves analyzing user browsing histories

which are constructed by sessionizing raw HTTP logs. The paper notes the need to "reconstruct the browsing history of each user" as a preliminary step. (Section 3

Paragraph 2). DOI: https://doi.org/10.1145/2567948.2577325

The analysis of a drive image is a form of static analysis, also known as post-mortem analysis. This process involves examining a bit-for-bit copy of a storage device (the image) in a non-running state. The data is "at rest," allowing the investigator to conduct a thorough and repeatable examination of the file system, deleted files, and other artifacts without altering the original evidence or being constrained by a live operating system. This is the most common form of digital forensic analysis for non-volatile storage media.

A. Real-time: Real-time analysis involves monitoring a system for events as they happen, which is not applicable to a static, previously created drive image.
C. Dynamic: Dynamic analysis involves executing programs or code from the evidence (e.g., in a sandbox) to observe their behavior, not analyzing the static data on a disk image.
D. Live: Live analysis is performed on a running computer system to capture volatile data like RAM, running processes, and network connections, which is the opposite of analyzing a static image. ---

1. National Institute of Standards and Technology (NIST). (2006). Guide to Integrating Forensic Techniques into Incident Response (Special Publication 800-86).

Section 3.3.2

Post-Mortem Hard Drive Analysis

Page 21: "Post-mortem hard drive analysis is the most common form of digital forensic analysis. It involves analyzing the contents of a hard drive that has been taken out of a system. The same analysis can be performed on a bit-stream image of a hard drive." This directly defines the scenario as post-mortem (static) analysis.

2. Kent

K.

Chevalier

S.

Grance

T.

& Dang

H. (2006). Guide to Computer Security Log Management (NIST Special Publication 800-92).

Section 4.3

Data Collection

Page 4-4: The document distinguishes between collecting data from live systems and static data sources. It states

"Static data is data that does not change

such as a disk image..." This reinforces that a disk image is a source for static analysis.

3. Beebe

N. L. (2009). Digital Forensic Research: The Good

the Bad

and the Unaddressed. In H.S. Venter et al. (Eds.)

Proceedings of the 2009 Information Security for South Africa Conference (ISSA 2009).

Section 2.1

Live vs. Postmortem Forensics: The paper distinguishes the two approaches: "Postmortem forensics refers to the analysis of data at rest (i.e.

on a hard drive

flash drive

etc. that is not currently running)." This academic source clearly categorizes the analysis of a drive image as postmortem

which is synonymous with static analysis.

4. Garfinkel

S. (2010). Digital forensics research: The next 10 years. Digital Investigation

7

S64-S73. https://doi.org/10.1016/j.diin.2010.05.009

Section 3.1

Dead vs. Live Analysis: The paper discusses "dead analysis" (another term for static/post-mortem) as the examination of a disk image

contrasting it with "live analysis" performed on a running system. This further solidifies the terminology and concept.

The scenario describes the use of automated tools to identify hosts, services, and vulnerabilities. This process involves actively sending probes, queries, and packets to the target systems and analyzing their responses. This direct interaction with the network is the defining characteristic of an active assessment. While the assessment could be internal or external, the methodology described is definitively active. Passive assessment, by contrast, would involve monitoring network traffic without directly engaging the target systems. Since the actions described are explicitly interactive, "Active assessment" is the most accurate classification.

A. Internal assessment: This is incorrect because the scenario does not specify Dickson's location. An internal assessment is performed from within the network perimeter, which is not stated.
C. Passive assessment: This is incorrect as the process involves using tools to "identify" hosts and services, which implies active probing, not passively sniffing traffic or analyzing logs.
D. External assessment: This is incorrect because, similar to internal assessment, the scenario provides no information about whether the scan originates from outside the organization's network.

1. National Institute of Standards and Technology (NIST) Special Publication 800-115, Technical Guide to Information Security Testing and Assessment, Section 4.2, Page 4-2. The document distinguishes between active and passive scanners: "Active scanners...interact directly with the target...by sending probes to the target and analyzing the feedback." This directly matches the actions described in the scenario.

2. Kim, D., & Solomon, M. G. (2016). Fundamentals of information systems security. Jones & Bartlett Learning. Chapter 7, "Security Operations," discusses vulnerability assessment types. It defines active scanning as directly probing systems for vulnerabilities, contrasting it with passive scanning, which analyzes traffic. The scenario clearly aligns with the definition of active scanning.

3. University of California, Berkeley. Information Security and Policy Courseware, "Vulnerability Scanning Service Definition." The documentation defines active scanning as a method that "sends traffic to a device to determine its operating system, services, and vulnerabilities." This aligns with Dickson's task of using automated tools to identify hosts, services, and vulnerabilities.

Risk assumption, also known as risk acceptance, is a strategy where an organization makes a conscious decision to accept the potential loss from a risk and continue operating. This decision is made under two primary conditions described in the question:
1. After implementing controls (risk mitigation) that reduce the risk to a level deemed acceptable by the organization (accepting the residual risk).
2. When the cost of mitigation outweighs the potential loss, leading to the acceptance of the risk in its current state. Both scenarios involve a deliberate choice to assume the risk and proceed with the IT system's operation.

B. Risk avoidance: This strategy involves eliminating the risk by ceasing the activity that causes it, which is the opposite of continuing to operate the system.
C. Risk planning: This is the overarching process of identifying, analyzing, and determining how to handle risks; it is not a specific response strategy itself.
D. Risk transference: This strategy involves shifting the financial impact of a risk to a third party, such as through insurance or outsourcing, not accepting it internally.

1. NIST Special Publication 800-30

Revision 1

Guide for Conducting Risk Assessments.

Section 3.3

Page 49: This section outlines risk response options. It defines Risk Acceptance as the appropriate response when the identified risk is within the organizational risk tolerance. It states

"Organizations can accept risk deemed to be residual risk... or risk that cannot be avoided

shared

or mitigated." This directly supports the concept of accepting risk after controls bring it to an "acceptable level."

2. NIST Special Publication 800-37

Revision 2

Risk Management Framework for Information Systems and Organizations.

Section 2.5

Page 20

"Step 5: Authorize": This step involves the authorizing official making an explicit risk acceptance decision. It states

"The risk determination... provides the authorizing official with the necessary information to make a credible

risk-based decision to either authorize the system... or not to authorize the system." This authorization is a formal act of risk assumption.

3. Carnegie Mellon University

Software Engineering Institute (SEI)

Continuous Risk Management Guidebook.

Chapter 6

"Mitigation

" Page 69: The guidebook describes risk handling strategies. It notes that after mitigation planning

a decision is made. "Accepting the risk means that the project team has decided to live with the risk... This is a valid response if the risk impact is low or the probability of occurrence is small." This aligns with the second part of the question's description.

The action performed by Robert, which is restoring the web application service using existing backups, directly corresponds to the Recovery phase of the Incident Handling and Response (IH&R) process. This phase focuses on restoring systems to normal operation after a security incident has been contained and eradicated. The primary goal of recovery is to bring affected systems back online, validate their functionality, and resume business operations, thereby ensuring business continuity. Restoring from a known-good backup is a fundamental recovery task.

A. Evidence gathering and forensics analysis: This stage involves collecting and analyzing data to understand the incident's scope and cause. Robert's action is restorative, not investigative.
B. Eradication: This stage focuses on eliminating the root cause of the incident, such as removing malware or patching vulnerabilities, which typically precedes the recovery of services.
C. Notification: This involves communicating the incident to relevant stakeholders, such as management, legal teams, or customers. It is a procedural step, not a technical restoration activity.

1. NIST Special Publication 800-61 Rev. 2

"Computer Security Incident Handling Guide":

Section 3.4.2

Recovery (Page 33): This section explicitly defines the recovery phase. It states

"In the recovery phase

administrators restore systems to normal operation

confirm that the systems are functioning normally

and (if applicable) remediate vulnerabilities to prevent similar incidents." It further mentions that this may involve "restoring systems from clean backups." Robert's action is a direct implementation of this principle.

2. Carnegie Mellon University

Software Engineering Institute

"CSIRT Services":

Incident Handling Service (Page 4): In the description of the incident handling lifecycle (which mirrors the NIST model)

the "Recovery" step is described as the process of "restoring the affected systems

services

resources

and data to a normal

trusted operational state." This aligns perfectly with restoring a web application from backups.

3. SANS Institute

"The Incident Handler's Handbook":

Section: The Six Steps (Page 5): The SANS/NIST model outlines six steps. Step 5

"Eradication & Recovery

" is a combined phase. The recovery component is defined as the process of restoring data from backups and returning systems to a production state after the threat has been removed. Robert's action is the recovery part of this step.

The digital forensic investigation process is typically divided into distinct phases. The scenario describes Bob performing analysis on evidence that has already been acquired and preserved. This activity—examining data to identify the source of an attack, understand the methods used, and identify the perpetrator—is the core of the Investigation phase. This phase encompasses the technical procedures of evidence collection, examination, and analysis, which directly follows the initial preparation (Pre-investigation) and precedes the final reporting (Post-investigation).

A. Vulnerability assessment phase: This is a proactive security practice to identify and mitigate potential weaknesses before an incident occurs, not a phase of a reactive forensic investigation.
B. Post-investigation phase: This phase occurs after the analysis is complete and primarily involves documenting findings, creating the final report, and providing expert testimony.
C. Pre-investigation phase: This phase involves all preparatory tasks performed before handling evidence, such as obtaining authorization, planning the investigation strategy, and assembling the toolkit.

1. National Institute of Standards and Technology (NIST). (2006). Guide to Integrating Forensic Techniques into Incident Response (Special Publication 800-86). Section 2.3, "The Forensic Process," outlines the core phases as Collection, Examination, Analysis, and Reporting. Bob's actions of "performing analysis on acquired evidentiary data" fall directly into the Examination and Analysis phases, which are the central components of the overall Investigation phase.

2. Valjarevic, A., & Venter, H. S. (2012). A comprehensive digital forensic investigation model. In 2012 Information Security for South Africa, IEEE. This academic paper discusses various forensic models, which consistently place evidence analysis as a central part of the main investigative stage, distinct from pre-investigation (preparation) and post-investigation (reporting). (DOI: https://doi.org/10.1109/ISSA.2012.6320453)

3. University of Washington. (n.d.). Digital Forensics - CSE 490F. Courseware, Paul G. Allen School of Computer Science & Engineering. The course syllabus outlines the "Digital Forensics Process," which includes phases such as "Acquisition/Preservation" and "Analysis." Bob has completed acquisition and is now in the Analysis stage, which is part of the broader investigation. (Available via UW CSE course archives).

The malware's objective is to identify "useful services" running on the compromised system. Network services (e.g., HTTP, FTP, SSH) listen for incoming connections on specific network ports. A port scan is a reconnaissance technique designed specifically to probe a target host to discover which ports are open and, by extension, which services are active and listening. This method provides the most direct and comprehensive information to fulfill the malware's goal of mapping available services for potential further exploitation or data exfiltration.

A. IP range sweep: This technique identifies active hosts on a network but does not provide information about the specific services running on them.
B. Packet sniffing: This is a passive method of capturing traffic. It can only identify services that are currently communicating, not all available services.
C. Session hijack: This is an attack to take over an existing, authenticated user session, not a method for discovering network services.

1. National Institute of Standards and Technology (NIST). (2008). Technical Guide to Information Security Testing and Assessment (NIST Special Publication 800-115).

Section 4.3.1

"Network Port and Service Identification

" Page 4-10: "Port scanning is the process of connecting to TCP and UDP ports on a target system to determine what services are running or in a listening state... The basic port scanning process involves sending a message to each port

one at a time

and analyzing the response." This directly aligns with the malware's goal.

2. Saltzman

R. M. (2017). Lecture 15: Network Security. MIT OpenCourseWare

6.858 Computer Systems Security

Fall 2014.

Slide 10

"Port scanning": The lecture notes explicitly state the goal of port scanning is to "Find out what services are running on a machine" by attempting to connect to a range of TCP/UDP ports.

3. Hutchins

E. M.

Cloppert

M. J.

& Amin

R. M. (2011). Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains. Lockheed Martin Corporation.

Page 6

"Reconnaissance": While the question places the malware post-exploitation

the action itself is a form of internal reconnaissance. The paper describes how adversaries

once inside

"conduct internal reconnaissance to map the network and identify high-value targets." Port scanning is a fundamental technique for this internal mapping of services.

The scenario describes James building an incident handling and response (IH&R) team and creating the associated plan. These are foundational, proactive activities performed to establish an organization's capability to respond to security incidents. According to standard incident response lifecycle models, such as the one detailed in NIST SP 800-61, these tasks are the core components of the Preparation phase. This phase occurs before any incident takes place and ensures that the necessary policies, procedures, personnel, and tools are in place to handle future events effectively. James is establishing the framework for response, not reacting to an active incident.

A. Eradication: This is a reactive phase that involves removing the root cause of an incident after it has been identified and contained.
B. Recovery: This phase focuses on restoring affected systems and services to normal operation after a threat has been eradicated.
D. Notification: This is the process of informing relevant stakeholders (e.g., management, legal, customers) about an incident, which occurs during or after an incident, not in the initial planning stage.

1. National Institute of Standards and Technology (NIST). (2012). Special Publication 800-61 Rev. 2

Computer Security Incident Handling Guide.

Section 2.3.1

"Preparation" (Page 8): This section explicitly states that the preparation phase includes "establishing and training an incident response team" and creating "policies and procedures for incident handling." James's activities directly align with this definition.

2. Carnegie Mellon University

Software Engineering Institute. (2004). State of the Practice of Incident Response. CMU/SEI-2004-TR-001.

Section 3.1

"Preparing to Handle Incidents" (Page 11): This section describes the preparation phase as involving the creation of policies

plans

procedures

and the formation of the incident response team

which is precisely what James is tasked with.

3. University of Washington

UW-IT. (n.d.). Incident Response. Courseware/Documentation.

"Incident Response Lifecycle" section: The documentation

based on the SANS/NIST model

defines the "Preparation" phase as the stage where "policies and procedures are developed" and "the team is created and trained." This directly supports the conclusion that James is in the Preparation phase.

Broken account management refers to vulnerabilities within the functions that handle the user account lifecycle, such as password resets, account recovery, and updates. When these features are implemented insecurely, they can create a weak point that bypasses the primary authentication scheme. For instance, if an attacker can predict or manipulate the password reset tokens sent to a user's email, they can take over the account without ever needing to know the original password. This directly undermines the security of the entire authentication system.

A. SQL injection: This is a database attack technique where malicious SQL code is inserted into input fields, not a vulnerability in account management logic itself.
C. Directory traversal: This attack exploits improper path handling to access files and directories stored outside the intended web root folder, unrelated to account functions.
D. Cross-site scripting: This involves injecting malicious scripts into a web page to be executed by other users' browsers, targeting the user, not the backend account logic.

1. OWASP Foundation. (2021). OWASP Top 10:2021. A07:2021 – Identification and Authentication Failures. The document states, "Failures can occur when... password reset and recovery workflows are not secure." This directly aligns with the concept of broken account management functions weakening authentication. (Reference: owasp.org/Top10/A072021-IdentificationandAuthenticationFailures/)

2. Felten, E. W., & Miller, A. (2018). Security, Lecture 10: Web Security. Princeton University, COS 432. The lecture notes discuss authentication systems and their common failure points, including insecure password recovery mechanisms as a critical vulnerability that subverts standard login protections.

3. Boneh, D. (2018). CS 155: Computer and Network Security, Lecture 5: Web Security Model. Stanford University. The course materials cover authentication and session management, detailing how flaws in secondary mechanisms like password reset can lead to complete account compromise, fitting the description of broken account management.