Free 212-89 sample questions

Correct answer: Macro Virus

Macro viruses specifically infect Microsoft Office documents like Word files by embedding malicious code in the document macros. These viruses execute when the document is opened and macros are enabled, making them particularly dangerous for document-based attacks. Micro viruses and file infectors target executable files, while boot sector viruses infect the master boot record of storage devices, none of which specifically target Word document files.

Correct answer: Access control policy

Access control policies specifically authorize groups of users to perform defined sets of actions on designated resources, establishing who can access what and under what conditions. This is the fundamental purpose of access control in organizational security. Audit trail policies track user activities, while other policy types serve different security functions but do not directly authorize user actions on resources.

Correct answer: RTIR

RTIR (Request Tracker for Incident Response) is a specialized incident tracking, reporting, and handling tool designed specifically for security incident management teams. It provides structured workflows for incident lifecycle management, reporting capabilities, and collaboration features essential for incident response. CRAMM is a risk assessment methodology, NETSTAT is a network utility command, and EAR/Pilar are not incident tracking tools.

Correct answer: Identify and report security loopholes to the management for necessary actions

Internal auditors in incident response teams are responsible for identifying and reporting security loopholes to management for necessary actions, ensuring organizational compliance and control effectiveness. Their expertise in evaluating internal controls makes them valuable for identifying systemic weaknesses that led to incidents. Configuring security controls, blocking network traffic, and coordinating containment are operational tasks typically handled by security engineers and incident handlers rather than auditors.

Correct answer: Digital evidence

Digital evidence refers to any information of probative value that is stored or transmitted in digital form during a computer crime, making it legally admissible in court proceedings. This encompasses all electronic data that can prove or disprove facts related to cyber incidents. Computer emails are just one type of digital evidence, digital investigation is the process of examining evidence, and digital forensic examiner is the person who analyzes the evidence, not the evidence itself.

Correct answer: Identification

The Identification stage of incident response involves analyzing incidents for their nature, intensity, and effects, which includes auditing system and network log files to understand what occurred. This stage focuses on determining whether a security event is actually an incident requiring response. Incident recording documents the incident, reporting communicates findings, and containment focuses on limiting the incident spread rather than initial analysis.

Correct answer: All the above

Incident Response Plans require all of the above components: financial and management support for resources and authority, expert team composition with skilled personnel from various disciplines, and adequate resources including technology, tools, and budget. A comprehensive incident response plan cannot be effective without any of these critical elements, as each component is essential for successful incident handling and organizational preparedness.

Correct answer: adware (spelled all lower case)

Adware is software that displays advertising banners while running and delivers ads through pop-up windows or bars on computer screens or browsers, often generating revenue for developers through ad display. Unlike malicious malware, adware primarily focuses on advertising rather than system damage. Trojans disguise malicious functionality, rootkits hide system presence, viruses self-replicate and infect files, and worms spread across networks, none of which primarily focus on advertising display.

Correct answer: Two image copies

According to Evidence Preservation policy, a forensic investigator should make at least two image copies of digital evidence to ensure data integrity and provide backup protection against corruption or damage during analysis. One copy serves as a working copy for examination while the other remains pristine for verification and legal presentation. Single copies risk evidence loss, while three or more copies may be excessive for most investigations, but two copies specifically provide the minimum redundancy needed for proper evidence preservation and chain of custody maintenance.

Correct answer: All the above

The most common types of intellectual property include all the mentioned forms: copyrights protecting creative works, trademarks protecting brand identifiers, patents protecting inventions, and trade secrets protecting confidential business information. Each type provides different legal protections for intangible assets. Since intellectual property encompasses multiple categories of legal protection for different types of creative and business assets, all the above represents the complete range of common intellectual property types that organizations must protect.

Correct answer: Business Recovery Plan

Business Recovery Plan is the comprehensive strategy that enables organizations to continue functioning after disastrous events through redundant hardware/software, fault-tolerant systems, and robust backup procedures. This plan specifically focuses on operational continuity and system restoration. While disaster recovery plans address immediate response, business impact analysis evaluates potential losses, and contingency plans provide alternative procedures, the Business Recovery Plan encompasses the full spectrum of organizational continuity measures.

Correct answer: Afraid of negative publicity

Organizations often fail to report information security incidents primarily due to fear of negative publicity, which could damage their reputation, customer trust, and stock value. This concern about public perception frequently outweighs the benefits of incident reporting and information sharing. While costs, legal concerns, and technical challenges may be factors, the fear of reputational damage remains the predominant reason organizations avoid incident disclosure.