Get EC-COUNCIL 212-89 Dumps Questions Study Exam Guide Nov 09, 2024
212-89 Premium Exam Engine - Download Free PDF Questions
EC-COUNCIL 212-89: EC Council Certified Incident Handler (ECIH v2) exam is a valuable certification for IT professionals who want to advance their careers in the information security field. EC Council Certified Incident Handler (ECIH v3) certification validates the candidate's ability to handle security incidents effectively, and the course content includes practical scenarios that simulate real-world security incidents. Candidates who pass the exam will have a deeper understanding of incident handling procedures and be able to apply them effectively in their organizations.
The ECIH v2 certification exam is recognized globally and is highly respected in the cybersecurity industry. EC Council Certified Incident Handler (ECIH v3) certification exam is designed to meet the needs of both individuals and organizations, providing individuals with the necessary skills and knowledge to effectively manage and respond to cybersecurity incidents, while also providing organizations with the assurance that their cybersecurity professionals are well-trained and capable of handling any cybersecurity incident that may arise.
NEW QUESTION # 97
Bonney's system has been compromised by a gruesome malware.
What is the primary step that is advisable to Bonney in order to contain the malware incident from spreading?
What is the cause of this issue?
- A. Leave it to the network administrators to handle
- B. Complaint to police in a formal way regarding the incident
- C. Call the legal department in the organization and info m about the incident
- D. Turnoff the infected machine
Answer: D
NEW QUESTION # 98
Which of the following processes is referred to as an approach to respond to the security incidents that occurred in an organization and enables the response team by ensuring that they know exactly what process to follow in case of security incidents?
- A. Risk assessment
- B. Incident response orchestration
- C. Threat assessment
- D. Vulnerability management
Answer: B
Explanation:
Incident response orchestration refers to the process and technologies used to coordinate and streamline the response to security incidents. This approach ensures that incident response teams have clear procedures and workflows to follow, enabling them to act swiftly and effectively when dealing with security incidents. By orchestrating the response, organizations can minimize the impact of incidents, ensure consistent and thorough investigation and remediation activities, and improve their overall security posture. Incident response orchestration involves integrating various security tools, automating response actions where possible, and providing a centralized platform for managing incidents.
References:The concept of incident response orchestration and its role in enhancing the effectiveness of incident handling and response efforts is discussed in cybersecurity literature and training, including ECIH v3 study materials, which highlight the benefits of having a structured and organized approach to managing security incidents.
NEW QUESTION # 99
Authorized users with privileged access who misuse the corporate informational assets and directly affects the confidentiality, integrity, and availability of the assets are known as:
- A. Zombies
- B. Social Engineers
- C. Insider threats
- D. Outsider threats
Answer: C
NEW QUESTION # 100
Rose is an incident-handling person and she is responsible for detecting and eliminating any kind of scanning attempts over the network by any malicious threat actors. Rose uses Wireshark tool to sniff the network and detect any malicious activities going on.
Which of the following Wireshark filters can be used by her to detect TCP Xmas scan attempt by the attacker?
- A. tcp.flags==0X029
- B. tcp.flags==0X000
- C. tcp.flags.reset==1
- D. tcp.dstport==7
Answer: A
Explanation:
A TCP Xmas scan is a type of network scanning technique used by attackers to identify open ports on a target machine. The name "Xmas" comes from the set of flags that are turned on within the packet, making it 'lit up like a Christmas tree'. Specifically, the FIN, PSH, and URG flags are set, which corresponds to the hexadecimal value 0X029 in the TCP header's flags field. Wireshark, a popular network protocol analyzer, allows users to create custom filters to detect specific types of network traffic, including malicious scanning attempts. By using the filtertcp.flags==0X029, Rose can detect packets that have these specific flags set, indicating a potential TCP Xmas scan attempt.
References:The technique of using Wireshark to detect specific types of scans, including the TCP Xmas scan, is covered in cybersecurity training materials and documentation related to network analysis and incident handling, such as those associated with the ECIH certification.
NEW QUESTION # 101
Oscar receives an email from an unknown source containing his domain name oscar.com. Upon checking the link, he found that it contains a malicious URL that redirects to the website evilsite.org. What type of vulnerability is this?
- A. Malware
- B. Unvalidated redirects and forwards
- C. Bolen
- D. SQL injection
Answer: B
NEW QUESTION # 102
Eric who is an incident responder is working on developing incident-handling plans and procedures. As part of this process, he is performing analysis on the organizational network to generate a report and to develop policies based on the acquired results.
Which of the following tools will help him in analyzing network and its related traffic?
- A. FaceNiff
- B. Burp Suite
- C. Whois
- D. Wireshark
Answer: D
NEW QUESTION # 103
Clark, a professional hacker, successfully exploited the web application of a target organization by tampering the form and parameter values. In result, Clark gained access to the information assets of the organization. Identify the vulnerability in the web application exploited by the attacker.
- A. Sensitive data exposure
- B. Security misconfiguration
- C. SQL injection
- D. Broken access control
Answer: C
NEW QUESTION # 104
The open source TCP/IP network intrusion prevention and detection system (IDS/IPS), uses a rule-driven
language, performs real-time traffic analysis and packet logging is known as:
- A. Nessus
- B. SAINT
- C. Snort
- D. Wireshark
Answer: C
Explanation:
Explanation
NEW QUESTION # 105
Insiders understand corporate business functions. What is the correct sequence of activities performed by
Insiders to damage company assets:
- A. Activate malware, gain privileged access then install malware
- B. Gain privileged access, activate and install malware
- C. Install malware, gain privileged access, then activate
- D. Gain privileged access, install malware then activate
Answer: D
NEW QUESTION # 106
Nervous Nat often sends emails with screenshots of what he thinks are serious incidents, but they always turn out to be false positives. Today, he sends another screenshot, suspecting a nation-state attack. As usual, you go through your list of questions, check your resources for information to determine whether the screenshot shows a real attack, and determine the condition of your network. Which step of IR did you just perform?
- A. Recovery
- B. Preparation
- C. Remediation
- D. Detection anc analysis (or identification)
Answer: D
Explanation:
When you receive a screenshot from Nervous Nat and go through a list of questions, check resources for information to determine the nature of the screenshot, and assess the condition of your network, you are engaging in the Detection and Analysis (or Identification) phase of Incident Response (IR). This phase is about identifying potential security incidents based on reported concerns, anomalies detected by security tools, or through the analysis of security alerts. In this scenario, despite the historical context of false positives, each report is treated seriously, requiring you to collect and analyze information to determine whether a real attack is happening. This involves verifying the validity of the incident, assessing its nature, scope, and impact, and deciding on the appropriate next steps. The detection and analysis phase is critical for determining the course of the IR process, including whether escalation is needed and what response measures should be initiated.References:The ECIH v3 certification materials outline the Incident Response process, detailing steps from preparation, detection and analysis, containment, eradication, and recovery, to post-incident activities, highlighting the importance of thorough detection and analysis as the foundation for effective incident management.
NEW QUESTION # 107
The policy that defines which set of events needs to be logged in order to capture and review the important data in a timely manner is known as:
- A. Logging policy
- B. Audit trail policy
- C. Evidence Collection policy
- D. Documentation policy
Answer: A
NEW QUESTION # 108
Michael is an incident handler at CyberTech Solutions. He is performing detection and analysis of a cloud security incident. He is also analyzing the file systems, slack spaces, and metadata within the storage units to find hidden malware and evidence of malice.
Identify the cloud security incident handled by Michael:
- A. Network-related incident
- B. Server-related incident
- C. Application-related incident
- D. Storage-related incident
Answer: D
NEW QUESTION # 109
John is performing a memory dump analysis in order to find traces of malware. He has employed Volatility tool in order to achieve his objective.
Which of the following volatility framework command she will use in order to analyze the running process from the memory dump?
- A. python vol.py imageinfo -f/root/Desktop/memdump.mem
- B. python vol.py svcscan--profile=Win2008SP1x86 -f/root/Desktop/memdump.mem | more
- C. python vol.py pslist-profile=Win2008SP1x86 -f/root/Desktop/memdump.mem
- D. python vol.py hivelist-prof le=Win2008SP1x86 -f/root Desktop/memdump.mem
Answer: C
NEW QUESTION # 110
John, a professional hacker, is attacking an organization, where he is trying to destroy the connectivity between an AP and client to make the target unavailable to other wireless devices.
Which of the following attacks is John performing in this case?
- A. Denial-of-service
- B. Disassociation attack
- C. EAP failure
- D. Routing attack
Answer: B
Explanation:
In a disassociation attack, the attacker sends disassociation frames to a wireless access point (AP) using a spoofed MAC address of a client or to the client pretending to be the AP. This forces the target to disconnect and often reconnect, causing a disruption in the wireless connectivity. Such attacks can be used to create a denial-of-service condition for the client, making the network resource unavailable. The primary objective of this attack is not to eavesdrop but to disrupt the normal operation of the wireless connection between the client and the AP.
References:The concept of disassociation attacks and their impact on wireless network connectivity is covered in cybersecurity training materials and incident response courses, including those related to the ECIH v3 certification. These materials explain the techniques used in various network attacks, including how disassociation attacks are performed and mitigated.
NEW QUESTION # 111
Dan is a newly appointed information security professional in a renowned organization. He is supposed to follow multiple security strategies to eradicate malware incidents. Which of the following is not considered as a good practice for maintaining information security and eradicating malware incidents?
- A. Do not open files with file extensions such as .bat, .com, ,exe, .pif, .vbs, and so on
- B. Do not download or execute applications from trusted sources
- C. Do not download or execute applications from third-party sources
- D. Do not click on web browser pop-up windows
Answer: B
Explanation:
The statement "Do not download or execute applications from trusted sources" is incorrect and not considered a good practice for maintaining information security and eradicating malware incidents. In contrast, downloading or executing applications from trusted sources is a fundamental security best practice. Trusted sources are vetted and are generally considered safe for downloading software, updates, and applications. This practice helps to minimize the risk of introducing malware into the organizational environment. The other options (A, B, C) represent good practices that help in reducing the likelihood of malware infections by avoiding potentially harmful actions.
References:The ECIH v3 materials from EC-Council provide guidance on best practices for malware prevention and response, underscoring the importance of relying on trusted sources for software and application downloads as part of a robust information security strategy.
NEW QUESTION # 112
XYZ Inc. was affected by a malware attack and James, being the incident handling and response (IH&R) team personnel handling the incident, found out that the root cause of the incident is a backdoor that has bypassed the security perimeter due to an existing vulnerability in the deployed firewall. James had contained the spread of the infection and removed the malware completely. Now the organization asked him to perform incident impact assessment to identify the impact of the incident over the organization and he was also asked to prepare a detailed report of the incident.
Which of the following stages in IH&R process is James working on?
- A. Post-incident activities
- B. Evidence gathering and forensics analysis
- C. Notification
- D. Eradication
Answer: A
Explanation:
James is working on the post-incident activities stage of the Incident Handling and Response (IH&R) process.
After containing the spread of the infection and removing the malware, the focus shifts to assessing the impact of the incident on the organization and preparing a detailed report. This phase involves analyzing the extent of the damage, determining the cost of the attack, evaluating how well the incident was managed, and identifying lessons learned to improve future response efforts. The objective is to restore systems to normal operation, ensure no remnants of the threat remain, and implement measures to prevent recurrence.References:Incident Handler (ECIH v3) courses and study guides outline the IH&R process, emphasizing the importance of post-incident activities for organizational recovery and improvement of future security measures.
NEW QUESTION # 113
Unusual logins, accessing sensitive information not used for the job role, and the use of personal external storage drives on company assets are all signs of which of the following?
- A. Over-working
- B. Lack of job rotation
- C. Security breach
- D. Insider threat
Answer: D
NEW QUESTION # 114
The sign(s) of the presence of malicious code on a host infected by a virus which is delivered via e-mail could be:
- A. Increase in the number of e-mails sent and received
- B. System files become inaccessible
- C. Antivirus software detects the infected files
- D. All the above
Answer: D
NEW QUESTION # 115
Miko was hired as an incident handler in XYZ company. His first task was to identify the PING sweep attempts inside the network. For this purpose, he used Wireshark to analyze the traffic. What filter did he use to identify ICMP ping sweep attempts?
- A. tcp.typc == icmp
- B. udp.lype - 7
- C. icrrip.lype == icmp
- D. icmp.type == 8 or icmp.type ==0
Answer: D
NEW QUESTION # 116
Francis received a spoof email asking for his bank information. He decided to use a tool to analyze the email headers. Which of the following should he use?
- A. PoliteMail
- B. MxTooIbox
- C. EventLog Analyzer
- D. Email Checker
Answer: B
NEW QUESTION # 117
Raven is a part of an IH&R team and was info med by her manager to handle and lead the removal of the root cause for an incident and to close all attack vectors to prevent similar incidents in the future. Raven notifies the service providers and developers of affected resources.
Which of the following steps of the incident handling and response process does Raven need to implement to remove the root cause of the incident?
- A. Eradication
- B. Containment
- C. Evidence gathering and forensic analysis
- D. Incident triage
Answer: A
NEW QUESTION # 118
The Malicious code that is installed on the computer without user's knowledge to acquire information from the user's machine and send it to the attacker who can access it remotely is called:
- A. Worm
- B. Trojan
- C. Logic Bomb
- D. Spyware
Answer: D
NEW QUESTION # 119
Elizabeth, who works for OBC organization as an incident responder, is assessing the risks to the organizational security. As part of the assessment process, she is calculating the probability of a threat source exploiting an existing system vulnerability. Which of the following risk assessment steps is Elizabeth currently in?
- A. Likelihood analysis
- B. Impact analysis
- C. Vulnerability identification
- D. System characterization
Answer: A
NEW QUESTION # 120
......
Free 212-89 Exam Braindumps EC-COUNCIL Pratice Exam: https://www.dumps4pdf.com/212-89-valid-braindumps.html
Instant Download 212-89 Free Updated Test Dumps: https://drive.google.com/open?id=1ylPyYUKGS59D9F2BexVcdzs_5vtOJuwA