Exam Questions and Answers for 212-89 Study Guide Questions and Answers!
EC Council Certified Incident Handler (ECIH v3) Certification Sample Questions and Practice Exam
Who Is ECIH 212-89 Test Intended for?
This exam is designed for the individuals who work as incident handlers, penetration testers, risk assessment administrators, cyber forensic investigators, system administrators, firewall administrators, IT professionals, IT managers, etc. Those who want to pursue their career in incident response and handling can also apply for this certification exam as it will enhance your skills and abilities to perform tasks in the ECIH sector.
EC-COUNCIL 212-89: EC Council Certified Incident Handler (ECIH v2) exam is a certification test that measures the candidate's ability to handle various security incidents that may affect an organization's network infrastructure. 212-89 exam is designed to provide IT professionals with the necessary knowledge and skills required to identify, manage, and respond to security incidents.
NEW QUESTION # 83
Which of the following is defined as the identification of the boundaries of an IT system along with the resources and information that constitute the system?
- A. System characterization
- B. Threat ioenLificalion
- C. Vulnerability identification
- D. Control analysis
Answer: A
NEW QUESTION # 84
Khai was tasked with examining the logs from a Linux email server. The server uses Sendmail to execute the command to send emailsand Syslog to maintain logs. To validate the data within email headers, which of the following directories should Khai check for information such as source and destination IP addresses, dates, and timestamps?
- A. /va r/log/sendmail/mailog
- B. /Var/log/mailog
- C. /va r/log/mai11og
- D. /var/log/sendmail
Answer: C
NEW QUESTION # 85
Alice is an incident handler and she has been informed by her lead that the data on affected systems must be backed up so that it can be retrieved if it is damaged during the incident response process. She was also told that the system backup can also be used for further investigation of the incident. In which of the following stages of the incident handling and response (IH&R) process does Alice need to do a complete backup of the infected system?
- A. Eradication
- B. Containment
- C. Incident recording
- D. Incident triage
Answer: C
NEW QUESTION # 86
Any information of probative value that is either stored or transmitted in a digital form during a computer crime is called:
- A. Digital Forensic Examiner
- B. Digital evidence
- C. Digital investigation
- D. Computer Emails
Answer: B
NEW QUESTION # 87
The flow chart gives a view of different roles played by the different personnel of CSIRT. Identify the incident
response personnel denoted by A, B, C, D, E, F and G.
- A. A- Incident Coordinator, B-Incident Analyst, C- Public Relations, D-Administrator, E- Human Resource, F-
Constituency, G-Incident Manager - B. A-Incident Analyst, B- Incident Coordinator, C- Public Relations, D-Administrator, E- Human Resource, F-
Constituency, G-Incident Manager - C. A- Incident Manager, B-Incident Analyst, C- Public Relations, D-Administrator, E- Human Resource, F-
Constituency, G-Incident Coordinator - D. A- Incident Coordinator, B- Constituency, C-Administrator, D-Incident Manager, E- Human Resource, F-
Incident Analyst, G-Public relations
Answer: D
NEW QUESTION # 88
Computer Forensics is the branch of forensic science in which legal evidence is found in any computer or any
digital media device. Of the following, who is responsible for examining the evidence acquired and separating
the useful evidence?
- A. Evidence Manager
- B. Evidence Documenter
- C. Evidence Examiner/ Investigator
- D. Evidence Supervisor
Answer: C
NEW QUESTION # 89
Who is mainly responsible for providing proper network services and handling network-related incidents in each cloud service model?
- A. Cloud brokers
- B. Cloud auditor
- C. Cloud service provider
- D. Cloud consumer
Answer: C
NEW QUESTION # 90
Rose is an incident-handling person and she is responsible for detecting and eliminating any kind of scanning attempts over the network by any malicious threat actors. Rose uses Wireshark tool to sniff the network and detect any malicious activities going on.
Which of the following Wireshark filters can be used by her to detect TCP Xmas scan attempt by the attacker?
- A. tcp.flags.reset==1
- B. tcp.flags==0X000
- C. tcp.flags==0X029
- D. tcp.dstport==7
Answer: C
Explanation:
A TCP Xmas scan is a type of network scanning technique used by attackers to identify open ports on a target machine. The name "Xmas" comes from the set of flags that are turned on within the packet, making it 'lit up like a Christmas tree'. Specifically, the FIN, PSH, and URG flags are set, which corresponds to the hexadecimal value 0X029 in the TCP header's flags field. Wireshark, a popular network protocol analyzer, allows users to create custom filters to detect specific types of network traffic, including malicious scanning attempts. By using the filtertcp.flags==0X029, Rose can detect packets that have these specific flags set, indicating a potential TCP Xmas scan attempt.
References:The technique of using Wireshark to detect specific types of scans, including the TCP Xmas scan, is covered in cybersecurity training materials and documentation related to network analysis and incident handling, such as those associated with the ECIH certification.
NEW QUESTION # 91
Which of the following terms refers to vulnerable account management functions, including account update, recovery of forgotten or lost passwords, and password reset, that might weaken valid authentication schemes?
- A. Cross-site scripting
- B. Directory traversal
- C. SQL injection
- D. Broken account management
Answer: D
Explanation:
The term "broken account management" refers to vulnerabilities in the account management functions of web applications, which can weaken valid authentication schemes. This can include issues with how accounts are created, updated, managed, and deleted, as well as how users recover forgotten passwords or perform password resets. Poorly implemented account management functions can allow attackers to bypass authentication, elevate privileges, or assume the identity of another user. This weakness is a significant security concern because it directly impacts the ability of a system to safeguard user data and maintain operational integrity.
References:In its training materials, the ECIH v3 program addresses various web application vulnerabilities, including broken account management, emphasizing the importance of secure development practices and regular security assessments to prevent such issues.
NEW QUESTION # 92
Preventing the incident from spreading and limiting the scope of the incident is known as:
- A. Incident Classification
- B. Incident Protection
- C. Incident Containment
- D. Incident Eradication
Answer: C
NEW QUESTION # 93
A self-replicating malicious code that does not alter files but resides in active memory and duplicates itself, spreads through the infected network automatically and takes advantage of file or information transport features on the system to travel independently is called:
- A. Virus
- B. RootKit
- C. Worm
- D. Trojan
Answer: C
NEW QUESTION # 94
A risk mitigation strategy determines the circumstances under which an action has to be taken to minimize and overcome risks. Identify the risk mitigation strategy that focuses on minimizing the probability of risk and losses by searching for vulnerabilities in the system and appropriate controls:
- A. Research and acknowledgment
- B. Risk absorption
- C. Risk limitation
- D. Risk Assumption
Answer: A
NEW QUESTION # 95
Based on the some statistics; what is the typical number one top incident?
- A. Malware
- B. Un-authorized access
- C. Policy violation
- D. Phishing
Answer: D
NEW QUESTION # 96
Identify a standard national process which establishes a set of activities, general tasks and a management
structure to certify and accredit systems that will maintain the information assurance (IA) and security posture
of a system or site.
- A. NIASAP
- B. NIPACP
- C. NIAAAP
- D. NIACAP
Answer: D
NEW QUESTION # 97
Which of the following encoding techniques replaces unusual ASCII characters with
"%" followed by the character's two-digit ASCII code expressed in hexadecimal?
- A. Base64 encoding
- B. URL encoding
- C. Unicode encoding
- D. HTML encoding
Answer: B
Explanation:
URL encoding, also known as percent-encoding, is a mechanism for encoding information in a Uniform Resource Identifier (URI) under certain circumstances. This technique involves replacing unsafe ASCII characters with a "%" followed by two hexadecimal digits that represent the character's ASCII code. This is necessary for embedding characters that are not allowed in URLs directly, such as spaces and symbols, or characters that have special meanings within URLs, ensuring that the URL is correctly interpreted by web browsers and servers.
References:The concept of URL encoding is fundamental to web application security, a topic that is covered in the ECIH v3 program by EC-Council. Understanding encoding techniques is crucial for incident handlers dealing with web-based attacks and investigations.
NEW QUESTION # 98
Which of the following terms refers to the personnel that the incident handling and response (IH&R) team must contact to report the incident and obtain the necessary permissions?
- A. Point of contact
- B. Ticketing
- C. Civil litigation
- D. Criminal referral
Answer: B
NEW QUESTION # 99
......
212-89 certification dumps - ECIH Certification 212-89 guides - 100% valid: https://certkiller.passleader.top/EC-COUNCIL/212-89-exam-braindumps.html