Access to Free EC-Council ECIH 212-89 Dumps for Better Result

test2022-06-02T07:14:42+00:00

If you want to become a Certified Incident Handler, you can get help here. EC-Council Certified Incident Handler certification is designed to provide the fundamental skills to handle and respond to computer security incidents in an information system. FreeTestShare is the only way to get you where you want to go. Only a week of preparation is required to pass the 212-89 exam with flying colors. The 212-89 dumps fully describe what you will face on the real exam, allowing you to pass the 212-89 exam quickly. We ensure that if you use the most accurate 212-89 dumps, you will pass the exam on the first try!

You can now use our free 212-89 practice test to help you prepare for the exam.

Page 1 of 5

1. SWA Cloud Services added PK las one of their cloud security controls.

What does PKI stand for?

Public key information

Private key infrastructure

Private key information

Public key infrastructure

2. Which of the following is a standard framework that provides recommendations for implementing information security controls for organizations that initiate, implement, or maintain information security management systems (ISMSs)?

ISO/IEC27035

RFC 2196

PCI DSS

ISO/IEC27002

3. As an IT security officer, what is the first step you will take after discovering a successful email compromise?

Test the infected system to ensure security

Investigate similar hosts to determine whether the attacker has compromised other systems.

Isolate the compromised system or take steps to contain the attack.

Report the incident to the organization's computer incident response team.

4. In which of the following phases of incident handling and response (IH&R) process are the identified security incidents analyzed, validated, categorized, and prioritized?

Incident triage

Notification

Incident recording and assignment

Containment

5. Raven is a part of an IH&R team and was info med by her manager to handle and lead the removal of the root cause for an incident and to close all attack vectors to prevent similar incidents in the future. Raven notifies the service providers and developers of affected resources.

Which of the following steps of the incident handling and response process does Raven need to implement to remove the root cause of the incident?

Containment

Eradication

Incident triage

Evidence gathering and forensic analysis

6. Which of the following is an attack that occurs when a malicious program causes a user's browser to perform man unwanted action on a trusted site for which the user is currently authenticated?

Insecure direct object references

SQL injection

Cross-site request forgery

Cross-site scripting

7. He must present this evidence in a clear and comprehensible manner to the members of jury so that the evidence explains the facts clearly and further helps in obtaining an expert opinion on the same to confirm the investigation process.

In the above scenario, what is the characteristic of the digital evidence Stanley tried to preserve?

Believable

Complete

Authentic

Admissible

8. Elizabeth, who works for OBC organization as an incident responder, is assessing the risks to the organizational security. As part of the assessment process, she is calculating the probability of a threat source exploiting an existing system vulnerability.

Which of the following risk assessment steps is Elizabeth currently in?

Likelihood analysis

System characterization

Vulnerability identification

Impact analysis

9. Which of the following forensic investigation phases should occur first?

Preform the first responder procedure.

Collect preliminary evidence.

Create two-bitstream copies of the evidence.

Transport the evidence to the forensic laboratory.

10. In the cloud environment, an authorized security professional executes approved sanitation procedures using approved utilities to permanently remove data spilled from contaminated information systems and applications in the cloud.

This is an example of which of the following?

Cloud auditor

Cloud eradication

Cloud broker

Cloud computing

Page 2 of 5

11. Alexis an incident handler in QWERTY Company. He identified that an attacker created a backdoor inside the company's network by installing a fake AP inside a firewall.

Which of the following attack types did the attacker use?

AP misconfiguration

Wardriving

Ad hoc associations

Rogue access point

12. Your company holds a large amount of customer Pll, and you want to protect those data from theft or unauthorized modification. Among other actions, you classify and encrypt the data.

In this process, which of the following OWASP security risks are you guarding against?

Insecure deserialization

Sensitive data exposure

Security misconfiguration

Broken authentication

13. Francis received a spoof email asking for his bank information. He decided to use a tool to analyze the email headers.

Which of the following should he use?

EventLog Analyzer

Polite Mail

Mx Toolbox

Email Checker

14. Bonney's system has been compromised by a gruesome malware.

What is the primary step that is advisable to Bonney in order to contain the malware incident from spreading?

What is the cause of this issue?

Complaint to police in a formal way regarding the incident

Turnoff the infected machine

Leave it to the network administrators to handle

Call the legal department in the organization and info m about the incident

15. A user downloaded what appears to be genuine software. Unknown to her, when she installed the application, it executed code that provided an unauthorized remote attacker access to her computer.

What type of malicious threat displays this characteristic?

Backdoor

Spyware

Trojan

Virus

16. Drake is an incident handler at Dark Cloud Inc. He is tasked with performing log analysis to detect traces of malicious activities within the network infrastructure.

Which of the following tools should Drake employ to view logs in real time and identify malware propagation within the network?

Splunk

Hydra

LOIC

HULK

17. Bran is an incident handler who is assessing the network of the organization. He wants to detect ping sweep attempts on the network using Wire shark.

Which of the following W re shark filters would Bran use to accomplish this task?

icmp.type== 8

icmp.redir_gw

icmp.ident

icmp.seq

18. Which of the following techniques helps incident handlers detect man-in-the-middle attacks by finding the new APs and trying to connect an already established channel, even if the spoofed AP consists of similar IP and MAC addresses as the original AP?

Network traffic monitoring

Access point monitoring

General wireless traffic monitoring

Wireless client monitoring

19. Which of the following is not called volatile data?

Open sockets or open ports

Creation dates off les

State of the network interface

The date and time of the system

20. Eve is an incident handler in ABC organization. One day, she got a complaint about an email hacking incident from one of the employees of the organization. As a part of incident handling and response process, she must follow a number of recovery steps in order to recover from the incident impact and maintain business continuity.

What is the first step that she must do to secure the employee's account?

Disabling automatic filesharing between the systems

Restore the email services and change the password

Enable scanning of links and attachments in all the emails

Enable two-factor authentication

Page 3 of 5

21. Attackers or insiders create a backdoor into a trusted network by installing an unsecured access point inside a firewall. They then use any software or hardware access point to perform an attack.

Which of the following is this type of attack?

Email infection

Malware attack

Rogue access point attack

Password-based attack

22. Rica works as an incident handler for an international company. As part of her role, she must review the present security policy implemented. Upon inspection, Rica finds that the policy is wide open, and only known dangerous services/attacks or behaviors are blocked.

Which of the following is the current policy that Rica identified?

Promiscuous policy

Paranoid policy

Permissive policy

Prudent policy

23. Which of the following is a term that describes the combination of strategies and services intended to restore data, applications, and other resources to the public cloud or dedicated service providers?

Eradication

Mitigation

Cloud recovery

Analysis

24. Employee monitoring tools are mostly used by employers to find which of the following?

Lost registry keys

Malicious insider threats

Conspiracies

Stolen credentials

25. Create a vulnerability scan report

Identify the correct sequence of vulnerability assessment steps performed by the incident responders.

4-->1-->2->3->6->5-->7

3-->6-->1->2->5->4-->7

1-->3-->2->4->5->6-->7

2-->1-->4->7->5->6-->3

26. Shall y, an incident handler, works for a company named Texas Pvt.Ltd.based in Florida. She was asked to work on an incident response plan. As part of the plan, she decided to enhance and improve the security infrastructure of the enterprise. She incorporated a security strategy that allows security professionals to use several protection layers throughout their information system. Owing to multiple-layer protection, this security strategy assists in preventing direct attacks against the organization's information system as a break in one layer only leads the attacker to the next layer.

Which of the following security strategies did Shall y incorporate in the incident response plan?

Defense-in-depth

Three-way handshake

Covert channels

Exponential back off algorithm

27. Elizabeth, working for OBC organization as an incident responder, is assessing the risks facing the organizational security. During the assessment process, she calculates the probability of a threat source exploiting an existing system vulnerability.

Identify the risk assessment step Elizabeth is currently in.

Impact analysis

Vulnerability identification

System characterization

Likelihood analysis

28. Which of the following email security tools can be used by an incident handler to prevent the organization against evolving email threats?

Mx Toolbox

G Suite Toolbox

Email Header Analyzer

Gpg4win

29. John is a professional hacker who is performing an attack on the target organization where he tries to redirect the connection between the IP address and its target server such that when the users type in the Internet address, it redirects them to a rogue website that resembles the original website. He tries this attack using cache poisoning technique.

Identify the type of attack John is performing on the target organization.

Pharming

Skimming

War driving

Pre texting

30. Ikeo Corp.hired an incident response team to assess the enterprise security. As part of the incident handling and response process, the IR team is reviewing the current se cunty policies implemented by the enterprise. The IR team finds that employees of the organization do not have any restrictions on Internet access: they are allowed to visit any site, download any appl cation, and access a computer or network from a remote location. Considering this as the main security threat, the IR team plans to change this policy as it can be easily exploited by attackers.

Which of the following security policies is the IR team planning to modify?

Promiscuous policy

Paranoid policy

Permissive policy

Prudent policy

Page 4 of 5

31. Which of the following are malicious software programs that infect computers and corruptor delete the data on them?

Trojans

Worms

Spyware

Virus

32. Jacobi san employee in Dolphin Investment firm. While he was on his duty, he identified that his computer is facing some problems and he wanted to convey the issue to the respective authority in his organization.

But currently this organization does not have a ticketing system to address such types of issues.

In the above scenario, which of the following ticketing systems can be employed by the Dolphin Investment firm to allow Jacob to raise the issue in order to tell the respective team about the incident?

ThreatConnec

IBM XForce Exchange

ManageEngine ServiceDesk Plus

MISP

33. If the browser does not expire the session when the user fails to logout properly, which of the following OWASP Top 10 web vulnerabilities is caused?

A5: Broken access control

A2: Broken authentication

A7: Cross-site scripting

A3: Sensitive data exposure

34. Robert is an incident handler working for X security Inc. One day, his organization faced a massive cyberattack and all of the websites related to the organization went offline. Robert was on duty during the incident and he was responsible for handling the incident and maintaining business continuity. He immediately restored the web application service with the help of the existing backups.

According to the scenario, which of the following stages of incident handling and response (IH&R) process did Robert perform?

Evidence gathering and forensics analysis

Eradication

Not if cation

Recovery

35. An attacker after performing an attack decided to wipe evidence using artifact wiping techniques to evade forensic investigation. He applied a magnetic field to the digital media device, resulting in a device entirely cleaned of any previously stored data.

Identify the artifact wiping technique used by the attacker.

Syscall proxying

Disk cleaning utilities

Disk degaussing/destruction

File wiping utilities

36. Which of the following is the BEST method to prevent email incidents?

Disabling HTML in email content fields

End-user training

Installing antivirus rule updates

Web proxy filtering

37. Alexis an incident handler for Tech-o-Tech Inc. and is tasked to identify any possible insider threats within his organization.

Which of the following insider threat detection techniques can be used by Alex to detect insider threats based on the behavior of a suspicious employee, both individually and in a group?

Physical detection

Behavioral analysis

Profiling

Mole detection

38. lkeo Corp. has hired an incident response team to assess the enterprise security. As a part of the incident handing and response process, the IR team is reviewing the current security policies implemented by the enterprise. The IR team finds out that employees of the organization do not have any restrictions on Internet access, which means that they are allowed to visit any site, download any application, and access a computer or a network from a remote location. Considering this as a main security threat, the IR team plans to change this policy as it can be easily exploited by the attackers. Identify the security policy that the IR team is planning to modify.

Promiscuous pol cy

Prudent policy

Permissive policy

Paranoid policy

39. Which of the following is an attack that attempts to prevent the use of systems, networks, or applications by the intended users?

Malicious code or insider threat attack

Fraud and theft

Unauthorized access

Denial of service (DoS) attack

40. ZYX company experienced a DoS/DDoS attack on their network. Upon investigating the incident, they concluded that the attack is an application-layer attack.

Which of the following attacks did the attacker use?

SIowloris attack

SYN flood attack

UDP flood attack

Ping of death

Page 5 of 5

41. Bonney's system has been compromised by a gruesome malware.

What is the primary step that is advisable to Bonney in order to contain the malware incident from spreading?

What is the cause of this issue?

Complaint to police in a formal way regarding the incident

Turnoff the infected machine

Leave it to the network administrators to handle

Call the legal department in the organization and info m about the incident

42. Which one of the following is Inappropriate Usage Incidents?

Denial of Service Attack

Reconnaissance Attack

Access Control Attack

Insider Threat

43. One of your coworkers just sent you an email. She wonders if it is real, a part of your phishing campaign, a real phishing attack, or a mistake. One of the things you want to know is where the email originated from.

Where would you check in the email message to find that information?

Email's received report

Inbox digest

The user's received report

Email headers

44. Which of the following information security personnel handles incidents from management and technical point of view?

Network administrators

Incident manager (IM)

Forensic investigators

Threat researchers

45. Which of the following digital evidence is temporarily stored on a digital device that requires a constant power supply and is deleted if the power supply is interrupted?

Event logs

Process memory

Slack space

Swap file

46. Which of the following terms refers to an organization's ability to make optimal use of digital evidence in a limited period of time and with minimal investigation costs?

Risk assessment

Data analysis

Threat assessment

Forensic readiness

47. Eric is an incident responder and is working on developing incident-handling plans and procedures. As part of this process, he is performing an analysis on the organizational network to generate a report and develop policies based on the acquired results.

Which of the following tools will help him in analyzing his network and the related traffic?

FaceNiff

Burp Suite

Wireshark

Whois

48. Rose is an incident-handler and is responsible for detecting and eliminating any kind of scanning attempts over the network by malicious threat actors. Rose uses Wire shark to sniff the network and detect any malicious activities going on.

Which of the following Wireshark filters can be used by her to detect TCP Xmas scan attempt by the attacker?

tcp.flags.reset== 1

tcp.flags==0X 000

tcp.flags==0X 029

tcp.dstport== 7

49. Multiple component incidents consist of a combination of two or more attacks in a system.

Which of the following is not a multiple component incident?

An attacker infecting a machine to launch a DDoS attack

An insider intentionally deleting files from a workstation

An attacker redirecting user to a malicious website and infects his system with Trojan

An attacker using email with malicious code to infect internal workstation