2025 Realistic 212-89 Dumps Questions To Gain Brilliant Result
Start your 212-89 Exam Questions Preparation with Updated 170 Questions
NEW QUESTION # 25
A US Federal agency network was the target of a DoS attack that prevented and impaired the normal authorized functionality of the networks. According to agency's reporting timeframe guidelines, this incident should be reported within two (2) HOURS of discovery/detection if the successful attack is still ongoing and the agency is unable to successfully mitigate the activity. Which incident category of the US Federal Agency does this incident belong to?
- A. CAT 2
- B. CAT 6
- C. CAT 5
- D. CAT 1
Answer: A
NEW QUESTION # 26
In which of the following phases of incident handling and response (IH&R) process the identified security incidents are analyzed, validated, categorized, and prioritized?
- A. Containment
- B. Incident recording and assignment
- C. Notification
- D. Incident triage
Answer: D
NEW QUESTION # 27
Nervous Nat often sends emails with screenshots of what he thinks are serious incidents, but they always turn out to be false positives. Today, he sends another screenshot, suspecting a nation-state attack. As usual, you go through your list of questions, check your resources for information to determine whether the screenshot shows a real attack, and determine the condition of your network. Which step of IR did you just perform?
- A. Remediation
- B. Detection anc analysis (or identification)
- C. Recovery
- D. Preparation
Answer: B
Explanation:
When you receive a screenshot from Nervous Nat and go through a list of questions, check resources for information to determine the nature of the screenshot, and assess the condition of your network, you are engaging in the Detection and Analysis (or Identification) phase of Incident Response (IR). This phase is about identifying potential security incidents based on reported concerns, anomalies detected by security tools, or through the analysis of security alerts. In this scenario, despite the historical context of false positives, each report is treated seriously, requiring you to collect and analyze information to determine whether a real attack is happening. This involves verifying the validity of the incident, assessing its nature, scope, and impact, and deciding on the appropriate next steps. The detection and analysis phase is critical for determining the course of the IR process, including whether escalation is needed and what response measures should be initiated.References:The ECIH v3 certification materials outline the Incident Response process, detailing steps from preparation, detection and analysis, containment, eradication, and recovery, to post-incident activities, highlighting the importance of thorough detection and analysis as the foundation for effective incident management.
NEW QUESTION # 28
The process of rebuilding and restoring the computer systems affected by an incident to normal operational stage including all the processes, policies and tools is known as:
- A. Incident Management
- B. Incident Handling
- C. Incident Recovery
- D. Incident Response
Answer: C
NEW QUESTION # 29
Which of the following details are included in the evidence bags?
- A. Software version information and web application source code
- B. Date and time of seizure, exhibit number, anc name of incident responder
- C. Sensitive cirectories, personal, and organizational email adcress
- D. Error messages that contain sensitive information and files containing passworos
Answer: A
Explanation:
In the practice of digital forensics and incident handling, evidence bags play a crucial role in preserving the integrity and chain of custody of physical and digital evidence. The information typically included in the documentation on evidence bags encompasses the date and time of seizure, which provides a timestamp for when the evidence was collected; the exhibit number, which is a unique identifier assigned to each piece of evidence for tracking and reference purposes; and the name of the incident responder or individual who collected the evidence, ensuring accountability and traceability. This documentation is essential for maintaining the chain of custody, a critical element in legal proceedings, as it helps establish the evidence's authenticity and integrity by detailing its handling from collection to presentation in court. Options A, B, and C describe types of digital evidence but are not directly related to the content typically documented on evidence bags.References:Incident Handler (ECIH v3) courses and study guides emphasize the importance of accurately documenting evidence bags as part of the evidence collection and preservation process in incident handling and digital forensics.
NEW QUESTION # 30
Which of the following is an attack that attempts to prevent the use of systems, networks, or applications by the intended users?
- A. Unauthorized access
- B. Fraud and theft
- C. Denial of service (DoS) attack
- D. Malicious code or insider threat attack
Answer: C
Explanation:
A Denial of Service (DoS) attack aims to make a computer resource, network, or application unavailable to its intended users, thereby preventing legitimate users from using the service. This is achieved by overwhelming the target with a flood of internet traffic or sending information that triggers a crash. In contrast, fraud and theft involve the unauthorized acquisition of data or assets, unauthorized access refers to gaining entry into systems without permission, and malicious code or insider threat attacks relate to software designed to cause harm or unauthorized actions by trusted users within the organization. The specific intent of a DoS attack is to disrupt service, making it a distinct category focused on denial of availability.References:The Incident Handler (ECIH v3) certification materials discuss various types of cybersecurity threats, including DoS attacks, outlining their methods, objectives, and impacts on targeted systems or networks.
NEW QUESTION # 31
Which of the following terms refers to vulnerable account management functions, including account update, recovery of forgotten or lost passwords, and password reset, that might weaken valid authentication schemes?
- A. Directory traversal
- B. Broken account management
- C. SQL injection
- D. Cross-site scripting
Answer: B
NEW QUESTION # 32
A computer forensic investigator must perform a proper investigation to protect digital evidence. During the investigation, an investigator needs to process large amounts of data using a combination of automated and manual methods. Identify the computer forensic process involved:
- A. Analysis
- B. Examination
- C. Collection
- D. Preparation
Answer: B
NEW QUESTION # 33
Removing or eliminating the root cause of the incident is called:
- A. Incident Containment
- B. Incident Classification
- C. Incident Eradication
- D. Incident Protection
Answer: C
NEW QUESTION # 34
Electronic evidence may reside in the following:
- A. Backup tapes
- B. Data Files
- C. All the above
- D. Other media sources
Answer: C
NEW QUESTION # 35
Which of the following is defined as the identification of the boundaries of an IT system along with the resources and information that constitute the system?
- A. Control analysis
- B. Threat ioenLificalion
- C. System characterization
- D. Vulnerability identification
Answer: C
NEW QUESTION # 36
Malicious downloads that result from malicious office documents being manipulated are caused by which of the following?
- A. Impersonation
- B. Macro abuse
- C. Click jacking
- D. Registry key manipulation
Answer: B
NEW QUESTION # 37
Ren is assigned to handle a security incident of an organization. He is tasked with forensics investigation to find the evidence needed by the management. Which of the following steps falls under the investigation phase of the computer forensics investigation process?
- A. Risk assessment
- B. Secure the evidence
- C. Evidence assessment
- D. Setup a computer forensics lab
Answer: B
NEW QUESTION # 38
The ability of an agency to continue to function even after a disastrous event, accomplished through the deployment of redundant hardware and software, the use of fault tolerant systems, as well as a solid backup and recovery strategy is known as:
- A. Business Continuity Plan
- B. Disaster Planning
- C. Business Continuity
- D. Contingency Planning
Answer: C
NEW QUESTION # 39
Keyloggers do NOT:
- A. Alter system files
- B. Secretly records URLs visited in browser, keystrokes, chat conversations, ...etc
- C. Run in the background
- D. Send log file to attacker's email or upload it to an ftp server
Answer: A
NEW QUESTION # 40
Frederick is in the eradication process in one of the incidents he is handing.
Which of the following is NOT an eradication process?
- A. Analyze the security model of the cloud provider interface.
- B. Monitor the client's traffic for any malicious activities.
- C. Conduct vulnerability scanning and configuration audits.
- D. CCs must train a few of their employees to use the cloud securely.
Answer: D
NEW QUESTION # 41
Digital evidence plays a major role in prosecuting cyber criminals. John is a cyber-crime investigator, is asked to investigate a child pornography case. The personal computer of the criminal in question was confiscated by the county police. Which of the following evidence will lead John in his investigation?
- A. Web serve log
- B. Web browser history
- C. SAM file
- D. Routing table list
Answer: B
NEW QUESTION # 42
Preventing the incident from spreading and limiting the scope of the incident is known as:
- A. Incident Containment
- B. Incident Eradication
- C. Incident Classification
- D. Incident Protection
Answer: A
NEW QUESTION # 43
Richard is analyzing a corporate network. After an alert in the network's IPS. he identified that allthe servers are sending huge amounts of traffic to the website abc.xyz. What type of information security attack vectors have affected the network?
- A. Advance persistent three Is
- B. Botnet
- C. Ransomware
- D. IOT threats
Answer: B
Explanation:
When a corporate network's servers are sending huge amounts of traffic to a specific website, as detected by the network's Intrusion Prevention System (IPS), this behavior is indicative of a Botnet attack. A Botnet is a network of compromised computers, often referred to as "bots," that are controlled remotely by an attacker, typically without the knowledge of the owners of the computers. The attacker can command these bots to execute distributed denial-of-service (DDoS) attacks, send spam, or conduct other malicious activities. In this scenario, the servers behaving as bots and targeting a website with large volumes of traffic suggests that they have been co-opted into a Botnet to potentially perform a DDoS attack on the website abc.xyz.References:Incident Handler (ECIH v3) courses and study guides discuss various types of cyber threats and attack vectors, including Botnets and their role in distributed cyber attacks.
NEW QUESTION # 44
A colleague wants to minimize their security responsibility because they are in a small organization. They are evaluating a new application that is offered in different forms. Which form would result in the least amount of responsibility for the colleague?
- A. saaS
- B. laaS
- C. On-prom installation
- D. PaaS
Answer: A
NEW QUESTION # 45
An information security incident is
- A. Any event that disrupts normal today's business functions
- B. Any real or suspected adverse event in relation to the security of computer systems or networks
- C. Any event that breaches the availability of information assets
- D. All of the above
Answer: D
NEW QUESTION # 46
Which of the following confidentiality attacks do attackers try to lure users by posing themselves as authorized AP by beaconing the WLAN's SSID?
- A. Session hijacking
- B. Honeypot AP
- C. Evil twin AP
- D. Masquerading
Answer: C
NEW QUESTION # 47
......
EC-COUNCIL 212-89 certification exam covers a range of topics related to incident handling, including incident response process and procedures, digital forensics, network security essentials, and vulnerability management. 212-89 exam consists of 100 multiple-choice questions, and candidates are given two hours to complete it. 212-89 exam is computer-based and can be taken at one of EC-COUNCIL's authorized testing centers.
Recommended Revision Books
Now, let's focus on the must-have revision books that Amazon kindly proffers:
- Practice Questions & Answers EC Council Certified Incident Handler (ECIH V2): ECCouncil 212-89
This is the ultimate solution if you are looking for valid and updated ECIH exam dumps and practice test questions for the actual 212-89 evaluation. Phil Scott has done an impressive job in putting together the latest question bank for the ECIH 212-89 exam using this book, with the help of which you will not only memorize the test details but also understand the crucial information you need to master regarding the latest updates. Get your copy from Amazon at only $14 and improve your knowledge as you prepare for the final test.
- EC Council Certified Incident Handler A Complete Guide - 2021 Edition
Now, let's talk about this 2021 material by the Art of Service - EC Council Certified Incident Handler Publishing. Unlike many revision books that you will want to purchase to study for 212-89, this guide takes your training a notch higher by emphasizing the skills you should know in practical environments. Particularly, it provides the skills you need to define, design, create and implement a process that solves challenging security incidents. By studying using this revision material, you will understand how to diagnose and manage bothersome security incidents, implement the best practices & policies that are geared towards the organization’s overall objectives, and integrate the latest concepts and processes into actual practice in line with the stipulated guidelines. Be ready to spend at least $100 to validate your skills using this material.
- EC Council Certified Incident Handler Complete Guide - 2020 Edition
This is the definitive guide to the ECIH 212-89 exam covering all the concepts necessary. It costs about $90 from Amazon. Throughout this book, important questions are asked and detailed answers are given. For instance, what should you know to complete a successful operation? How should you perform a response exercise? Does your company have an official computer incident response plan? And most importantly, how do you protect your organization’s systems from security incidents and maintain high-quality services every time? The author, Gerardus Blokdyk, uses his years of experience to craft a series of informative questions covering all aspects of the ECIH designation. There’s no doubt any candidate will find this tool helpful in his/her certification prep journey, taking into consideration the detailed account it gives to all the topic areas. All in all, every purchase comes with the following tools:
- A valid current edition of this book in PDF format;
- An Excel dashboard for self-assessment;
- Detailed ECIH checklists;
- Highly informative project management checklists.
Easy Success EC-COUNCIL 212-89 Exam in First Try: https://protechtraining.actualtestsit.com/EC-COUNCIL/212-89-exam-prep-dumps.html