212-89 Exam Questions - Real & Updated Questions PDF [Q94-Q113]

5/5 - (1 vote)

212-89 Exam Questions – Real & Updated Questions PDF

Pass Guaranteed Quiz 2022 Realistic Verified Free EC-COUNCIL

EC-COUNCIL 212-89 Exam Syllabus Topics:

Topic	Details
Topic 1	Handling and Responding to Insider Threats Forensic Readiness and First Response
Topic 2	Handling and Responding to Cloud Security Incidents Incident Handling and Response Process
Topic 3	Handling and Responding to Web Application Security Incidents Introduction to Incident Handling and Response
Topic 4	Handling and Responding to Email Security Incidents
Topic 5	Handling and Responding to Network Security Incidents Handling and Responding to Malware Incidents

NEW QUESTION 94
An audit trail policy collects all audit trails such as series of records of computer events, about an operating
system, application or user activities. Which of the following statements is NOT true for an audit trail policy:

It helps calculating intangible losses to the organization due to incident

It helps tracking individual actions and allows users to be personally accountable for their actions

It helps in compliance to various regulatory laws, rules,and guidelines

It helps in reconstructing the events after a problem has occurred

NEW QUESTION 95
A methodical series of techniques and procedures for gathering evidence, from computing equipment and various storage devices and digital media, that can be presented in a court of law in a coherent and meaningful format is called:

Forensic Analysis

Computer Forensics

Forensic Readiness

Steganalysis

NEW QUESTION 96
Policies are designed to protect the organizational resources on the network by establishing the set rules and procedures. Which of the following policies authorizes a group of users to perform a set of actions on a set of resources?

Access control policy

Audit trail policy

Logging policy

Documentation policy

NEW QUESTION 97
Qual Tech Solutions is a leading security services enterprise. Dickson, who works as an incident responder with this firm, is performing a vulnerability assessment to identify the security problems in the network by using automated tools for identifying the hosts, services, and vulnerabilities in the enterprise network.
In the above scenario, which of the following types of vulnerability assessment is Dickson performing?

External assessment

Passive assessment

Active assessment

Internal assessment

NEW QUESTION 98
A threat source does not present a risk if NO vulnerability that can be exercised for a particular threat source. Identify the step in which different threat sources are defined:

Identification Vulnerabilities

Control analysis

Threat identification

System characterization

NEW QUESTION 99
James is working as an incident responder at Cyber Sol Inc. The management instructed James to invest gate a cybersecurity incident that recently happened in the company. As a part of the investigation process, James started collecting volatile information from a system running on Windows operating system.
Which of the following commands helps James in determining all the executable files for running processes?

dos key/history

date/t&time/t

top

netstat-ab

NEW QUESTION 100
Incident handling and response steps help you to detect, identify, respond and manage an incident. Which of the following steps focus on limiting the scope and extent of an incident?

Eradication

Containment

Identification

Data collection

NEW QUESTION 101
Keyloggers do NOT:

Run in the background

Alter system files

Secretly records URLs visited in browser, keystrokes, chat conversations, …etc

Send log file to attacker’s email or upload it to an ftp server

NEW QUESTION 102
An organization faced an information security incident where a disgruntled employee passed sensitive access control information to a competitor. The organization’s incident response manager, upon investigation, found that the incident must be handled within a few hours on the same day to maintain business continuity and market competitiveness. How would you categorize such information security incident?

High level incident

Middle level incident

Ultra-High level incident

Low level incident

NEW QUESTION 103
Which of the following types of insider threats involves an insider who is uneducated on potential security threats or simply bypasses general security procedures to meet workplace efficiency?

Professional insider

Malicious insider

Compromised insider

Negligent insider

NEW QUESTION 104
Which of the following terms refers to vulnerable account management functions, including account update, recovery of forgotten or lost passwords, and password reset, that might weaken valid authentication schemes?

Broken account management

SQL injection

Directory traversal

Cross-site scripting

NEW QUESTION 105
The message that is received and requires an urgent action and it prompts the recipient to delete certain files or forward it to others is called:

An Adware

Mail bomb

A Virus Hoax

Spear Phishing

NEW QUESTION 106
Insiders may be:

Ignorant employees

Carless administrators

Disgruntled staff members

All the above

NEW QUESTION 107
According to the Evidence Preservation policy, a forensic investigator should make at least ………………… image
copies of the digital evidence.

One image copy

Two image copies

Three image copies

Four image copies

Erläuterung/Referenz:

NEW QUESTION 108
Eric works as a system administrator at ABC organization and previously granted several users with access privileges to the organizations systems with unlimited permissions. These privileged users could prospectively misuse their rights unintentionally, maliciously, or could be deceived by attackers that could trick them to perform malicious activities.
Which of the following guidelines would help incident handlers eradicate insider at tacks by privileged users?

Do not allow administrators to use unique accounts during the installation process

Do not use encryption methods to prevent administrators and privileged users from accessing backup tapes and sensitive information

Do not control the access to administrators and privileged users

Do not enable default administrative accounts to ensure accountability

NEW QUESTION 109
Johnson is an incident handler and is working on a recent web application attack faced by his organization. As part of this process, he performed data preprocessing in order to analyze and detect the watering hole attack. Johnson preprocessed the outbound network traffic data collected from firewalls and proxy servers. He then started analyzing the user activities within a certain time period to create time ordered domain sequences to perform further analysis on sequential patterns. Identify the data-preprocessing step performed by Johnson.

User-specific sessionization

Identifying unpopular domains

Hostname normalization

Filtering invalid hostnames

NEW QUESTION 110
The free, open source, TCP/IP protocol analyzer, sniffer and packet capturing utility standard across many industries and educational institutions is known as:

Snort

Wireshark

Cain & Able

nmap

NEW QUESTION 111
Which of the following does NOT reduce the success rate of SQL injection?

Constrain legitimate characters to exclude special characters.

Automatically lock a user account at era predefined number of invalid login attempts within a predefined interval

Close unnecessary application services and ports on the server.

Limit the length of the input field.

NEW QUESTION 112
Installing a password cracking tool, downloading pornography material, sending emails to colleagues which
irritates them and hosting unauthorized websites on the company’s computer are considered:

Network based attacks

Unauthorized access attacks

Malware attacks

Inappropriate usage incidents

NEW QUESTION 113
A living high level document that states in writing a requirement and directions on how an agency plans to protect its information technology assets is called:

Information security Policy

Information security Procedure

Information security Baseline

Information security Standard

Laden …

Becoming Certified Incident Handler

If you opt to become a Certified Incident Handler, your job scope will fall under one of Incident Management Team (IMT) or Incident Response Team (IRT). The ECIH certificate is meant to equip you with the skills you need to deal with and manage computer security issues within a certain information system. In the modern IT environments, a Certified Incident Handler is expected to become a knowledgeable professional who can manage different kinds of incidents and understand the methodologies of risk assessment, including the common policies associated with incident handling. In many organizations, an incident handler will be responsible for creating incident handling policies & dealing with different forms of incidents for security comprising insider attack threats and incidents for malicious code. Therefore, getting certified will earn you recognition as the designated and highly respected incident handler in your company.

Get to the Top with 212-89 Practice Exam Questions: https://www.real4prep.com/212-89-exam.html