Verified & Correct 212-89 Practice Test Reliable Source Nov 02, 2024 Updated
Free EC-COUNCIL 212-89 Exam Files Downloaded Instantly
The ECIH v2 certification is recognized globally, and it validates the candidate's ability to handle security incidents effectively. EC Council Certified Incident Handler (ECIH v3) certification covers various incident handling methodologies, including the NIST SP 800-61 rev2, Computer Emergency Response Team (CERT), and SANS. 212-89 course content also includes practical scenarios that simulate real-world security incidents that the candidate may face in their day-to-day operations.
NEW QUESTION # 35
A malicious, security-breaking program is disguised as a useful program. Such executable programs, which are installed when a file is opened, allow others to control a user's system. What is this type of program called?
- A. Virus
- B. Trojan
- C. Worm
- D. Spyware
Answer: B
NEW QUESTION # 36
Alice is a disgruntled employee. She decided to acquire critical information from her organization for financial benefit. To acccomplish this, Alice started running a virtual machine on the same physical host as her victim's virtual machine and took advantage of shared physical resources (processor cache) to steal data (cryptographic key/plain text secrets) from the victim machine. Identify the type of attack Alice is performing in the above scenario.
- A. Man-in-the-cloud attack
- B. SQL injection attack
- C. Service hijacking
- D. Side channel attack
Answer: D
Explanation:
A side channel attack, as described in the scenario, involves an attacker using indirect methods to gather information from a system. In this case, Alice is exploiting the shared physical resources, specifically the processor cache, of a virtual machine host to steal data from another virtual machine on the same host. This type of attack does not directly breach the system through conventional means like breaking encryption but instead takes advantage of the information leaked by the physical implementation of the system, such as timing information, power consumption, electromagnetic leaks, or, as in this case, shared resource utilization, to infer the secret data.
References:The EC-Council's Certified Incident Handler (ECIH v3) program covers various types of cyber attacks, including advanced techniques like side channel attacks, highlighting the need for comprehensive security strategies that consider both direct and indirect attack vectors.
NEW QUESTION # 37
Clark is investigating a cybercrime at TechSoft Solutions. While investigating the case, he needs to collect volatile information such as running services, their process IDs, startmode, state, and status.
Which of the following commands will help Clark to collect such information from running services?
- A. wmic
- B. net file
- C. Openfiles
- D. netstat -ab
Answer: A
Explanation:
WMIC (Windows Management Instrumentation Command-line) is a command-line tool that provides a unified interface for Windows management tasks, including the collection of system information. It allows administrators and forensic investigators to query the live system for information about running services, their process IDs, start modes, states, and statuses, among other data. The use of WMIC is particularly valuable in incident response scenarios for gathering volatile information from a system without having to install additional software, which might alter the state of the system being investigated. By executing specific WMIC commands, Clark can extract detailed information about the services running on a system at the time of the investigation, making it an essential tool for collecting volatile data in a forensically sound manner.
References:The ECIH v3 courses and study guides emphasize the importance of collecting volatile data during incident response and digital forensics investigations. They specifically highlight the use of built-in Windows tools like WMIC for gathering essential system information without compromising the integrity of the evidence.
NEW QUESTION # 38
A Host is infected by worms that propagates through a vulnerable service; the sign(s) of the presence of the
worm include:
- A. System becomes instable or crashes
- B. Established connection attempts targeted at the vulnerable services
- C. All the above
- D. Decrease in network usage
Answer: A
NEW QUESTION # 39
Clark, a professional hacker, successfully exploited the web application of a target organization by tampering the form and parameter values. In result, Clark gained access to the information assets of the organization. Identify the vulnerability in the web application exploited by the attacker.
- A. Broken access control
- B. Security misconfiguration
- C. SQL injection
- D. Sensitive data exposure
Answer: C
NEW QUESTION # 40
Incident may be reported using/ by:
- A. Email or on-line Web form
- B. Facsimile (Fax)
- C. Phone call
- D. All the above
Answer: D
NEW QUESTION # 41
Which of the following are malicious software programs that infect computers and corruptor delete the data on them?
- A. Trojans
- B. Virus
- C. Worms
- D. Spyware
Answer: B
NEW QUESTION # 42
Otis is an incident handler working in an organization called Delmont. Recently, the organization faced several setbacks in business, whereby its revenues are decreasing. Otis was asked to take charge and look into the matter. While auditing the enterprise security, he found traces of an attack through which proprietary information was stolen from the enterprise network and passed onto their competitors. Which of the following information security incidents did Delmont face?
- A. Network and resource abuses
- B. Espionage
- C. Email-based abuse
- D. Unauthorized access
Answer: B
NEW QUESTION # 43
Which of the following is not a best practice to eliminate the possibility of insider attacks?
- A. Always leave business details over voicemail or email broadcast message
- B. Disable the users from installing unauthorized software or accessing malicious websites using the corporate network
- C. Implement secure backup and disaster recovery processes for business continuity
- D. Monitor employee behaviors and the computer systems used by employees
Answer: A
NEW QUESTION # 44
Removing or eliminating the root cause of the incident is called:
- A. Incident Containment
- B. Incident Protection
- C. Incident Eradication
- D. Incident Classification
Answer: C
NEW QUESTION # 45
Adam is an incident handler who intends to use DBCCLOG command to analyze a database and retrieve the active transaction logfiles for the specified database. The syntax of DBCC LG command is DBCC LOG (<database name>, <output>), where the output parameter specifies the level of information an incident handler wants to retrieve.
If Adam wants to retrieve the full information on each operation along with the hex dump of a current transaction row, which of the following output parameters should Adam use?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: A
NEW QUESTION # 46
The network perimeter should be configured in such a way that it denies all incoming and outgoing traffic/ services that are not required. Which service listed below, if blocked, can help in preventing Denial of Service attack?
- A. SAM service
- B. SMTP service
- C. POP3 service
- D. Echo service
Answer: D
NEW QUESTION # 47
Which of the following is a type of malicious code or software that appears legitimate but can take control of your computer?
- A. Trojan attack
- B. DDoS
- C. Phishing attack
- D. Password attack
Answer: A
Explanation:
A Trojan attack involves a type of malicious code or software that appears legitimate but can take control of your computer. Trojans often disguise themselves as legitimate software or are hidden within legitimate software that has been tampered with. They differ from viruses and worms because they do not replicate.
However, once activated, Trojans can enable cyber-criminals to spy on you, steal your sensitive data, and gain backdoor access to your system. This can include unauthorized actions such as deleting files, monitoring user activities, or installing additional malicious software.
References:The ECIH v3 course details various forms of malware, including Trojans, their modes of operation, and their impact on information security. Understanding the nature of these threats is crucial for effective incident handling and response.
NEW QUESTION # 48
John is a professional hacker who is performing an attack on the target organization where he tries to redirect the connection between the IP address and its target server such that when the users type in the Internet address, it redirects them to a rogue website that resembles the original website. He tries this attack using cache poisoning technique.
Identify the type of attack John is performing on the target organization.
- A. Pre texting
- B. War driving
- C. Skimming
- D. Pharming
Answer: D
NEW QUESTION # 49
Business Continuity planning includes other plans such as:
- A. Contingency plan
- B. All the above
- C. Business recovery and resumption plans
- D. Incident/disaster recovery plan
Answer: B
NEW QUESTION # 50
Which of the following digital evidence is temporarily stored on a digital device that requires a constant power supply and is deleted if the power supply is interrupted?
- A. Swap file
- B. Process memory
- C. Slack space
- D. Event logs
Answer: B
NEW QUESTION # 51
XYZ Inc. was affected by a malware attack and James, being the incident handling and response (IH&R) team personnel handling the incident, found out that the root cause of the incident is a backdoor that has bypassed the security perimeter due to an existing vulnerability in the deployed firewall. James had contained the spread of the infection and removed the malware completely. Now the organization asked him to perform an incident impact assessment to identify the impact of the incident over the organization and he was also asked to prepare a detailed report of the incident.
Which of the following stages in IH&R process is James working on?
- A. Evidence gathering and forensics analysis
- B. Post-incident activities
- C. Notification
- D. Eradication
Answer: B
NEW QUESTION # 52
Which of the following tools helps incident responders effectively contain a potential cloud security incident and gather required forensic evidence?
- A. Qualys Cloud Platform
- B. Alert Logic
- C. Cloud Passage Quarantine
- D. Cloud Passage Halo
Answer: D
NEW QUESTION # 53
......
Career Path
After accomplishing the ECIH certification, you can apply for the CHFI (Computer Hacking Forensic Investigator) and the CASE (Certified Application Security Engineer) to become a multi-domain specialist. In addition, there are many other specialized certifications that you can opt to master in IT security. Thus, if you plan to become a Licensed Security consultant, it's recommended to take the Licensed Penetration Test Master (LPT) qualification. In all, these certificates can attract potential employers and lead you to a successful path.
Pass EC-COUNCIL 212-89 exam Dumps 100 Pass Guarantee With Latest Demo: https://www.freepdfdump.top/212-89-valid-torrent.html
The 212-89 PDF Dumps Greatest for the EC-COUNCIL Exam Study Guide!: https://drive.google.com/open?id=1sMvLYhhUQWkAjMJ8RorS812DxnBy2Ut0
