EC-COUNCIL 212-82 Online Practice Questions and Exam Preparation

EC-COUNCIL 212-82 Online Questions & Answers

• Question 71:

  Brielle. a security professional, was instructed to secure her organization's network from malicious activities. To achieve this, she started monitoring network activities on a control system that collected event data from various sources. During this process. Brielle observed that a malicious actor had logged in to access a network device connected to the organizational network. Which of the following types of events did Brielle identify in the above scenario?

  A. Failure audit
  B. Error
  C. Success audit
  D. Warning
  C. Success audit

  ---

  Explanation/Reference:

  Success audit is the type of event that Brielle identified in the above scenario. Success audit is a type of event that records successful attempts to access a network device or resource. Success audit can be used to monitor authorized activities on a network, but it can also indicate unauthorized activities by malicious actors who have compromised credentials or bypassed security controls4. References: Success Audit Event

• Question 72:

  A disgruntled employee has set up a RAT (Remote Access Trojan) server in one of the machines in the target network to steal sensitive corporate documents. The IP address of the target machine where the RAT is installed is 20.20.10.26. Initiate a remote connection to the target machine from the "Attacker Machine-1" using the Theef client. Locate the "Sensitive Corporate Documents" folder in the target machine's Documents directory and determine the number of files. Mint: Theef folder is located at Z:\CCT-Tools\CCT Module 01 Information Security Threats and Vulnerabilities\Remote Access Trojans (RAT)\Theef of the Attacker Machine1.

  A. 2
  B. 4
  C. 5
  D. 3
  B. 4

  ---

  Explanation/Reference:

  The number of files in the "Sensitive Corporate Documents" folder is 4. This can be verified by initiating a remote connection to the target machine from the "Attacker Machine-1" using Theef client. Theef is a Remote Access

  Trojan (RAT) that allows an attacker to remotely control a victim's machine and perform various malicious activities. To connect to the target machine using Theef client, one can follow these steps:

  Launch Theef client from Z:\CCT-Tools\CCT Module 01 Information Security Threats and Vulnerabilities\Remote Access Trojans (RAT)\Theef on the "Attacker Machine-1". Enter the IP address of the target machine (20.20.10.26) and click on

  Connect. Wait for a few seconds until a connection is established and a message box appears saying "Connection Successful".

  Click on OK to close the message box and access the remote desktop of the target machine.

  Navigate to the Documents directory and locate the "Sensitive Corporate Documents" folder.

  Open the folder and count the number of files in it. The screenshot below shows an example of performing these steps: References: [Theef Client Tutorial], [Screenshot of Theef client showing remote desktop and folder]

• Question 73:

  A web application, www.moviescope.com. hosted on your tarqet web server is vulnerable to SQL injection attacks. Exploit the web application and extract the user credentials from the moviescope database. Identify the UID (user ID) of a

  user, John, in the database. Note:

  Vou have an account on the web application, and your credentials are samAest.

  A. 3
  B. 4
  C. 2
  D. 5
  B. 4

  ---

  Explanation/Reference:

  4 is the UID (user ID) of a user, John, in the database in the above scenario. A web application is a software application that runs on a web server and can be accessed by users through a web browser. A web application can be

  vulnerable to SQL injection attacks, which are a type of web application attack that exploit a vulnerability in a web application that allows an attacker to inject malicious SQL statements into an input field, such as a username or password field,

  and execute them on the database server. SQL injection can be used to bypass authentication, access or modify sensitive data, execute commands, etc. To exploit the web application and extract the user credentials from the moviescope

  database, one has to follow these steps:

  Open a web browser and type www.moviescope.com

  Press Enter key to access the web application.

  Enter sam as username and test as password.

  Click on Login button.

  Observe that a welcome message with username sam is displayed.

  Click on Logout button.

  Enter sam' or `1'='1 as username and test as password.

  Click on Login button.

  Observe that a welcome message with username admin is displayed, indicating that SQL injection was successful.

  Click on Logout button.

  Enter sam'; SELECT * FROM users; ?as username and test as password.

  Click on Login button.

  Observe that an error message with user credentials from users table is displayed.

  The user credentials from users table are:

  

  The UID that is mapped to user john is 4

• Question 74:

  Juan, a safety officer at an organization, installed a physical lock at the entrance of each floor. All employees in the organization were allotted a smart card embedded in their ID cards, which had to be swiped to unlock doors and Access any floor. Which of the following types of physical locks did Juan install In this scenario?

  A. Mechanical locks
  B. Digital locks
  C. Combination locks
  D. Electromagnetic locks
  B. Digital locks

  ---

  Explanation/Reference:

  Digital locks are the types of physical locks that Juan installed in this scenario. A physical lock is a device that prevents or restricts access to a physical location or environment, such as a door, a cabinet, a drawer, etc. A physical lock can have different types based on its mechanism or technology. A digital lock is a type of physical lock that uses electronic or digital components, such as a keypad, a card reader, a fingerprint scanner, etc., to unlock or lock . A digital lock can be used to provide enhanced security and convenience to users, but it can also be vulnerable to hacking or tampering. In the scenario, Juan installed a physical lock at the entrance of each floor. All employees in the organization were allotted a smart card embedded in their ID cards, which had to be swiped to unlock doors and access any floor. This means that he installed digital locks for those doors. A mechanical lock is a type of physical lock that uses mechanical components, such as a key, a bolt, a latch, etc., to unlock or lock. A combination lock is a type of physical lock that uses a sequence of numbers or symbols, such as a dial, a wheel, or a keypad, to unlock or lock. An electromagnetic lock is a type of physical lock that uses an electromagnet and an armature plate to unlock or lock.

• Question 75:

  An organization hired a network operations center (NOC) team to protect its IT infrastructure from external attacks. The organization utilized a type of threat intelligence to protect its resources from evolving threats. The threat intelligence helped the NOC team understand how attackers are expected to perform an attack on the organization, identify the information leakage, and determine the attack goals as well as attack vectors.

  Identify the type of threat intelligence consumed by the organization in the above scenario.

  A. Operational threat intelligence
  B. Strategic threat intelligence
  C. Technical threat intelligence
  D. Tactical threat intelligence
  C. Technical threat intelligence

  ---

  Explanation/Reference:

  Technical threat intelligence is a type of threat intelligence that provides information about the technical details of specific attacks, such as indicators of compromise (IOCs), malware signatures, attack vectors, and vulnerabilities. Technical threat intelligence helps the NOC team understand how attackers are expected to perform an attack on the organization, identify the information leakage, and determine the attack goals as well as attack vectors. Technical threat intelligence is often consumed by security analysts, incident responders, and penetration testers who need to analyze and respond to active or potential threats.

• Question 76:

  Kason, a forensic officer, was appointed to investigate a case where a threat actor has bullied certain children online. Before proceeding legally with the case, Kason has documented all the supporting documents, including source of the evidence and its relevance to the case, before presenting it in front of the jury.

  Which of the following rules of evidence was discussed in the above scenario?

  A. Authentic
  B. Understandable
  C. Reliable
  D. Admissible
  D. Admissible

  ---

  Explanation/Reference:

  Admissible is the rule of evidence discussed in the above scenario. A rule of evidence is a criterion or principle that determines whether a piece of evidence can be used in a legal proceeding or investigation. Admissible is a rule of evidence that states that the evidence must be relevant, reliable, authentic, and understandable to be accepted by a court or a jury . Admissible also means that the evidence must be obtained legally and ethically, without violating any laws or rights. In the scenario, Kason has documented all the supporting documents, including source of the evidence and its relevance to the case, before presenting it in front of the jury, which means that he has followed the admissible rule of evidence. Authentic is a rule of evidence that states that the evidence must be original or verifiable as genuine and not altered or tampered with. Understandable is a rule of evidence that states that the evidence must be clear and comprehensible to the court or jury and not ambiguous or confusing. Reliable is a rule of evidence that states that the evidence must be consistent and trustworthy and not based on hearsay or speculation.

• Question 77:

  The incident handling and response (IHandR) team of an organization was handling a recent cyberattack on the organization's web server. Fernando, a member of the IHandP team, was tasked with eliminating the root cause of the incident and closing all attack vectors to prevent similar incidents in future. For this purpose. Fernando applied the latest patches to the web server and installed the latest security mechanisms on it. Identify the IHandR step performed by Fernando in this scenario.

  A. Notification
  B. Containment
  C. Recovery
  D. Eradication
  D. Eradication

  ---

  Explanation/Reference:

  Eradication is the IHandR step performed by Fernando in this scenario. Eradication is a step in IHandR that involves eliminating the root cause of the incident and closing all attack vectors to prevent similar incidents in future.

  Eradication can include applying patches, installing security mechanisms, removing malware, restoring backups, or reformatting systems.

  References: [Eradication Step in IHandR]

• Question 78:

  Ruben, a crime investigator, wants to retrieve all the deleted files and folders in the suspected media without affecting the original files. For this purpose, he uses a method that involves the creation of a cloned copy of the entire media and prevents the contamination of the original media.

  Identify the method utilized by Ruben in the above scenario.

  A. Sparse acquisition
  B. Bit-stream imaging
  C. Drive decryption
  D. Logical acquisition
  B. Bit-stream imaging

  ---

  Explanation/Reference:

  Bit-stream imaging is the method utilized by Ruben in the above scenario. Bit-stream imaging is a method that involves creating a cloned copy of the entire media and prevents the contamination of the original media. Bit-stream imaging copies all the data on the media, including deleted files and folders, hidden partitions, slack space, etc., at a bit level. Bit-stream imaging preserves the integrity and authenticity of the digital evidence and allows further analysis without affecting the original media. Sparse acquisition is a method that involves creating a partial copy of the media by skipping empty sectors or blocks. Drive decryption is a method that involves decrypting an encrypted drive or partition using a password or a key. Logical acquisition is a method that involves creating a copy of the logical files and folders on the media using file system commands.

• Question 79:

  Kayden successfully cracked the final round of interviews at an organization. After a few days, he received his offer letter through an official company email address. The email stated that the selected candidate should respond within a specified time. Kayden accepted the opportunity and provided an e-signature on the offer letter, then replied to the same email address. The company validated the e-signature and added his details to their database. Here, Kayden could not deny the company's message, and the company could not deny Kayden's signature.

  Which of the following information security elements was described in the above scenario?

  A. Availability
  B. Non-repudiation
  C. Integrity
  D. Confidentiality
  B. Non-repudiation

  ---

  Explanation/Reference:

  The correct answer is B, as it describes the information security element that was described in the above scenario. Non-repudiation is an information security element that ensures that a party cannot deny sending or receiving a message or performing an action. In the above scenario, non-repudiation was described, as Kayden could not deny company's message, and company could not deny Kayden's signature. Option A is incorrect, as it does not describe the information security element that was described in the above scenario. Availability is an information security element that ensures that authorized users can access and use information and resources when needed. In the above scenario, availability was not described, as there was no mention of access or use of information and resources. Option C is incorrect, as it does not describe the information security element that was described in the above scenario. Integrity is an information security element that ensures that information and resources are accurate and complete and have not been modified by unauthorized parties. In the above scenario, integrity was not described, as there was no mention of accuracy or completeness of information and resources. Option D is incorrect, as it does not describe the information security element that was described in the above scenario. Confidentiality is an information security element that ensures that information and resources are protected from unauthorized access and disclosure. In the above scenario, confidentiality was not described, as there was no mention of protection or disclosure of information and resources. References: , Section 3.1

• Question 80:

  A software company is developing a new software product by following the best practices for secure application development. Dawson, a software analyst, is checking the performance of the application on the client's network to determine whether end users are facing any issues in accessing the application.

  Which of the following tiers of a secure application development lifecycle involves checking the performance of the application?

  A. Development
  B. Testing
  C. Quality assurance (QA)
  D. Staging
  B. Testing

  ---

  Explanation/Reference:

  The testing tier of a secure application development lifecycle involves checking the performance of the application on the client's network to determine whether end users are facing any issues in accessing the application. Testing is a crucial phase of software development that ensures the quality, functionality, reliability, and security of the application. Testing can be done manually or automatically using various tools and techniques, such as unit testing, integration testing, system testing, regression testing, performance testing, usability testing, security testing, and acceptance testing