EC-COUNCIL 212-89 Online Practice Questions and Exam Preparation

EC-COUNCIL 212-89 Online Questions & Answers

• Question 1:

  Which of the following port scanning techniques involves resetting the TCP connection between client and server abruptly before completion of the three-way handshake signals, making the connection half-open?

  A. Null scan
  B. Full connect scan
  C. Stealth scan
  D. Xmas scan
  C. Stealth scan

  ---

  The port scanning technique that involves resetting the TCP connection between the client and server abruptly before the completion of the three-way handshake, thereby leaving the connection half-open, is known as a Stealth scan (also referred to as a SYN scan). This technique allows the scanner to inquire about the status of a port without establishing a full TCP connection, making the scan less detectible to intrusion detection systems and less likely to be logged by the target. It's a method used to discreetly discover open ports on a target machine without establishing a full connection that would be visible in logs.

  References: ECIH v3 certification materials often cover different types of network scanning techniques, including Stealth scans, explaining their methodologies, purposes, and how they can be detected or mitigated.

• Question 2:

  Which of the following terms refers to vulnerable account management functions, including account update, recovery of forgotten or lost passwords, and password reset, that might weaken valid authentication schemes?

  A. SQL injection
  B. Broken account management
  C. Directory traversal
  D. Cross-site scripting
  B. Broken account management

  ---

  The term "broken account management" refers to vulnerabilities in the account management functions of web applications, which can weaken valid authentication schemes. This can include issues with how accounts are created, updated, managed, and deleted, as well as how users recover forgotten passwords or perform password resets. Poorly implemented account management functions can allow attackers to bypass authentication, elevate privileges, or assume the identity of another user. This weakness is a significant security concern because it directly impacts the ability of a system to safeguard user data and maintain operational integrity.

  References: In its training materials, the ECIH v3 program addresses various web application vulnerabilities, including broken account management, emphasizing the importance of secure development practices and regular security assessments to prevent such issues.

• Question 3:

  Which of the following options describes common characteristics of phishing emails?

  A. Written in French
  B. Sent from friends or colleagues
  C. Urgency, threatening, or promising subject lines
  D. No BCC fields
  C. Urgency, threatening, or promising subject lines

  ---

  Phishing emails often share common characteristics designed to manipulate the recipient into taking immediate action. One of the hallmark features is the use of urgency, threatening language, or promising subject lines in the emails. These tactics are intended to create a sense of urgency or fear, compelling the recipient to respond quickly without giving due consideration to the legitimacy of the email. Phishing emails may claim that the recipient's account has been compromised, that they need to confirm personal information immediately, or that they have won a prize. The goal is to trick the recipient into clicking on malicious links, opening attachments, or providing sensitive information.

  References: The Certified Incident Handler (ECIH v3) program by EC-Council covers the identification and handling of phishing incidents, including the analysis of phishing emails and the importance of educating users on recognizing and responding to phishing attempts.

• Question 4:

  An attacker exploits a web application flaw that allows unauthorized users to execute commands on the server hosting the application. Which phase of incident handling focuses on identifying how this vulnerability was exploited?

  A. Containment
  B. Detection and analysis
  C. Recovery
  D. Incident disclosure
  B. Detection and analysis

  ---

  The detection and analysis phase focuses on identifying the nature of the incident, attack vectors used, exploited vulnerabilities, and affected systems. Understanding how the attacker executed commands is essential before containment or eradication actions can be applied.

• Question 5:

  Keyloggers do NOT:

  A. Run in the background
  B. Alter system files
  C. Secretly records URLs visited in browser, keystrokes, chat conversations, ...etc
  D. Send log file to attacker's email or upload it to an ftp server
  B. Alter system files

  ---

  Explanation

• Question 6:

  Which of the following GPG18 and Forensic readiness planning (SPF) principles states that "organizations should adopt a scenario based Forensic Readiness Planning approach that learns from experience gained within the business"?

  A. Principle 3
  B. Principle 2
  C. Principle 5
  D. Principle 7
  C. Principle 5

  ---

  The GPG18 and Forensic readiness planning (SPF) principles outline various guidelines to enhance an organization's readiness for forensic investigation and response. Principle 5, which suggests that organizations should adopt a scenario-based Forensic Readiness Planning approach that learns from experience gained within the business, emphasizes the importance of being prepared for a wide range of potential incidents by leveraging lessons learned from past experiences. This approach helps in continuously improving forensic readiness and response capabilities by adapting to the evolving threat landscape and organizational changes.

  References: While specific documentation from GPG18 and SPF might detail these principles, the ECIH v3 program by EC-Council covers the concept of forensic readiness planning, including adopting scenario-based approaches and learning from past incidents as a fundamental aspect of enhancing an organization's incident response and forensic capabilities.

• Question 7:

  Which type of malware enables an attacker to maintain long-term, covert access to a compromised system?

  A. Worm
  B. Logic bomb
  C. Backdoor
  D. Adware
  C. Backdoor

  ---

  A backdoor provides attackers with persistent and covert access to a system, bypassing normal authentication mechanisms. Backdoors are commonly used to maintain long-term control over compromised systems.

• Question 8:

  Bran is an incident handler who is assessing the network of the organization. In the process, he wants to detect ping sweep attempts on the network using Wireshark tool. Which of the following Wireshark filter he must use to accomplish this task?

  A. icmp.seq
  B. icmp.redir_gw
  C. icmp.type==8
  D. icmp.ident
  C. icmp.type==8

  ---

  In Wireshark, the filter icmp.type==8 is used to detect ping sweep attempts. ICMP type 8 messages are echo requests, which are used in ping operations to check the availability of a network device. A ping sweep involves sending ICMP echo requests to multiple addresses to discover active devices on a network. By filtering for ICMP type 8 messages in Wireshark, Bran can identify these echo requests, helping to pinpoint ping sweep activities on the network.

  References: Wireshark, as a network protocol analyzer, is frequently discussed in the ECIH v3 program, with particular emphasis on its utility in detecting network reconnaissance activities like ping sweeps through specific filter usage.

• Question 9:

  CSIRT can be implemented at:

  A. Internal enterprise level
  B. National, government and military level
  C. Vendor level
  D. All the above
  D. All the above

  ---

  Explanation

• Question 10:

  James is a professional hacker and is employed by an organization to exploit their cloud services. In order to achieve this, James created anonymous access to the cloud services to carry out various attacks such as password and key cracking, hosting malicious data, and DDoS attacks. Which of the following threats is he posing to the cloud platform?

  A. Insecure interface and APIs
  B. Data breach/loss
  C. Insufficient duo diligence
  D. Abuse end nefarious use of cloud services
  D. Abuse end nefarious use of cloud services

  ---

  James's activities, including creating anonymous access to cloud services to carry out attacks such as password and key cracking, hosting malicious data, and conducting DDoS attacks, exemplify the abuse and nefarious use of cloud services. This threat involves exploiting cloud computing resources to conduct malicious activities, which can impact the cloud service provider as well as other users of the cloud services. This abuse ranges from using the cloud platform's resources for computationally intensive tasks like cracking passwords or encryption keys to conducting DDoS attacks that can disrupt services for legitimate users.

  References: The Incident Handler (ECIH v3) certification emphasizes understanding cloud-specific security challenges, including the abuse of cloud services, and recommends strategies for mitigating such risks, highlighting the need for comprehensive security measures to protect cloud environments.