EC-COUNCIL 212-89 Online Practice Questions and Exam Preparation

EC-COUNCIL 212-89 Online Questions & Answers

• Question 171:

  A methodical series of techniques and procedures for gathering evidence, from computing equipment and various storage devices and digital media, that can be presented in a court of law in a coherent and meaningful format is called:

  A. Forensic Analysis
  B. Computer Forensics
  C. Forensic Readiness
  D. Steganalysis
  B. Computer Forensics

  ---

  Explanation

• Question 172:

  The individual who recovers, analyzes, and preserves computer and related materials to be presented as evidence in a court of law and identifies the evidence, estimates the potential impact of the malicious activity on the victim, and assesses the intent and identity of the perpetrator is called:

  A. Digital Forensic Examiner
  B. Computer Forensic Investigator
  C. Computer Hacking Forensic Investigator
  D. All the above
  D. All the above

  ---

  Explanation

• Question 173:

  If a hacker cannot find any other way to attack an organization, they can influence an employee or a disgruntled staff member. What type of threat is this?

  A. Phishing attack
  B. Insider attack
  C. Footprinting
  D. Identity theft
  B. Insider attack

  ---

  If a hacker influences an employee or a disgruntled staff member to gain access to an organization's resources or sensitive information, this is classified as an insider attack. Insider attacks are perpetrated by individuals within the organization, such as employees, contractors, or business associates, who have inside information concerning the organization's security practices, data, and computer systems. The threat from insiders can be intentional, as in the case of a disgruntled employee seeking to harm the organization, or unintentional, where an employee is manipulated or coerced by external parties without realizing the implications of their actions. Phishing attacks, footprinting, and identity theft represent different types of cybersecurity threats where the attacker's method or objective differs from that of insider attacks.

  References: The ECIH v3 certification program addresses various types of threats, including insider threats, emphasizing the importance of recognizing and mitigating risks posed by individuals within the organization.

• Question 174:

  Shally, an incident handler, is working for a company named Texas Pvt. Ltd. based in Florida. She was asked to work on an incident response plan. As part of the plan, she decided to enhance and improve the security infrastructure of the enterprise. She has incorporated a security strategy that allows security professionals to use several protection layers throughout their information system. Due to multiple layer protection, this security strategy assists in preventing direct attacks against the organization's information system as a break in one layer only leads the attacker to the next layer.

  Identify the security strategy Shally has incorporated in the incident response plan.

  A. Defense-in-depth
  B. Three-way handshake
  C. Covert channels
  D. Exponential backoff algorithm
  A. Defense-in-depth

  ---

  Shally has incorporated the Defense-in-depth strategy into the incident response plan for Texas Pvt. Ltd. Defense-in-depth is a layered security approach that involves implementing multiple security measures and controls throughout an information system. This strategy is designed to provide several defensive barriers to protect against threats and attacks, ensuring that if one layer is compromised, others still provide protection. The goal is to create a multi-faceted defense that addresses potential vulnerabilities in various areas, including physical security, network security, application security, and user education.

  References: The Incident Handler (ECIH v3) courses and study guides often emphasize the importance of a Defense-in-depth strategy in creating robust security infrastructures to protect against a wide range of cyber threats.

• Question 175:

  James has been appointed as an incident handling and response (IHandR) team lead and he was assigned to build an IHandR plan along with his own team in the company. Identify the IHandR process step James is currently working on.

  A. Eradication
  B. Recovery
  C. Preparation
  D. Notification
  C. Preparation

  ---

  In the context of incident handling and response (IHandR), the preparation phase is the initial step where teams and resources are organized to effectively respond to potential security incidents. This phase involves building the IHandR team, developing incident response plans and policies, setting up communication channels, and ensuring that the team has the necessary tools and authority to act. James, being assigned to build an IHandR plan and organize his team, is engaging in the preparation step of the incident response process. This foundational step is crucial for ensuring a coordinated and efficient response to incidents when they occur.

  References: The importance of the preparation phase in the incident response lifecycle is emphasized in various cybersecurity frameworks and guidelines, including those covered in ECIH v3 certification materials, which detail the roles, responsibilities, and planning necessary to establish an effective incident response capability.

• Question 176:

  Elizabeth, who works for OBC organization as an incident responder, is assessing the risks to the organizational security. As part of the assessment process, she is calculating the probability of a threat source exploiting an existing system vulnerability. Which of the following risk assessment steps is Elizabeth currently in?

  A. Vulnerability identification
  B. Impact analysis
  C. Likelihood analysis
  D. System characterization
  C. Likelihood analysis

  ---

  In the risk assessment process, calculating the probability that a threat source will exploit an existing system vulnerability is known as likelihood analysis. This step involves evaluating how probable it is that the organization's vulnerabilities can be exploited by potential threats, considering various factors such as the nature of the vulnerability, the presence and capability of threat actors, and the effectiveness of current controls. Elizabeth's task of assessing the probability of exploitation is crucial for understanding the risk level associated with different vulnerabilities and for prioritizing risk mitigation efforts based on the likelihood of occurrence.

  References: The Certified Incident Handler (ECIH v3) program by EC-Council includes detailed discussions on risk assessment methodologies, where likelihood analysis is highlighted as a key component in evaluating risks to organizational security.

• Question 177:

  Which of the following is the BEST method to prevent email incidents?

  A. Installing antivirus rule updates
  B. Disabling HTML in email content fields
  C. Web proxy filtering
  D. End-user training
  D. End-user training

  ---

  While technical solutions like antivirus updates, disabling HTML in emails, and web proxy filtering play significant roles in securing email systems, the best method to prevent email incidents is often considered to be end-user training. This is because many email threats, such as phishing, rely on exploiting user behavior rather than technical vulnerabilities. By educating users on the risks associated with suspicious emails, how to recognize potentially harmful messages, and the importance of not clicking on unknown links or attachments, organizations can significantly reduce the risk of email-related incidents. End-user training empowers individuals to act as a critical line of defense against email-based threats, complementing technical safeguards.

  References: EC-Council's Certified Incident Handler (ECIH v3) curriculum emphasizes the importance of a holistic approach to cybersecurity, including the key role of end-user education in preventing email incidents and other security breaches.

• Question 178:

  The free, open source, TCP/IP protocol analyzer, sniffer and packet capturing utility standard across many industries and educational institutions is known as:

  A. Snort
  B. Wireshark
  C. Cain and Able
  D. nmap
  B. Wireshark

  ---

  Explanation

• Question 179:

  Ren is assigned to handle a security incident of an organization. He is tasked with forensics investigation to find the evidence needed by the management. Which of the following steps falls under the investigation phase of the computer forensics investigation process?

  A. Secure the evidence
  B. Risk assessment
  C. Setup a computer forensics lab
  D. Evidence assessment
  D. Evidence assessment

  ---

  Evidence assessment is a critical step in the investigation phase of the computer forensics process. This step involves evaluating the evidence collected to determine its relevance and significance to the case at hand. It includes analyzing the secured data to identify what information can be used as evidence, its integrity, and how it can be related to the security incident. This phase is pivotal as it helps in building a coherent understanding of the incident and in establishing facts that can be presented in management reports or legal proceedings.

  References: The Certified Incident Handler (ECIH v3) by EC-Council includes a comprehensive discussion on the computer forensics investigation process, detailing steps from securing evidence to analyzing and assessing it within the context of an investigation.

• Question 180:

  Which of the following is NOT a network forensic tool?

  A. Capsa Network Analyzer
  B. Tcpdurnp
  C. Advancec NTFS Journaling Parser
  D. Wireshark
  C. Advancec NTFS Journaling Parser

  ---

  Network forensic tools are designed to capture, record, and analyze network traffic. Tools like Capsa Network Analyzer, Tcpdump, and Wireshark are specifically designed for this purpose, providing capabilities to capture live traffic, analyze packets, and understand network activities. Capsa Network Analyzer is a comprehensive network monitoring tool, Tcpdump is a powerful command-line packet analyzer, and Wireshark is a widely used network protocol analyzer that provides detailed information about network traffic.

  Advanced NTFS Journaling Parser, on the other hand, is not a network forensic tool but a tool used for forensic analysis of NTFS file systems. It parses the NTFS journal ($LogFile), which contains a log of changes made to files on an NTFS volume. This tool is valuable for forensic analysts who are investigating the file system activities on a Windows system, such as file creation, modification, and deletion times, rather than analyzing network traffic. Therefore, it does not fit the category of a network forensic tool.

  References: The ECIH v3 curriculum from EC-Council covers a range of tools useful for incident handlers and forensic analysts, distinguishing between network forensic tools and those used for other types of forensic analysis, such as file system investigation.