EC-COUNCIL 212-89 Online Practice Questions and Exam Preparation

EC-COUNCIL 212-89 Online Questions & Answers

• Question 181:

  Which category of insider threat involves individuals whose credentials are stolen and misused by external attackers?

  A. Malicious insider
  B. Professional insider
  C. Negligent insider
  D. Compromised insider
  D. Compromised insider

  ---

  A compromised insider refers to a legitimate user whose credentials or system access has been taken over by an external attacker, enabling unauthorized activities under a trusted identity.

• Question 182:

  QualTech Solutions is a leading security services enterprise. Dickson works as an incident responder with this firm. He is performing vulnerability assessment to identify the security problems in the network, using automated tools to identify the hosts, services, and vulnerabilities present in the enterprise network. Based on the above scenario, identify the type of vulnerability assessment performed by Dickson.

  A. Internal assessment
  B. Active assessment
  C. Passive assessment
  D. External assessment
  D. External assessment

  ---

  An active assessment involves using automated tools to scan and probe the network actively to identify hosts, services, and vulnerabilities. This type of assessment directly interacts with the network components to gather information about the existing security posture, unlike passive assessments, which analyze traffic without sending packets to the target systems. Dickson's approach, employing automated tools to identify the network's hosts, services, and vulnerabilities, fits the definition of an active assessment. This method provides a more immediate understanding of the network's vulnerabilities, allowing for timely remediation actions.

  References: The ECIH v3 program includes discussions on vulnerability assessment techniques, highlighting the differences between active and passive assessments and their applicability in identifying network security issues.

• Question 183:

  James is working as an incident responder at CyberSol Inc. The management instructed James to investigate a cybersecurity incident that recently happened in the company. As a part of the investigation process, James started collecting volatile information from a system running on Windows operating system. Which of the following commands helps James in determining all the executable files for running processes?

  A. cate A and. time ,/t
  B. netstat -ab
  C. top
  D. doskey/history
  B. netstat -ab

  ---

  The netstat -ab command is useful in Windows operating systems for displaying all connections and listening ports, along with the executable involved in creating each connection or listening port. This can be particularly valuable for an incident responder like James when attempting to determine which processes are running on a system and how they are communicating over the network. This information can help identify malicious processes, unauthorized connections, or other signs of compromise on the system. Whilenetstat -ab does not exclusively list executable files for running processes, it ties processes to network activity, which is a critical part of collecting volatile information during a cybersecurity incident investigation.

  References: The Certified Incident Handler (ECIH v3) course by EC-Council covers various commands and tools that can be used to collect volatile data from systems as part of incident response activities, highlighting the importance of understanding network connections and the processes responsible for them.

• Question 184:

  A US Federal Agency network was the target of a DoS attack that prevented and impaired the normal authorized functionality of the networks. According to agency's reporting timeframe guidelines, this incident should be reported within 2 h of discovery/detection if the successful attack is still ongoing and the agency is unable to successfully mitigate the activity. Which incident category of US Federal Agency does this incident belong to?

  A. CAT 6
  B. CAT 2
  C. CAT 1
  D. CAT 5
  B. CAT 2

  ---

  In the context of US Federal Agencies, incidents are categorized based on their impact on operations, assets, or individuals. A DoS attack that prevents or impairs the authorized functionality of networks and is still ongoing without successful mitigation efforts typically falls under Category 2 (CAT 2). This category is designated for incidents that have a significant impact, requiring immediate reporting and response. The reporting timeframe of within 2 hours as mentioned aligns with the urgency associated with CAT 2 incidents, emphasizing the need for swift action to address the attack and restore normal operations.

  References: US Federal incident response guidelines and the Incident Handler (ECIH v3) courses outline the categorization of cybersecurity incidents, detailing the response protocols for each category, including the reporting timeframes.

• Question 185:

  Preventing the incident from spreading and limiting the scope of the incident is known as:

  A. Incident Eradication
  B. Incident Protection
  C. Incident Containment
  D. Incident Classification
  C. Incident Containment

  ---

  Explanation

• Question 186:

  Which of the following risk management processes identifies the risks, estimates the impact, and determines sources to recommend proper mitigation measures?

  A. Risk assessment
  B. Risk assumption
  C. Risk mitigation
  D. Risk avoidance
  A. Risk assessment

  ---

  Risk assessment is the risk management process that involves identifying risks, estimating their impact on the organization, and determining the sources of those risks to recommend appropriate mitigation measures. The goal of a risk assessment is to understand the nature of potential threats, vulnerabilities, and the consequences of those risks materializing, allowing an organization to make informed decisions about how to address them effectively. Risk assumption involves accepting the potential impact of a risk, risk mitigation focuses on reducing the likelihood or impact of risks, and risk avoidance involves taking actions to avoid the risk entirely.

  References: The ECIH v3 course materials include discussions on risk management processes, outlining the importance of risk assessment in identifying and preparing for potential security threats.

• Question 187:

  An organization named Sam Morison Inc. decided to use cloud-based services to reduce the cost of their maintenance. They first identified various risks and threats associated with cloud .. adoption and migrating critical business data to third-party systems. Hence, the organization decided to deploy cloud-based security tools to prevent upcoming threats. Which of the following tools would help the organization to secure cloud resources and services?

  A. Nmap
  B. Alert Logic
  C. Burp Suite
  D. Wireshark
  B. Alert Logic

  ---

  Explanation

• Question 188:

  Which of the following is an Inappropriate usage incident?

  A. Access-control attack
  B. Reconnaissance attack
  C. Insider threat
  D. Denial-of-service attack
  C. Insider threat

  ---

  An Inappropriate Usage incident refers to instances where computing resources are misused or abused, often violating organizational policies or laws. While access-control attacks, reconnaissance attacks, and denial-of- service (DoS) attacks represent different types of external threats or methods of attack, an Insider Threat is an example of inappropriate usage. Insider threats come from individuals within the organization, such as employees or contractors, who misuse their access to harm the organization's interests. This can include stealing confidential information, intentionally disrupting systems, or other malicious activities that leverage their legitimate access to the organization's resources.

  References: EC-Council's Incident Handler (ECIH v3) materials often discuss various types of security incidents, including inappropriate usage, and emphasize the importance of recognizing and preparing for insider threats as a critical component of an organization's incident response strategy.

• Question 189:

  Which of the following types of digital evidence is temporarily stored in a digital device that requires constant power supply and is deleted if the power supply is interrupted?

  A. Slack space
  B. Process memory
  C. Event logs
  D. Swap file
  B. Process memory

  ---

  Process memory (RAM) is a type of digital evidence that is temporarily stored and requires a constant power supply to retain information. If the power supply is interrupted, the information stored in process memory is lost. This type of evidence can include data about running programs, user actions, system events, and more, making it crucial for forensic analysis, especially in identifying actions taken by both users and malware. Collecting data from process memory helps incident responders understand the state of the system at the time of an incident and can reveal valuable information that is not persisted elsewhere on the device.

  References: Incident handling and response training, such as the ECIH v3 program, emphasize the importance of collecting and analyzing volatile data, including process memory, to effectively investigate and respond to cybersecurity incidents.

• Question 190:

  Which one of the following is Inappropriate Usage Incidents?

  A. Insider Threat
  B. Reconnaissance Attack
  C. Access Control Attack
  D. Denial of Service Attack
  A. Insider Threat

  ---

  Explanation