EC-COUNCIL 212-89 Online Practice Questions and Exam Preparation

EC-COUNCIL 212-89 Online Questions & Answers

• Question 11:

  In which of the following confidentiality attacks attackers try to lure users by posing themselves as authorized AP by beaconing the WLAN's SSID?

  A. Evil twin AP
  B. Session hijacking
  C. Honeypot AP
  D. Masqueradin
  A. Evil twin AP

  ---

  In the described attack, where attackers pose as legitimate access points (APs) by beaconing the WLAN's SSID to lure users, the attack is known as an Evil twin AP attack. This type of attack involves setting up a rogue AP with the same SSID as a legitimate wireless access point, making it appear as an authorized network to users. Unsuspecting users may connect to this malicious AP, allowing attackers to intercept sensitive information, conduct man-in-the-middle attacks, or distribute malware. The Evil twin AP attack exploits the trust users have in known SSIDs to compromise their security.

  References: Incident Handler (ECIH v3) certification materials discuss various confidentiality and network attacks, including Evil twin AP attacks, highlighting their mechanisms and how to defend against them.

• Question 12:

  Darwin is an attacker residing within the organization and is performing network sniffing by running his system in promiscuous mode. He is capturing and viewing all the network packets transmitted within the organization. Edwin is an incident handler in the same organization. In the above situation, which of the following Nmap commands Edwin must use to detect Darwin's system that is running in promiscuous mode?

  A. nmap -sV -T4 -O -F -version-light
  B. nmap -sU -p 500
  C. nmap --script=sniffer-detect [Target IP Address/Range of IP addresses]
  D. nmap --script hostmap
  C. nmap --script=sniffer-detect [Target IP Address/Range of IP addresses]

  ---

  The GPG18 and Forensic readiness planning (SPF) principles outline various guidelines to enhance an organization's readiness for forensic investigation and response. Principle 5, which suggests that organizations should adopt a scenario-based Forensic Readiness Planning approach that learns from experience gained within the business, emphasizes the importance of being prepared for a wide range of potential incidents by leveraging lessons learned from past experiences. This approach helps in continuously improving forensic readiness and response capabilities by adapting to the evolving threat landscape and organizational changes.

  References: While specific documentation from GPG18 and SPF might detail these principles, the ECIH v3 program by EC-Council covers the concept of forensic readiness planning, including adopting scenario-based approaches and learning from past incidents as a fundamental aspect of enhancing an organization's incident response and forensic capabilities.

• Question 13:

  John is performing memory dump analysis in order to find out the traces of malware.

  He has employed volatility tool in order to achieve his objective.

  Which of the following volatility framework commands he will use in order to analyze running process from the memory dump?

  A. python vol.py svcscan --profile=Win2008SP1x86 -f /root/Desktop/memdump.mem | more
  B. python vol.py pslist --profile=Win2008SP1x86 -f /root/Desktop/memdump.mem
  C. python vol.py hivelist --profile=Win2008SP1x86 -f /root/Desktop/memdump.mem
  D. python vol.py imageinfo -f /root/Desktop/memdump.mem
  B. python vol.py pslist --profile=Win2008SP1x86 -f /root/Desktop/memdump.mem

  ---

  The Volatility framework is a widely used tool for analyzing volatile memory (RAM) dumps. It is especially useful in digital forensics and malware analysis. One of the fundamental tasks in memory analysis is to list the processes that were running on the system at the time the memory dump was taken. The pslist command in the Volatility framework serves this purpose by listing all processes from the process list in memory, which can provide valuable insights into what was happening on the system, including

  the presence of any malicious processes.

  The syntax provided in the answer option corresponds to the usage of the pslist command with the Volatility tool, specifying the memory dump file to be analyzed ( -f /root/Desktop/memdump.mem ) and the profile of the system from which the dump was taken ( --profile=Win2008SP1x86 ). This information is crucial for accurate analysis, as the profile helps Volatility interpret the memory structures correctly.

  References: The use of the pslist command within the Volatility framework for the purpose of analyzing running processes from a memory dump is documented in the official Volatility documentation and is a fundamental technique in the field of memory forensics as part of incident response activities.

• Question 14:

  Clark, a professional hacker, exploited the web application of a target organization by tampering the form and parameter values. He successfully exploited the web application and gained access to the information assets of the organization. Identify the vulnerability in the web application exploited by the attacker.

  A. Broken access control
  B. Security misconfiguration
  C. SQL injection
  D. Sensitive data exposure
  C. SQL injection

  ---

  The vulnerability exploited by Clark through tampering with form and parameter values to gain unauthorized access to information assets is indicative of Broken Access Control. Broken Access Control vulnerabilities occur when a web application does not properly enforce restrictions on what authenticated users are allowed to do. Attackers can exploit these vulnerabilities to access unauthorized functionality or data, such as accessing other users' accounts, viewing sensitive files, and modifying other users' data.

• Question 15:

  Which of the following techniques prevent or mislead incident-handling process and may also affect the collection, preservation, and identification phases of the forensic investigation process?

  A. Scanning
  B. Footprinting
  C. Enumeration
  D. Anti-forensics
  D. Anti-forensics

  ---

  Anti-forensics techniques are designed to prevent, mislead, or interfere with the incident handling process, affecting the collection, preservation, and identification phases of the forensic investigation process. These techniques include methods to erase, encrypt, or alter information, make data recovery difficult, hide data (e. g., steganography), or otherwise obstruct forensic analysis and investigation efforts. Anti-forensics can significantly challenge the efforts of incident responders and forensic investigators in establishing the facts of a security incident or crime.

  References: The Incident Handler (ECIH v3) courses and study guides discuss various challenges in digital forensics, including anti-forensics methods and their impact on the effectiveness of forensic investigations.

• Question 16:

  Business Continuity provides a planning methodology that allows continuity in business operations:

  A. Before and after a disaster
  B. Before a disaster
  C. Before, during and after a disaster
  D. During and after a disaster
  C. Before, during and after a disaster

  ---

  Explanation

• Question 17:

  Which of the following tools helps incident handlers to view the file system, retrieve deleted data, perform timeline analysis, web artifacts, etc., during an incident response process?

  A. Autopsy
  B. netstat
  C. Process Explorer
  D. nblslal
  A. Autopsy

  ---

  Autopsy is a digital forensics platform and graphical interface to The Sleuth Kit and other digital forensics tools. It is used by law enforcement, military, and corporate examiners to investigate what happened on a computer. Autopsy enables incident handlers to view the file system, retrieve deleted data, perform timeline analysis, and analyze web artifacts, among other functionalities. This tool is particularly useful during the incident response process for conducting in-depth investigations into the nature of a security incident, identifying the methods used by attackers, and recovering lost or compromised data.

  References: The EC-Council's Certified Incident Handler (ECIH v3) program covers digital forensic tools and techniques, highlighting the capabilities of Autopsy for supporting comprehensive incident investigations and response activities.

• Question 18:

  Ross is an incident manager (IM) at an organization, and his team provides support to all users in the organization who are affected by threats or attacks. David, who is the organization's internal auditor, is also part of Ross's incident response team. Which of the following is David's responsibility?

  A. Configure information security controls.
  B. Identify and report security loopholes to the management for necessary action.
  C. Coordinate incident containment activities with the information security officer (ISO).
  D. Perform the- necessary action to block the network traffic from the suspectoc intruder.
  B. Identify and report security loopholes to the management for necessary action.

  ---

  In the context of an incident response team, the role of an internal auditor like David includes identifying, evaluating, and reporting on information security risks and vulnerabilities within the organization. His responsibility is to ensure that the organization's security controls are effective and to identify any security loopholes that could be exploited by attackers. Once identified, he reports these vulnerabilities to management so that they can take the necessary actions to mitigate the risks. This role is critical in maintaining theorganization's overall security posture and ensuring compliance with relevant laws, regulations, and policies.

  References: Incident Handler (ECIH v3) courses and study guides cover the roles and responsibilities of incident response team members, highlighting the importance of internal auditors in identifying and addressing security vulnerabilities.

• Question 19:

  An organization implemented an encoding technique to eradicate SQL injection attacks. In this technique, if a user submits a request using single-quote and some values, then the encoding technique will convert it into numeric digits and letters ranging from a to f. This prevents the user request from performing SQL injection attempt on the web application. Identify the encoding technique used by the organization.

  A. Unicode encoding
  B. Base64 encoding
  C. Hex encoding
  D. URL encoding
  C. Hex encoding

  ---

  Hex encoding (also known as hexadecimal encoding) involves converting binary data into hexadecimal representation. In the context described, when a user submits a request with potentially malicious input (such as a single quote and other characters in an attempt to perform SQL injection), the encoding technique converts this input into a string of hexadecimal digits (ranging from 0 to 9 and A to F). This prevents the direct interpretation of the input as SQL commands by the database, thereby mitigating the risk of SQL injection attacks. This method is a form of input sanitization that helps ensure that user input cannot be used to manipulate database queries directly.

  References: The use of hex encoding as a technique to prevent SQL injection attacks is discussed in the ECIH v3 course materials. This includes an explanation of how encoding user input can protect web applications from injection and other forms of attacks by ensuring that inputs are treated as data rather than executable code.

• Question 20:

  Which of the following best describes an email issued as an attack medium, in which several messages are sent to a mailbox to cause overflow?

  A. Email-bombing
  B. Masquerading
  C. Spoofing
  D. Smurf attack
  A. Email-bombing

  ---

  Email-bombing refers to the attack where the attacker sends a massive volume of emails to a specific email address or mail server in order to overflow the mailbox or overwhelm the server, potentially causing it to fail or deny service to legitimate users. This attack can disrupt communications and, in some cases, lead to the targeted email account being disabled. Masquerading involves pretending to be another legitimate user, spoofing is the creation of emails (or other communications) with a forged sender address, and a smurf attack is a specific type of Distributed Denial of Service (DDoS) attack that exploits Internet Protocol (IP) and Internet Control Message Protocol (ICMP) to flood a target with traffic. Email-bombing specifically targets email services with the goal of causing disruption by overflowing inboxes.

  References: ECIH v3 courses and study guides often include discussions on various attack vectors used by cybercriminals, including email-based threats and their impact on organizational security.