EC-COUNCIL 212-89 Online Practice Questions and Exam Preparation

EC-COUNCIL 212-89 Online Questions & Answers

• Question 211:

  During the process of detecting and containing malicious emails, incident responders should examine the originating IP address of the emails. The steps to examine the originating IP address are as follow:

  1.

  Search for the IP in the WHOIS database

  2.

  Open the email to trace and find its header

  3.

  Collect the IP address of the sender from the header of the received mail

  4.

  Look for the geographic address of the sender in the WHOIS database

  Identify the correct sequence of steps to be performed by the incident responders to examine originating IP address of the emails.

  A. 4-->1-->2-->3
  B. 2-->1-->4-->3
  C. 1-->3-->2-->4
  D. 2-->3-->1-->4
  D. 2-->3-->1-->4

  ---

  The correct sequence to examine the originating IP address of emails involves first accessing the email's header to locate the IP address, then using external resources to investigate that address further. The steps are as follows:

  Step 2:Open the email to trace and find its header. This is the initial step because the header contains valuable information about the email's journey across the internet, including the originating IP address.

  Step 3:Collect the IP address of the sender from the header of the received mail. This detail is crucial for the next steps in the investigation.

  Step 1:Search for the IP in the WHOIS database. This database can provide information about the owner of the IP address, including the ISP and sometimes the geographic location.

  Step 4:Look for the geographic address of the sender in the WHOIS database. With the IP address information obtained from the WHOIS search, the geographic location or the originating country of the email can often be deduced, contributing to the analysis of the email's legitimacy.

  References: The process of analyzing email headers to trace originating IP addresses and further investigating those addresses is a common practice in incident response, covered under the digital forensics and email analysis topics within the ECIH v3 curriculum by EC-Council.

• Question 212:

  Which type of incident involves unauthorized disclosure of classified organizational information without modifying or destroying the data?

  A. Integrity violation
  B. Availability violation
  C. Confidentiality violation
  D. Authenticity violation
  C. Confidentiality violation

  ---

  A confidentiality violation occurs when sensitive or classified information is accessed or disclosed to unauthorized individuals. Even if the data remains unchanged and available, unauthorized disclosure constitutes a confidentiality breach.

• Question 213:

  Eric works as an incident handler at Erinol software systems. He was assigned a task to protect the organization from any kind of DoS/DDoS attacks. Which of the following tools can be used by Eric to achieve his objective?

  A. Incapsula
  B. Hydra
  C. IDA
  D. Wireshark
  A. Incapsula

  ---

  Incapsula is a cloud-based application delivery platform that offers a comprehensive security solution, including protection against Distributed Denial of Service (DDoS) attacks. By providing DDoS mitigation services, Incapsula helps protect websites and online services from being overwhelmed by traffic intended to make the resource unavailable to its intended users. The platform filters out malicious traffic and allows legitimate traffic through, thus ensuring that the organization's online resources remain available even under attack.

  References: The ECIH v3 curriculum includes discussions on various tools and strategies for protecting organizations against DoS/DDoS attacks, highlighting the importance of incorporating services like Incapsula into an organization's cybersecurity defenses to mitigate the risk and impact of such attacks.

• Question 214:

  Which of the following is a type of malicious code or software that appears legitimate but can take control of your computer?

  A. Phishing attack
  B. DDoS
  C. Trojan attack
  D. Password attack
  C. Trojan attack

  ---

  A Trojan attack involves a type of malicious code or software that appears legitimate but can take control of your computer. Trojans often disguise themselves as legitimate software or are hidden within legitimate software that has been tampered with. They differ from viruses and worms because they do not replicate. However, once activated, Trojans can enable cyber-criminals to spy on you, steal your sensitive data, and gain backdoor access to your system. This can include unauthorized actions such as deleting files, monitoring user activities, or installing additional malicious software.

  References: The ECIH v3 course details various forms of malware, including Trojans, their modes of operation, and their impact on information security. Understanding the nature of these threats is crucial for effective incident handling and response.

• Question 215:

  Francis is an incident handler and security expert. He works at MorisonTech Solutions based in Sydney, Australia. He was assigned a task to detect phishing/spam mails for the client organization. Which of the following tools can assist Francis to perform the required task?

  A. Netcraft
  B. Nessus
  C. BTCrack
  D. Cain and Abel
  A. Netcraft

  ---

  Netcraft is a tool that provides internet security services, including the detection of phishing and spam emails. It offers a range of services that can help organizations identify fraudulent websites and phishing activities by analyzing web content and email messages for known phishing signatures and heuristics. This makes it a useful tool for incident handlers like Francis, who is tasked with detecting phishing and spam emails for client organizations. Other options listed, such as Nessus (a vulnerability scanner), BTCrack (a Bluetooth pin and link-key cracker), and Cain and Abel (a password recovery tool), do not specialize in detecting phishing or spam emails but serve different purposes in cybersecurity.

  References: The Incident Handler (ECIH v3) curriculum includes discussions on tools and methodologies for detecting and mitigating various cyber threats, including phishing and spam, highlighting tools like Netcraft for their utility in these areas.

• Question 216:

  Which of the following methods help incident responders to reduce the false-positive alert rates and further provide benefits of focusing on topmost priority issues reducing potential risk and corporate liabilities?

  A. Threat profiling
  B. Threat contextualization
  C. Threat correlation
  D. Threat attribution
  C. Threat correlation

  ---

  Threat correlation is a method used by incident responders to analyze and associate various indicators of compromise (IoCs) and alerts to identify genuine threats. By correlating data from multiple sources and applying intelligence to distinguish between unrelated events and coordinated attack patterns, responders can significantly reduce the rate of false-positive alerts. This enables teams to prioritize their efforts on the most critical and likely threats, thereby reducing potential risks and corporate liabilities. Effective threat correlation involves the use of sophisticated security information and event management (SIEM) systems, threat intelligence platforms, and analytical techniques to identify relationships between seemingly disparate security events and alerts.

  References: The role of threat correlation in improving the efficiency of incident response activities by reducing false positives and focusing on high-priority issues is outlined in various cybersecurity frameworks and incident response guides, including those related to the ECIH v3 certification. These resources emphasize the importance of applying context and intelligence to security alerts to accurately identify and respond to genuine threats.

• Question 217:

  The largest number of cyber-attacks are conducted by:

  A. Insiders
  B. Outsiders
  C. Business partners
  D. Suppliers
  B. Outsiders

  ---

  Explanation

• Question 218:

  ZYX company experienced a DoS/DDoS attack on their network. Upon investigating the incident, they concluded that the attack is an application-layer attack. Which of the following attacks did the attacker use?

  A. Slowloris attack
  B. UDP flood attack
  C. SYN flood attack
  D. Ping of ceath
  A. Slowloris attack

  ---

  The Slowloris attack is a type of application-layer attack that targets the web server by establishing and maintaining many simultaneous HTTP connections to the target server. Unlike traditional network-layer DoS /DDoS attacks such as UDP flood or SYN flood, Slowloris is designed to hold as many connections to the target web server open for as long as possible. It does so by sending partial requests, which are never completed, and periodically sending subsequent HTTP headers to keep the connections open. This consumes the server's resources, leading to denial of service as legitimate users cannot establish connections. The Slowloris attack is effective even against servers with a high bandwidth because it targets the server's connection pool, not its network bandwidth.

  References: Incident Handler (ECIH v3) courses and study guides particularly emphasize understanding different types of attacks, including application-layer attacks like Slowloris, as part of the incident handling and response process.

• Question 219:

  Allan performed a reconnaissance attack on his corporate network as part of a red-team activity. He scanned the IP range to find live host IP addresses. What type of technique did he use to exploit the network?

  A. DNS foot printing
  B. Social engineering
  C. Port scanning
  D. Ping sweeping
  D. Ping sweeping

  ---

  Ping sweeping is a technique used in network reconnaissance to identify which IP addresses in a range are active or live. By sending ICMP echo requests ("ping") to multiple hosts and observing which ones respond, an attacker or, in this case, a red team member like Allan, can determine which systems are up and potentially vulnerable to further exploration or attack. This method is foundational for mapping the network before deploying more targeted exploits or scans.

  References: EC-Council's Certified Incident Handler (ECIH v3) program discusses various reconnaissance techniques, including ping sweeping, as a preliminary step in network analysis and vulnerability assessment.

• Question 220:

  Which of the following is not a countermeasure to eradicate cloud security incidents?

  A. Patch the database vulnerabilities and improve the isolation mechanism
  B. Remove the malware files and traces from the affected components
  C. Check for data protection at both design and runtime
  D. Disable security options such as two factor authentication and CAPTCHA
  D. Disable security options such as two factor authentication and CAPTCHA

  ---

  Disabling security options such as two-factor authentication (2FA) and CAPTCHA is not a countermeasure to eradicate cloud security incidents. In fact, it is contrary to best security practices. 2FA adds an additional layer of security by requiring two forms of verification before granting access to an account or system. CAPTCHA helps prevent automated attacks by ensuring that the entity accessing the service is human. Both are important security measures that protect against unauthorized access and automated attacks, thereby enhancing cloud security.