EC-COUNCIL 212-89 Online Practice Questions and Exam Preparation

EC-COUNCIL 212-89 Online Questions & Answers

• Question 221:

  Andrew, an incident responder, is performing risk assessment of the client organization.

  As a part of risk assessment process, he identified the boundaries of the IT systems, along with the resources and the information that constitute the systems.

  Identify the risk assessment step Andrew is performing.

  A. Control analysis
  B. System characterization
  C. Likelihood determination
  D. Control recommendations
  B. System characterization

  ---

  In the risk assessment process, "System characterization" is the initial step where the scope of the assessment is defined. This involves identifying and documenting the boundaries of the IT systems under review, the resources (hardware, software, data, and personnel) that constitute these systems, and any relevant information about their operation and environment. This foundational step is essential for understanding what needs to be protected and forms the basis for subsequent analysis, including identifying vulnerabilities, assessing potential threats, and determining the impact of risks to the organization.

  References: The step of system characterization within the risk assessment process is discussed in detail in information security frameworks and incident response guides, including those related to the ECIH v3 certification. These guides stress the importance of accurately characterizing the system to ensure that the risk assessment is comprehensive and tailored to the specific context of the organization.

• Question 222:

  Alex is an incident handler in QWERTY Company. He identified that an attacker created a backdoor inside the company's network by installing a fake AP inside a firewall. Which of the following attack types did the attacker use?

  A. AP misconfiguration
  B. Wardriving
  C. Rogue access point
  D. Ad hoc associations
  C. Rogue access point

  ---

  When an attacker installs a fake AP (Access Point) within a company's network, especially behind a firewall, this constitutes the deployment of a Rogue Access Point. Rogue APs are unauthorized wireless access points installed within a network without the network administrator's knowledge or consent. They pose a significant security risk because they can be used to intercept sensitive information, bypass network security configurations, and provide a gateway for attackers to enter the network undetected. This type of attack circumvents the security measures put in place by a company, including firewalls, by creating an illicit entry point into the network that is under the control of the attacker.

  References: Incident Handler (ECIH v3) courses and study materials discuss various network-based attacks and their mitigation strategies, emphasizing the importance of regular network scans to detect and remove rogue access points and thus secure the network from unauthorized access.

• Question 223:

  Otis is an incident handler working in an organization called Delmont. Recently, the organization faced several setbacks in business, whereby its revenues are decreasing. Otis was asked to take charge and look into the matter. While auditing the enterprise security, he found traces of an attack through which proprietary information was stolen from the enterprise network and passed onto their competitors. Which of the following information security incidents did Delmont face?

  A. Network and resource abuses
  B. Espionage
  C. Email-based abuse
  D. Unauthorized access
  B. Espionage

  ---

  Espionage, in the context of information security incidents, refers to the unauthorized access and theft of proprietary information for competitive advantage. In the scenario described, where proprietary information was stolen from Delmont's enterprise network and passed onto their competitors, this directly aligns with the definition of espionage. The incident involves deliberate targeting and extraction of sensitive business information, which is then used by competitors to gain a market advantage. Such actions not only compromise the confidentiality of business-critical information but can also significantly impact the financial stability and competitive positioning of the victim organization.

  References: The Certified Incident Handler (ECIH v3) curriculum by EC-Council discusses various information security incidents, including espionage, highlighting the need for comprehensive security measures, incident detection capabilities, and effective response strategies to protect against and respond to such threats.

• Question 224:

  An organization named Sam Morison Inc. decided to use cloud-based services to reduce the cost of maintenance. The organization identified various risks and threats associated with cloud service adoption and migrating business-critical data to thirdparty systems. Hence, the organization decided to deploy cloud-based security tools to prevent upcoming threats. Which of the following tools help the organization to secure the cloud resources and services?

  A. Nmap
  B. Burp Suite
  C. Wireshark
  D. Alert Logic
  D. Alert Logic

  ---

  Alert Logic is a cloud-based security tool that provides Security-as-a-Service solutions including threat management, vulnerability assessment, and improved security outcomes. It is designed specifically to secure cloud resources and services, making it an ideal choice for organizations like Sam Morison Inc. that are moving their operations to the cloud and are concerned about the security of their data. Tools like Nmap, Burp Suite, and Wireshark, while valuable in certain contexts, do not offer the same cloud-focused security capabilities as Alert Logic.

• Question 225:

  Which of the following is not a best practice to eliminate the possibility of insider attacks?

  A. Disable the users from installing unauthorized software or accessing malicious websites using the corporate network
  B. Monitor employee behaviors and the computer systems used by employees
  C. Implement secure backup and disaster recovery processes for business continuity
  D. Always leave business details over voicemail or email broadcast message
  D. Always leave business details over voicemail or email broadcast message

  ---

  Leaving sensitive business details over voicemail or sending them out through email broadcast messages is not a best practice for security. This approach significantly increases the risk of information leakage and unauthorized access to critical business information. Such practices can be exploited by insiders to conduct malicious activities, including data theft, fraud, or sabotage. The best practices for mitigating insider threats involve implementing strict access controls, monitoring and auditing employee actions, securing communications, and ensuring that sensitive information is only shared through secure and authorized channels. Encouraging or allowing the practice of leaving sensitive business details in such insecure manners contradicts the principles of information security and increases the vulnerability to insider attacks.

  References: ECIH v3 courses and study materials stress the importance of implementing strong security policies and practices to mitigate the risk of insider threats. These include controlling access to information, monitoring use of corporate resources, and securing communication channels to ensure that sensitive information is not exposed or mishandled within the organization.

• Question 226:

  Employee monitoring tools are mostly used by employers to find which of the following?

  A. Lost registry keys
  B. Conspiracies
  C. Malicious insider threats
  D. Stolen credentials
  C. Malicious insider threats

  ---

  Employee monitoring tools are primarily used by employers to detect and prevent malicious insider threats. These tools can track activities such as data access, data exfiltration attempts, unauthorized actions, and other behaviors that could indicate malicious intent or pose a risk to the organization's security. While such tools may also incidentally uncover issues like lost registry keys, conspiracies, or stolen credentials, their main purpose is to safeguard against insiders who might misuse their access to harm the organization, steal data, sabotage systems, or engage in espionage.

  References: ECIH v3 study materials cover various security measures and tools that organizations can use to protect against insider threats, emphasizing the role of monitoring in detecting and responding to malicious activities by insiders.

• Question 227:

  Stanley works as an incident responder at a top MNC based in Singapore. He was asked to investigate a cybersecurity incident that recently occurred in the company. While investigating the incident, he collected evidence from the victim systems. He must present this evidence in a clear and comprehensible manner to the members of a jury so that the evidence clarifies the facts and further helps in obtaining an expert opinion on the incident to confirm the investigation process. In the above scenario, which of the following characteristics of the digital evidence did Stanley attempt to preserve?

  A. Completeness
  B. Admissibility
  C. Believability
  D. Authenticity
  B. Admissibility

  ---

  In the scenario described, Stanley's effort to present evidence in a clear and comprehensible manner to the members of a jury, with the intention of clarifying facts and aiding in obtaining expert opinion, aligns with the characteristic of admissibility. The admissibility of digital evidence pertains to its acceptability in a court of law, which hinges on the evidence being collected, handled, and presented in a manner that complies with legal standards and procedures. This includes ensuring the evidence is relevant, reliable, and not overly prejudicial. By preparing to present the evidence in a way that the jury can understand and use to confirm the investigation process, Stanley is focusing on ensuring that the evidence meets the criteria for admissibility in the legal proceedings. Completeness, believability, and authenticity are also important characteristics of digital evidence, but the context provided indicates that Stanley's primary focus is on meeting the legal requirements for the evidence to be considered valid in court.

  References: The Incident Handler (ECIH v3) certification materials cover the legal aspects of incident response, including the importance of ensuring the admissibility of evidence in legal proceedings as a fundamental objective of the evidence collection and presentation process.

• Question 228:

  Marley was asked by his incident handling and response (IHandR) team lead to collect volatile data such as system information and network information present in the registries, cache, and RAM of victim's system. Identify the data acquisition method Marley must employ to collect volatile data.

  A. Validate data acquisition
  B. Static data acquisition
  C. Live data acquisition
  D. Remote data acquisition
  C. Live data acquisition

  ---

  Live data acquisition is the process of collecting volatile data from a system that is still running. Volatile data includes information stored in system memory (RAM), cache, and system and network configuration settings that are lost when the system is powered off. This method is essential for capturing data that can provide insights into the state of the system at the time of an incident, including active network connections, running processes, and the contents of memory. Marley must employ live data acquisition to ensure that this crucial and ephemeral data is not lost, which can be pivotal in understanding and responding to the incident effectively.

  References: The concept of live data acquisition is discussed in the ECIH v3 certification program by EC- Council, which emphasizes its importance in the context of incident handling and response for capturing volatile information that could be critical to the investigation.

• Question 229:

  The product of intellect that has commercial value and includes copyrights and trademarks is called:

  A. Intellectual property
  B. Trade secrets
  C. Logos
  D. Patents
  A. Intellectual property

  ---

  Explanation

• Question 230:

  Performing Vulnerability Assessment is an example of a:

  A. Incident Response
  B. Incident Handling
  C. Pre-Incident Preparation
  D. Post Incident Management
  C. Pre-Incident Preparation

  ---

  Explanation