EC-COUNCIL 212-89 Online Practice Questions and Exam Preparation

EC-COUNCIL 212-89 Online Questions & Answers

• Question 21:

  In which of the following stages of the incident handling and response (IHandR) process do the incident handlers try to find the root cause of the incident along with the threat actors behind the incidents, threat vectors, etc.?

  A. Evidence gathering and forensics analysis
  B. Incident triage
  C. Incident recording and assignment
  D. Post-incident activities
  A. Evidence gathering and forensics analysis

  ---

  Explanation

• Question 22:

  John, a professional hacker, is attacking an organization, where he is trying to destroy the connectivity between an AP and client to make the target unavailable to other wireless devices. Which of the following attacks is John performing in this case?

  A. Routing attack
  B. EAP failure
  C. Disassociation attack
  D. Denial-of-service
  C. Disassociation attack

  ---

  In a disassociation attack, the attacker sends disassociation frames to a wireless access point (AP) using a spoofed MAC address of a client or to the client pretending to be the AP. This forces the target to disconnect and often reconnect, causing a disruption in the wireless connectivity. Such attacks can be used to create a denial-of-service condition for the client, making the network resource unavailable. The primary objective of this attack is not to eavesdrop but to disrupt the normal operation of the wireless connection between the client and the AP.

  References: The concept of disassociation attacks and their impact on wireless network connectivity is covered in cybersecurity training materials and incident response courses, including those related to the ECIH v3 certification. These materials explain the techniques used in various network attacks, including how disassociation attacks are performed and mitigated.

• Question 23:

  An information security incident is

  A. Any real or suspected adverse event in relation to the security of computer systems or networks
  B. Any event that disrupts normal today's business functions
  C. Any event that breaches the availability of information assets
  D. All of the above
  D. All of the above

  ---

  Explanation

• Question 24:

  Which attack technique involves sending fragmented packets to bypass intrusion detection systems?

  A. Replay attack
  B. Packet fragmentation attack
  C. DNS poisoning
  D. Smurf attack
  B. Packet fragmentation attack

  ---

  Packet fragmentation attacks split malicious payloads into smaller fragments to evade detection by security devices that fail to reassemble packets correctly before inspection.

• Question 25:

  Joseph is an incident handling and response (IHandR) team lead in Toro Network Solutions Company. As a part of IHandR process, Joseph alerted the service providers, developers, and manufacturers about the affected resources. Identify the stage of IHandR process Joseph is currently in.

  A. Eradication
  B. Containment
  C. Incident triage
  D. Recovery
  B. Containment

  ---

  When Joseph, the IHandR team lead, alerted service providers, developers, and manufacturers about the affected resources, he was engaged in the Containment stage of the Incident Handling and Response (IHandR) process. Containment involves taking steps to limit the spread or impact of an incident and to isolate affected systems to prevent further damage. Alerting relevant stakeholders, including service providers and developers, is part of containment efforts to ensure that the threat does not escalate and that measures are taken to protect unaffected resources. This stage precedes eradication and recovery, focusing on immediate response actions to secure the environment.

  References: The ECIH v3 certification program outlines the IHandR process stages, explaining the roles and actions involved in containment, including communication with external and internal stakeholders to manage and mitigate the incident's effects.

• Question 26:

  Removing or eliminating the root cause of the incident is called:

  A. Incident Eradication
  B. Incident Protection
  C. Incident Containment
  D. Incident Classification
  A. Incident Eradication

  ---

  Explanation

• Question 27:

  An attacker tricks users into visiting a legitimate-looking website by manipulating DNS records. What type of attack is this?

  A. Spoofing
  B. Pharming
  C. Phishing
  D. Pretexting
  B. Pharming

  ---

  Pharming redirects users to fraudulent websites by altering DNS records or poisoning caches, even when users enter the correct URL into their browsers.

• Question 28:

  Eric works as a system administrator at ABC organization and previously granted several users with access privileges to the organizations systems with unlimited permissions. These privileged users could prospectively misuse their rights unintentionally, maliciously, or could be deceived by attackers that could trick them to perform malicious activities. Which of the following guidelines would help incident handlers eradicate insider attacks by privileged users?

  A. Do not allow administrators to use unique accounts during the installation process
  B. Do not enable default administrative accounts to ensure accountability
  C. Do not control the access to administrator ano privileged users
  D. Do not use encryption methods to prevent, administrators and privileged users from accessing backup tapes and sensitive information
  B. Do not enable default administrative accounts to ensure accountability

  ---

  Not enabling default administrative accounts is crucial to ensuring accountability and minimizing the risk of insider attacks by privileged users. By disabling or renaming default accounts, organizations can better track the actions performed by individual administrators, reducing the risk of unauthorized or malicious activities going unnoticed. This practice is part of a broader approach to privilege management that includes limiting permissions to the minimum necessary and monitoring the use of administrative privileges.

  References: The ECIH v3 program emphasizes the importance of managing privileged access and ensuring accountability among users with elevated permissions to protect against insider threats and misuse of administrative rights.

• Question 29:

  Which of the following digital evidence temporarily stored on a digital device that requires a constant power supply and is deleted if the power supply is interrupted?

  A. Swap file
  B. Event logs
  C. Slack space
  D. Process memory
  D. Process memory

  ---

  Process memory, or volatile memory (RAM), is digital evidence that requires a constant power supply to retain data and is deleted or lost when the power supply is interrupted. It contains information about the system's ongoing processes and operations. This type of evidence can be crucial for forensic investigations as it may hold information about user actions, system events, and the state of applications and services at the time of an incident. Unlike swap files, event logs, and slack space, which can retain information without a constant power supply, process memory is inherently volatile and its contents are lost when a device is powered off or restarts.

  References: The ECIH v3 certification program includes discussions on digital forensics and the importance of different types of digital evidence, including volatile and non-volatile memory, in the context of incident response and investigation.

• Question 30:

  Which of the following is a common tool used to help detect malicious internal or compromised actors?

  A. User behavior analytics
  B. SOC2 compliance report
  C. Log forward ng
  D. Syslog configuration
  A. User behavior analytics

  ---

  User Behavior Analytics (UBA) is a cybersecurity process or tool that utilizes machine learning, algorithms, and statistical analyses to detect potentially harmful activities within an organization's network by comparing them against established patterns of users' behavior. It is particularly effective in identifying malicious internal actors or compromised users who may be conducting activities that deviate from their normal behavior patterns, such as accessing unauthorized data or systems, excessive file downloads, or unusual login times. UBA tools can flag these activities for further investigation, often before traditional security tools detect a breach. In contrast, SOC2 compliance reports, log forwarding, and syslog configuration are important for maintaining and auditing security standards and for infrastructure monitoring, but they are not primarily focused on detecting malicious behavior based on deviations from established user behavior patterns.

  References: The Incident Handler (ECIH v3) curriculum discusses various tools and methodologies for detecting and responding to security incidents, highlighting User Behavior Analytics as a key tool for identifying insider threats and compromised accounts through behavioral monitoring and analysis.