EC-COUNCIL 212-89 Online Practice Questions and Exam Preparation

EC-COUNCIL 212-89 Online Questions & Answers

• Question 31:

  A self-replicating malicious code that does not alter files but resides in active memory and duplicates itself, spreads through the infected network automatically and takes advantage of file or information transport features on the system to travel independently is called:

  A. Trojan
  B. Worm
  C. Virus
  D. RootKit
  B. Worm

  ---

  Explanation

• Question 32:

  An incident is analyzed for its nature, intensity and its effects on the network and systems. Which stage of the incident response and handling process involves auditing the system and network log files?

  A. Incident recording
  B. Reporting
  C. Containment
  D. Identification
  D. Identification

  ---

  Explanation

• Question 33:

  Which principle ensures that digital evidence can be traced from collection through presentation without unauthorized alteration?

  A. Confidentiality
  B. Availability
  C. Chain of custody
  D. Non-repudiation
  C. Chain of custody

  ---

  Chain of custody documents the handling and transfer of evidence throughout the investigation lifecycle, ensuring accountability and preventing tampering or unauthorized modification.

• Question 34:

  Ikeo Corp, hired an incident response team to assess the enterprise security. As part of the incident handling and response process, the IR team is reviewing the current security policies implemented by the enterprise. The IR team finds that employees of the organization do not have any restrictions on Internet access: they are allowed to visit any site, download any application, and access a computer or network from a remote location. Considering this as the main security threat, the IR team plans to change this policy as it can be easily exploited by attackers. Which of the following security policies is the IR team planning to modify?

  A. Paranoid policy
  B. Prudent policy
  C. Promiscuous policy
  D. Permissive policy
  A. Paranoid policy

  ---

  A permissive security policy is one that allows employees broad freedoms in terms of internet access, application downloads, and remote access capabilities. In the scenario described, the incident response team identifies that the lack of restrictions is a significant security threat that could be exploited by attackers, indicating that the current policy is permissive. Modifying this policy would involve implementing more stringent controls on what sites can be visited, what applications can be downloaded, and how remote access is granted, moving towards a more controlled and secure environment. This approach contrasts with paranoic, prudent, and promiscuous policies, each of which has its own characteristics and applications in cybersecurity frameworks.

  References: The ECIH v3 certification materials often discuss security policies within the context of organizational security posture, emphasizing how varying degrees of restrictiveness impact security and risk.

• Question 35:

  Eve's is an incident handler in ABC organization. One day, she got a complaint about email hacking incident from one of the employees of the organization. As a part of incident handling and response process, she must follow many recovery steps in order to recover from incident impact to maintain business continuity. What is the first step that she must do to secure employee account?

  A. Restore the email services and change the password
  B. Enable two-factor authentication
  C. Enable scanning of links and attachments in all the emails
  D. Disabling automatic file sharing between the systems
  A. Restore the email services and change the password

  ---

  The first step in securing an employee's account following an email hacking incident involves restoring access to the email services if necessary and immediately changing the password to prevent unauthorized access. This action ensures that the attacker is locked out of the account as quickly as possible. While enabling two- factor authentication, scanning links and attachments, and disabling automatic file sharing are important security measures, they come into play after ensuring that the compromised account is first secured by changing its password to halt any ongoing unauthorized access.

  References: The ECIH v3 certification materials cover the initial steps to be taken when responding to incidents involving compromised accounts, emphasizing the importance of quickly changing passwords to secure the accounts against further unauthorized access.

• Question 36:

  Dash wants to perform a DoS attack over 256 target URLs simultaneously. Which of the following tools can Dash employ to achieve his objective?

  A. HOIC
  B. IDAPro
  C. Ollydbg
  D. OpenVAS
  A. HOIC

  ---

  High Orbit Ion Cannon (HOIC) is a tool designed to perform stress testing on networks or servers. It can launch a Distributed Denial of Service (DDoS) attack by enabling an attacker to overwhelm a target with HTTP POST and GET requests. HOIC's distinctive feature is its ability to attack multiple targets (up to 256 URLs simultaneously) with configurable HTTP flood attacks. This capability makes it a preferred choice for attackers aiming to disrupt services on a large scale. Unlike tools designed for debugging or vulnerability scanning (e.g., IDA Pro, Ollydbg, OpenVAS), HOIC is specifically crafted for launching DoS/DDoS attacks, making it the correct answer for Dash's objective.

  References: The Incident Handler (ECIH v3) courses and study guides delve into various cyber attack tools, including HOIC, explaining their functionalities and potential impact as part of the comprehensive cybersecurity threat landscape education.

• Question 37:

  Racheal is an incident handler working in InceptionTech organization. Recently, numerous employees are complaining about receiving emails from unknown senders. In order to prevent employees against spoofing emails and keeping security in mind, Racheal was asked to take appropriate actions in this matter. As a part of her assignment, she needs to analyze the email headers to check the authenticity of received emails. Which of the following protocol/authentication standards she must check in email header to analyze the email authenticity?

  A. DKIM
  B. SNMP
  C. POP
  D. ARP
  A. DKIM

  ---

  Racheal should check for DKIM (DomainKeys Identified Mail) in the email headers to analyze the authenticity of received emails. DKIM is an email authentication method designed to detect email spoofing. It provides a way for the receiver to check that an email claimed to have come from a specific domain was indeed authorized by the owner of that domain. It achieves this by affixing a digital signature, linked to a domain name, to each outgoing email message. The recipient can verify this signature to confirm that the email was not altered during its transmission and that it indeed comes from the specified domain, thereby helping to prevent email spoofing. Other options like SNMP (Simple Network Management Protocol), POP (Post Office Protocol), and ARP (Address Resolution Protocol) are not directly related to email authenticity checks.

  References: Incident Handler (ECIH v3) certification materials cover various protocols and standards for ensuring the security and authenticity of communications, including email security protocols like DKIM.

• Question 38:

  Richard is analyzing a corporate network. After an alert in the network's IPS. he identified that all the servers are sending huge amounts of traffic to the website abc.xyz. What type of information security attack vectors have affected the network?

  A. Botnet
  B. Advance persistent three Is
  C. Ransomware
  D. IOT threats
  A. Botnet

  ---

  When a corporate network's servers are sending huge amounts of traffic to a specific website, as detected by the network's Intrusion Prevention System (IPS), this behavior is indicative of a Botnet attack. A Botnet is a network of compromised computers, often referred to as "bots," that are controlled remotely by an attacker, typically without the knowledge of the owners of the computers. The attacker can command these bots to execute distributed denial-of-service (DDoS) attacks, send spam, or conduct other malicious activities. In this scenario, the servers behaving as bots and targeting a website with large volumes of traffic suggests that they have been co-opted into a Botnet to potentially perform a DDoS attack on the website abc.xyz.

  References: Incident Handler (ECIH v3) courses and study guides discuss various types of cyber threats and attack vectors, including Botnets and their role in distributed cyber attacks.

• Question 39:

  The main feature offered by PGP Desktop Email is:

  A. Email service during incidents
  B. End-to-end email communications
  C. End-to-end secure email service
  D. None of the above
  C. End-to-end secure email service

  ---

  Explanation

• Question 40:

  Which of the following is a technique used by attackers to make a message difficult to understand through the use of ambiguous language?

  A. Steganography
  B. Spoofing
  C. Encryption
  D. Obfuscation
  D. Obfuscation

  ---

  Obfuscation is a technique used to make data or code difficult to understand. It is often employed by attackers to conceal the true intent of their code or communications, making it harder for security professionals, automated tools, and others to analyze or detect malicious activity. Obfuscation can involve the use of ambiguous or misleading language, as well as more technical methods such as encoding, encryption, or the use of nonsensical variable names in source code to hide its true functionality.

  References: The ECIH v3 program discusses various techniques attackers use to evade detection, including obfuscation, highlighting how it complicates the analysis and understanding of malicious payloads.