EC-COUNCIL 212-89 Online Practice Questions and Exam Preparation

EC-COUNCIL 212-89 Online Questions & Answers

• Question 41:

  Which of the following is a standard framework that provides recommendations for implementing information security controls for organizations that initiate, implement, or maintain information security management systems (ISMSs)?

  A. ISO/IEC 27002
  B. ISO/IEC 27035
  C. PCI DSS
  D. RFC 219G
  A. ISO/IEC 27002

  ---

  ISO/IEC 27002 is a standard that provides best practice recommendations on information security controls for use by those responsible for initiating, implementing, or maintaining information security management systems (ISMSs). It covers areas such as risk assessment, human resource security, operational security, and communications security, among others, providing a framework for establishing, implementing, operating, monitoring, reviewing, maintaining, and improving an ISMS. ISO/IEC 27035 pertains to information security incident management, PCI DSS (Payment Card Industry Data Security Standard) deals with the security of cardholder data, and RFC 2196 is a guide for computer security incident response teams (CSIRTs), not a standard for implementing ISMSs.

  References: The ECIH v3 curriculum includes the study of various standards and frameworks that support information security management and governance, including ISO/IEC 27002, highlighting its role in guiding organizations in implementing effective security controls.

• Question 42:

  Bran is an incident handler who is assessing the network of the organization. He wants to detect ping sweep attempts on the network using Wireshark. Which of the following Wireshark filters would Bran use to accomplish this task?

  A. icmp.scq
  B. icmp.lype==8
  C. icmp.ident
  D. icmp.redir_gw
  B. icmp.lype==8

  ---

  In the context of using Wireshark, a popular network protocol analyzer, to detect ping sweep attempts on a network, the filter icmp.type==8 is used. ICMP (Internet Control Message Protocol) is utilized for sending error messages and operational information indicating, for example, that a requested service is not available or that a host or router could not be reached. ICMP type 8 messages are echo requests, which are used by the ping command to test the reachability of a host on an IP network. A ping sweep consists of ICMP echo requests sent to multiple hosts to find which ones are alive. By applying the icmp.type==8 filter in Wireshark, Bran can isolate and examine the echo request messages, helping to identify ping sweep attempts, which are characterized by a high volume of ICMP echo requests over a broad range of IP addresses in a short period.

  References: The ECIH v3 program by EC-Council covers network monitoring and analysis techniques, including the use of Wireshark and its filters to detect various types of network scanning activities, such as ping sweeps.

• Question 43:

  Eric is an incident responder and is working on developing incident-handling plans and procedures. As part of this process, he is performing an analysis on the organizational network to generate a report and develop policies based on the acquired results. Which of the following tools will help him in analyzing his network and the related traffic?

  A. Whois
  B. Burp Suite
  C. FaceNiff
  D. Wireshark
  D. Wireshark

  ---

  Wireshark is a widely used network protocol analyzer that helps in capturing and interactively browsing the traffic on a network. It is an essential tool for incident responders like Eric who are developing incident- handling plans and procedures. By analyzing network traffic, Wireshark allows users to see what is happening on their network at a microscopic level, making it invaluable for troubleshooting network problems, analyzing security incidents, and understanding network behavior. Whois is used for querying databases that store registered users or assignees of an Internet resource. Burp Suite is a tool for testing web application security, and FaceNiff is used for session hijacking within a WiFi network, which makes Wireshark the best choice for analyzing network traffic.

  References: ECIH v3 certification materials often reference Wireshark as a fundamental tool for network analysis, crucial for incident handlers in the analysis phase of incident response.

• Question 44:

  During incident containment, which action is MOST appropriate to prevent lateral movement without destroying forensic evidence?

  A. Wiping affected systems
  B. Disconnecting systems from the network
  C. Reimaging the disk immediately
  D. Restoring backups
  B. Disconnecting systems from the network

  ---

  Disconnecting affected systems from the network prevents further spread and lateral movement while preserving the system state for forensic analysis. Immediate wiping or reimaging may destroy valuable evidence.

• Question 45:

  The type of relationship between CSIRT and its constituency have an impact on the services provided by the CSIRT. Identify the level of the authority that enables members of CSIRT to undertake any necessary actions on behalf of their constituency?

  A. Full-level authority
  B. Mid-level authority
  C. Half-level authority
  D. Shared-level authority
  A. Full-level authority

  ---

  Explanation

• Question 46:

  In which of the following types of fuzz testing strategies the new data will be generated from scratch and the amount of data to be generated are predefined based on the testing model?

  A. Log-based fuzz testing
  B. Generation-based fuzz testing
  C. Mutation-based fuzz testing
  D. Protocol-based fuzz testing
  A. Log-based fuzz testing

  ---

  Generation-based fuzz testing is a strategy where new test data is generated from scratch based on a predefined model that specifies the structure, type, and format of the input data. This approach is systematic and relies on a deep understanding of the format and protocol of the input data to create test cases that are both valid and potentially revealing of vulnerabilities. This contrasts with mutation-based fuzz testing, where existing data samples are modified (mutated) to produce new test cases, and log-based and protocol-based fuzz testing, which use different approaches to test software robustness and security.

  References: ECIH v3 certification materials often cover software testing techniques, including fuzz testing, to identify vulnerabilities in applications by inputting unexpected or random data.

• Question 47:

  Eric who is an incident responder is working on developing incident-handling plans and procedures. As part of this process, he is performing analysis on the organizational network to generate a report and to develop policies based on the acquired results. Which of the following tools will help him in analyzing network and its related traffic?

  A. FaceNiff
  B. Wireshark
  C. Burp Suite
  D. Whois
  B. Wireshark

  ---

  Wireshark is a network protocol analyzer that allows users to capture and interactively browse the traffic running on a computer network. It is a crucial tool for incident responders like Eric who are developing incident-handling plans and need to analyze network traffic and patterns. Wireshark can provide detailed information about the network, including protocols used, source and destination of packets, and potential signs of malicious activity, making it invaluable for developing informed policies and procedures.

• Question 48:

  Attackers or insiders create a backdoor into a trusted network by installing an unsecured access point inside a firewall. They then use any software or hardware access point to perform an attack. Which of the following is this type of attack?

  A. Rogue- access point attack
  B. Password-based attack
  C. Malware attack
  D. Email infection
  A. Rogue- access point attack

  ---

  A rogue-access point attack occurs when attackers or insiders install an unsecured access point within a trusted network, typically behind a firewall, to create a backdoor. This allows them to bypass network security measures and perform various malicious activities undetected. The use of any software or hardware access point to gain unauthorized access and conduct an attack characterizes a rogue-access point attack. This contrasts with password-based attacks, malware attacks, and email infections, which involve different methodologies and objectives, such as stealing credentials, distributing malicious software, or propagating through email systems, respectively.

  References: The ECIH v3 certification materials discuss various types of network attacks, including rogue- access point attacks, highlighting the risk they pose by providing unauthorized network access to attackers.

• Question 49:

  What is the most recent NIST standard for incident response?

  A. 800-61r2
  B. 800-61r3
  C. 800-53r3
  D. 800-171r2
  A. 800-61r2

  ---

  As of my last update, the most recent NIST standard for incident response was NIST Special Publication 800- 61 Revision 2 (800-61r2), titled "Computer Security Incident Handling Guide." This document provides guidelines for establishing an effective incident response program, including preparation, detection and analysis, containment, eradication, recovery, and post-incident activity.

  References: The document is a key resource in the field of incident response, frequently cited in the ECIH v3 curriculum for its comprehensive guidelines on managing and responding to cybersecurity incidents.

• Question 50:

  Oscar receives an email from an unknown source containing his domain name oscar.com. Upon checking the link, he found that it contains a malicious URL that redirects to the website evilsite.org. What type of vulnerability is this?

  A. Malware
  B. Bolen
  C. Unvalidated redirects and forwards
  D. SQL injection
  C. Unvalidated redirects and forwards

  ---

  The scenario described, where Oscar receives an email with a link that contains a malicious URL redirecting to evilsite.org, exemplifies a vulnerability related to unvalidated redirects and forwards. This type of vulnerability occurs when a web application accepts untrusted input that could cause the web application to redirect the request to a URL contained within untrusted input. Attackers can exploit this vulnerability by crafting a malicious URL that leads unsuspecting users to phishing sites or other malicious websites, under the guise of a legitimate domain. This is distinct from malware, which refers to malicious software; SQL injection, which involves inserting malicious SQL queries through input fields to manipulate or exploit databases; and is not a term related to cybersecurity vulnerabilities.

  References: The Incident Handler (ECIH v3) certification materials often cover web application vulnerabilities, including unvalidated redirects and forwards, emphasizing the need for proper validation and sanitization of user input to prevent such exploits.