EC-COUNCIL 212-89 Online Practice Questions and Exam Preparation

EC-COUNCIL 212-89 Online Questions & Answers

• Question 51:

  Which of the following incidents are reported under CAT -5 federal agency category?

  A. Exercise/ Network Defense Testing
  B. Malicious code
  C. Scans/ probes/ Attempted Access
  D. Denial of Service DoS
  C. Scans/ probes/ Attempted Access

  ---

  Explanation

• Question 52:

  A malicious security-breaking code that is disguised as any useful program that installs an executable programs when a file is opened and allows others to control the victim's system is called:

  A. Trojan
  B. Worm
  C. Virus
  D. RootKit
  A. Trojan

  ---

  Explanation

• Question 53:

  Your company holds a large amount of customer PH. and you want to protect those data from theft or unauthorized modification. Among other actions, you classify and encrypt the data. In this process, which of the following OWASP security risks are you guarding against?

  A. Insecure deserialization
  B. Security misconfiguration
  C. Broken authentication
  D. Sensitive data exposure
  D. Sensitive data exposure

  ---

  By classifying and encrypting customer Personally Identifiable Information (PHI), you are specifically guarding against the risk of Sensitive Data Exposure. This OWASP security risk involves the accidental or unlawful exposure of protected data to unauthorized individuals. Encryption serves as a critical defense mechanism by ensuring that, even if data is accessed without authorization, it remains unintelligible and useless to the attacker without the decryption keys. Data classification further supports this by identifying which data is sensitive and requires such protections, ensuring that appropriate security controls are applied to prevent exposure.

  References: OWASP Top 10, a widely respected document that outlines the most critical web application security risks, identifies Sensitive Data Exposure as a key risk area. Incident Handler (ECIH v3) courses and study guides often refer to the OWASP Top 10 to explain common web security risks and appropriate countermeasures, including the importance of encrypting sensitive data.

• Question 54:

  The network perimeter should be configured in such a way that it denies all incoming and outgoing traffic/ services that are not required. Which service listed below, if blocked, can help in preventing Denial of Service attack?

  A. SAM service
  B. POP3 service
  C. SMTP service
  D. Echo service
  D. Echo service

  ---

  Explanation

• Question 55:

  You are talking to a colleague who Is deciding what information they should include in their organization's logs to help with security auditing. Which of the following items should you tell them to NOT log?

  A. Timestamp
  B. Session ID
  C. Source IP eddross
  D. userid
  B. Session ID

  ---

  Logging User IDs (D) can pose privacy concerns and may conflict with regulations such as the General Data Protection Regulation (GDPR), which emphasizes the protection of personal data and privacy. Therefore, while logging details such as Timestamps, Session IDs, and Source IP addresses are essential for security auditing to track when events occur, who is initiating sessions, and from where, care must be taken with User IDs. The handling of personally identifiable information (PII) must comply with privacy laws and organizational policies to safeguard individual privacy rights.

  References: Security best practices and compliance frameworks discussed in the ECIH v3 certification guide incident handlers on what information should and should not be logged, emphasizing the need to balance security auditing requirements with privacy and regulatory obligations.

• Question 56:

  Which of the following encoding techniques replaces unusual ASCII characters with "%" followed by the character's two-digit ASCII code expressed in hexadecimal?

  A. URL encoding
  B. Unicode encoding
  C. Base64 encoding
  D. HTML encoding
  A. URL encoding

  ---

  URL encoding, also known as percent-encoding, is a mechanism for encoding information in a Uniform Resource Identifier (URI) under certain circumstances. This technique involves replacing unsafe ASCII characters with a "%" followed by two hexadecimal digits that represent the character's ASCII code. This is necessary for embedding characters that are not allowed in URLs directly, such as spaces and symbols, or characters that have special meanings within URLs, ensuring that the URL is correctly interpreted by web browsers and servers.

  References: The concept of URL encoding is fundamental to web application security, a topic that is covered in the ECIH v3 program by EC-Council. Understanding encoding techniques is crucial for incident handlers dealing with web-based attacks and investigations.

• Question 57:

  An audit trail policy collects all audit trails such as series of records of computer events, about an operating system, application or user activities. Which of the following statements is NOT true for an audit trail policy:

  A. It helps calculating intangible losses to the organization due to incident
  B. It helps tracking individual actions and allows users to be personally accountable for their actions
  C. It helps in compliance to various regulatory laws, rules,and guidelines
  D. It helps in reconstructing the events after a problem has occurred
  A. It helps calculating intangible losses to the organization due to incident

  ---

  Explanation

• Question 58:

  QualTech Solutions is a leading security services enterprise. Dickson, who works as an incident responder with this firm, is performing a vulnerability assessment to identify the security problems in the network by using automated tools for identifying the hosts, services, and vulnerabilities in the enterprise network. In the above scenario, which of the following types of vulnerability assessment is Dickson performing?

  A. Active assessment
  B. External assessment
  C. Internal assessment
  D. Passive assessment
  A. Active assessment

  ---

  In the scenario described, Dickson is performing an active assessment. This type of vulnerability assessment involves using automated tools to actively scan and probe the network for identifying hosts, services, and vulnerabilities. Unlike passive assessments, which rely on monitoring network traffic without direct interaction with the targets, active assessments engage directly with the network infrastructure to discover vulnerabilities, misconfigurations, and other security issues by sending data to systems and analyzing the responses. This approach provides a more immediate and detailed view of the security posture but can also generate detectable traffic that might be noticed by defensive systems or affect the performance of live systems.

  References: The ECIH v3 curriculum by EC-Council includes discussions on various methods of conducting vulnerability assessments, highlighting the differences between active and passive techniques, as well as the contexts in which each is most appropriately used.

• Question 59:

  The following steps describe the key activities in forensic readiness planning:

  1. Train the staff to handle the incident and preserve the evidence

  2. Create a special process for documenting the procedure

  3. Identify the potential evidence required for an incident

  4. Determine the source of the evidence

  5. Establish a legal advisory board to guide the investigation process

  6. Identify if the incident requires full or formal investigation

  7. Establish a policy for securely handling and storing the collected evidence

  8. Define a policy that determines the pathway to legally extract electronic evidence with minimal disruption Identify the correct sequence of steps involved in forensic readiness planning.

  A. 2-->3-->1-->4-->6-->5-->7-->8
  B. 3-->4-->8-->7-->6-->1-->2-->5
  C. 3-->1-->4-->5-->8-->2-->6-->7
  D. 1-->2-->3-->4-->5-->6-->7-->8
  B. 3-->4-->8-->7-->6-->1-->2-->5

  ---

  The correct sequence of steps involved in forensic readiness planning, based on the activities described, is as follows:

  Identify the potential evidence required for an incident.

  Determine the source of the evidence.

  Define a policy that determines the pathway to legally extract electronic evidence with minimal disruption.

  Establish a policy for securely handling and storing the collected evidence.

  Identify if the incident requires full or formal investigation.

  Train the staff to handle the incident and preserve the evidence.

  Create a special process for documenting the procedure.

  References: Incident Handler (ECIH v3) courses and study guides include discussions on forensic readiness planning, highlighting the importance of preparing organizations for effective legal and technical handling of incidents.

• Question 60:

  The flow chart gives a view of different roles played by the different personnel of CSIRT. Identify the incident response personnel denoted by A, B, C, D, E, F and G.

  

  A. A-Incident Analyst, B- Incident Coordinator, C- Public Relations, D-Administrator, E- Human Resource, F-Constituency, G-Incident Manager
  B. A- Incident Coordinator, B-Incident Analyst, C- Public Relations, D-Administrator, E- Human Resource, F-Constituency, G-Incident Manager
  C. A- Incident Coordinator, B- Constituency, C-Administrator, D-Incident Manager, E- Human Resource, F-Incident Analyst, G-Public relations
  D. A- Incident Manager, B-Incident Analyst, C- Public Relations, D-Administrator, E- Human Resource, F- Constituency, G-Incident Coordinator
  C. A- Incident Coordinator, B- Constituency, C-Administrator, D-Incident Manager, E- Human Resource, F-Incident Analyst, G-Public relations

  ---

  Explanation