EC-COUNCIL 212-89 Online Practice Questions and Exam Preparation

EC-COUNCIL 212-89 Online Questions & Answers

• Question 61:

  Finn is working in the eradication phase, wherein he is eliminating the root cause of an incident that occurred in the Windows operating system installed in a system. He ran a tool that can detect missing security patches and install the latest patches on the system and networks. Which of the following tools did he use to detect the missing security patches?

  A. Microsoft Cloud App Security
  B. Offico360 Advanced Throat Protection
  C. Microsoft Advanced Threat Analytics
  D. Microsoft Baseline Security Analyzer
  D. Microsoft Baseline Security Analyzer

  ---

  The Microsoft Baseline Security Analyzer (MBSA) is a tool designed to assess a computer or network's security state by checking for missing security updates and common security misconfigurations. In the scenario with Finn, who is working in the eradication phase of an incident response process, the use of MBSA makes sense. The tool's ability to detect missing security patches and recommend the installation of the latest patches is crucial for eliminating vulnerabilities in the Windows operating system

  that could be the root cause of the incident.

  MBSA scans the system for missing security updates, misconfigurations, and other vulnerabilities and provides detailed reports and recommendations for remediation. This step is vital in the eradication phase, where the goal is to remove the root causes of the incident and secure the system against future attacks. By ensuring that all necessary patches are applied, Finn is addressing any security gaps that could be exploited by attackers.

  References: EC-Council's ECIH v3 program discusses various tools and techniques for securing systems and networks, including the importance of patch management and the use of tools like the Microsoft Baseline Security Analyzer for identifying and applying necessary security updates as part of the incident response process.

• Question 62:

  The state of incident response preparedness that enables an organization to maximize its potential to use digital evidence while minimizing the cost of an investigation is called:

  A. Computer Forensics
  B. Digital Forensic Analysis
  C. Forensic Readiness
  D. Digital Forensic Policy
  C. Forensic Readiness

  ---

  Explanation

• Question 63:

  An incident handler is analyzing email headers to find out suspicious emails. Which of the following tools he/she must use in order to accomplish the task?

  A. Barracuda Email Security Gateway
  B. Gophish
  C. SPAMfighter
  A. Barracuda Email Security Gateway

  ---

  The Barracuda Email Security Gateway is designed to manage and filter inbound and outbound email traffic to protect organizations from email-borne threats and data leaks. As an incident handler analyzing email headers to find out suspicious emails, using a tool like the Barracuda Email Security Gateway would be appropriate. This tool can help identify and block spam, phishing, malware, and other malicious email threats, making it easier to focus on analyzing potentially harmful emails more closely.

• Question 64:

  An organization performs a post-incident review to document lessons learned and improve future response capabilities. Which phase of incident handling does this activity belong to?

  A. Recovery
  B. Eradication
  C. Post-incident activity
  D. Detection
  C. Post-incident activity

  ---

  Post-incident activity focuses on reviewing the incident, documenting lessons learned, updating procedures, and improving controls to reduce the likelihood and impact of future incidents.

• Question 65:

  John is a professional hacker who is performing an attack on the target organization where he tries to redirect the connection between the IP address and its target server such that when the users type in the Internet address, it redirects them to a rogue website that resembles the original website. He tries this attack using cache poisoning technique. Identify the type of attack John is performing on the target organization.

  A. War driving
  B. Pharming
  C. Skimming
  D. Pretexting
  B. Pharming

  ---

  Pharming is a cyber attack intended to redirect a website's traffic to another, bogus website. By poisoning a DNS server's cache, attackers can redirect users from the site they intended to visit to one that is malicious, without the user's knowledge or any action on their part, such as clicking a deceptive link. This technique is particularly insidious because it can affect well-intentioned users who type the correct URL into their browsers but are still redirected. War driving involves searching for wireless networks from a moving vehicle, skimming refers to stealing credit card information using a device placed on ATMs or point-of-sale terminals, and pretexting is a form of social engineering where the attacker lies to obtain privileged data.

  References: The Incident Handler (ECIH v3) certification program covers a variety of cyber attacks and techniques, including DNS poisoning and pharming, explaining how attackers exploit vulnerabilities to redirect users to fraudulent sites.

• Question 66:

  Jacob is an employee at a firm called Dolphin Investment. While he was on duty, he identified that his computer was facing some problems, and he wanted to convey the issue to the concerned authority in his organization. However, this organization currently does not have a ticketing system to address such types of issues. In the above scenario, which of the following ticketing systems can be employed by Dolphin Investment to allow Jacob to inform the concerned team about the incident?

  A. IBM XForco Exchange
  B. ThreatConnect
  C. MISP
  D. ManageEngine ServiceDesk Plus
  D. ManageEngine ServiceDesk Plus

  ---

  In the scenario where Dolphin Investment needs to implement a ticketing system for employees like Jacob to report IT-related issues, ManageEngine ServiceDesk Plus is the most suitable option among the choices provided. ManageEngine ServiceDesk Plus is a comprehensive IT help desk software that facilitates issue tracking, incident management, and efficient resolution of IT-related problems and requests. It enables users to submit tickets through various channels, including email, web portal, phone, or chat, and allows IT support teams to manage these tickets through a centralized platform. This system is designed to streamline the process of reporting, tracking, and resolving IT issues and incidents, making it an ideal solution for organizations looking to establish a formalized incident reporting and resolution process. Other options like IBM X-Force Exchange, ThreatConnect, and MISP focus more on threat intelligence sharing and security incident analysis rather than functioning as an IT help desk or ticketing system.

  References: Incident Handler (ECIH v3) courses and study guides often discuss the importance of having an effective incident reporting and management system in place, and ManageEngine ServiceDesk Plus is frequently cited as a practical solution for organizations seeking to implement such a system.

• Question 67:

  Johnson an incident handler is working on a recent web application attack faced by the organization. As part of this process, he performed data preprocessing in order to analyzing and detecting the watering hole attack. He preprocessed the outbound network traffic data collected from firewalls and proxy servers and started analyzing the user activities within a certain time period to create time-ordered domain sequences to perform further analysis on sequential patterns. Identify the data-preprocessing step performed by Johnson.

  A. Filtering invalid host names
  B. Identifying unpopular domains
  C. Host name normalization
  D. User-specific sessionization
  D. User-specific sessionization

  ---

  The data preprocessing step performed by Johnson, where he analyzes user activities within a certain time period to create time-ordered domain sequences for further analysis on sequential patterns, is known as user- specific sessionization. This process involves aggregating all user activities and requests into discrete sessions based on the individual user, allowing for a coherent analysis of user behavior over time. This is critical for identifying patterns that may indicate a watering hole attack, where attackers compromise a site frequently visited by the target group to distribute malware. User-specific sessionization helps in isolating and examining sequences of actions taken by users, making it easier to detect anomalies or patterns indicative of such an attack.

  References: The ECIH v3 certification materials discuss various data preprocessing techniques used in the analysis of cyber attacks, including the concept of sessionization to better understand user behavior and detect threats.

• Question 68:

  Robert is an incident handler working for Xsecurity Inc. One day, his organization faced a massive cyberattack and all the websites related to the organization went offline. Robert was on duty during the incident and he was responsible to handle the incident and maintain business continuity. He immediately restored the web application service with the help of the existing backups. According to the scenario, which of the following stages of incident handling and response (IHandR) process does Robert performed?

  A. Evidence gathering and forensics analysis
  B. Eradication
  C. Notification
  D. Recovery
  D. Recovery

  ---

  Restoring web application services with the help of existing backups, as performed by Robert, falls under the Recovery stage of the Incident Handling and Response (IHandR) process. The Recovery stage involves actions taken to return the organization to normal operations after an incident, which includes restoring systems to their operational state using backups, patching vulnerabilities, and ensuring that all systems are clean and secure before being brought back online. This step is crucial for resuming business operations and mitigating the impact of the incident.

• Question 69:

  Nervous Nat often sends emails with screenshots of what he thinks are serious incidents, but they always turn out to be false positives. Today, he sends another screenshot, suspecting a nation-state attack. As usual, you go through your list of questions, check your resources for information to determine whether the screenshot shows a real attack, and determine the condition of your network. Which step of IR did you just perform?

  A. Recovery
  B. Preparation
  C. Remediation
  D. Detection anc analysis (or identification)
  D. Detection anc analysis (or identification)

  ---

  When you receive a screenshot from Nervous Nat and go through a list of questions, check resources for information to determine the nature of the screenshot, and assess the condition of your network, you are engaging in the Detection and Analysis (or Identification) phase of Incident Response (IR). This phase is about identifying potential security incidents based on reported concerns, anomalies detected by security tools, or through the analysis of security alerts. In this scenario, despite the historical context of false positives, each report is treated seriously, requiring you to collect and analyze information to determine whether a real attack is happening. This involves verifying the validity of the incident, assessing its nature, scope, and impact, and deciding on the appropriate next steps. The detection and analysis phase is critical for determining the course of the IR process, including whether escalation is needed and what response measures should be initiated.

  References: The ECIH v3 certification materials outline the Incident Response process, detailing steps from preparation, detection and analysis, containment, eradication, and recovery, to post-incident activities, highlighting the importance of thorough detection and analysis as the foundation for effective incident management.

• Question 70:

  What command does a Digital Forensic Examiner use to display the list of all IP addresses and their associated MAC addresses on a victim computer to identify the machines that were communicating with it:

  A. "arp" command
  B. "netstat n" command
  C. "dd" command
  D. "ifconfig" command
  A. "arp" command

  ---

  Explanation