[Nov-2023] Use Real 212-89 Dumps Free Sample Questions and Practice Test Engine
Pass EC-COUNCIL 212-89 exam - questions - convert Tets Engine to PDF
Breaking down Test Details
The ECIH 212-89 exam is offered at the ECC Exam Center. It is a 3-hour long exam that brings a maximum of 100 items. It should be stated that this test is restricted to learners above 18 years of age. Also, the EC-Council has the mandate to revoke your certificate if you obtain it through unscrupulous means or fail to comply with the exam policies as stated in the official handbook. Finally, scheduling this test costs $450 for all interested candidates.
The ECIH v2 certification is recognized globally, and it validates the candidate's ability to handle security incidents effectively. EC Council Certified Incident Handler (ECIH v2) certification covers various incident handling methodologies, including the NIST SP 800-61 rev2, Computer Emergency Response Team (CERT), and SANS. 212-89 course content also includes practical scenarios that simulate real-world security incidents that the candidate may face in their day-to-day operations.
NEW QUESTION # 105
Which of the following risk mitigation strategies involves the execution of controls to reduce the risk factor and bring it to an acceptable level, or accepts the potential risk and continues operating the IT system?
- A. Risk transference
- B. Risk assumption
- C. Risk planning
- D. Risk avoidance
Answer: B
NEW QUESTION # 106
Which of the following is a common tool used to help detect malicious internal or compromised actors?
- A. Log forwarding
- B. User behavior analytics
- C. Syslog configuration
- D. SOC2 compliance report
Answer: B
NEW QUESTION # 107
Which one of the following is Inappropriate Usage Incidents?
- A. Insider Threat
- B. Denial of Service Attack
- C. Reconnaissance Attack
- D. Access Control Attack
Answer: A
NEW QUESTION # 108
The policy that defines which set of events needs to be logged in order to capture and review the important
data in a timely manner is known as:
- A. Documentation policy
- B. Logging policy
- C. Audit trail policy
- D. Evidence Collection policy
Answer: B
NEW QUESTION # 109
Digital evidence plays a major role in prosecuting cyber criminals. John is a cyber-crime investigator, is asked to investigate a child pornography case. The personal computer of the criminal in question was confiscated by the county police. Which of the following evidence will lead John in his investigation?
- A. SAM file
- B. Routing table list
- C. Web browser history
- D. Web serve log
Answer: C
NEW QUESTION # 110
Identify the malicious program that is masked as a genuine harmless program and gives the attacker unrestricted access to the user's information and system. These programs may unleash dangerous programs that may erase the unsuspecting user's disk and send the victim's credit card numbers and passwords to a stranger.
- A. Virus
- B. Trojan
- C. Cookie tracker
- D. Worm
Answer: B
NEW QUESTION # 111
An organization faced an information security incident where a disgruntled employee passed sensitive access
control information to a competitor. The organization's incident response manager, upon investigation, found
that the incident must be handled within a few hours on the same day to maintain business continuity and
market competitiveness. How would you categorize such information security incident?
- A. Middle level incident
- B. High level incident
- C. Ultra-High level incident
- D. Low level incident
Answer: B
NEW QUESTION # 112
Which of the following is not a best practice to eliminate the possibility of insider attacks?
- A. Monitoring employee behaviors and computer systems used by employees
- B. Implementing secure backup and disaster recovery processes for business continuity
- C. Disabling users from install ng unauthorized software or accessing malicious websites using the corporate network
- D. Always leave business details over voicemail or email messages
Answer: B
NEW QUESTION # 113
Racheal is an incident handler working at an organization called Inception Tech. Recently, numerous employees have been complaining about receiving emails from unknown senders. In order to prevent employees from spoof ng emails and keeping security in mind, Racheal was asked to take appropriate actions in this matter. As a part of her assignment, she needs to analyze the email headers to check the authenticity of received emails.
Which of the following protocol/authentication standards she must check in email header to analyze the email authenticity?
- A. ARP
- B. POP
- C. SNMP
- D. DKIM
Answer: D
NEW QUESTION # 114
Which of the following is a characteristic of adware?
- A. Gathering information
- B. Displaying popups
- C. Intimidating users
- D. Replicating
Answer: B
NEW QUESTION # 115
An organization's customers are experiencing either slower network communication or unavailability of services. In addition, network administrators are receiving alerts from security tools such as IDS/IPS and firewalls about a possible DoS/DDoS attack. In result, the organization requests the incident handling and response (IH&R) team further investigates the incident. The IH&R team decides to use manual techniques to detect DoS/DDoS attack.
Which of the following commands helps the IH&R team to manually detect DoS/DDoS attack?
- A. netstat -an
- B. nbtstat /c
- C. netstat -r
- D. nbtstat /S
Answer: A
NEW QUESTION # 116
Absorbing minor risks while preparing to respond to major ones is called:
- A. Risk Mitigation
- B. Risk Avoidance
- C. Risk Transfer
- D. Risk Assumption
Answer: D
NEW QUESTION # 117
Browser data can be used to access various credentials.
Which of the following tools is used to analyze the history data files in Microsoft Edge browser?
- A. MZ Cache View
- B. MZ History View
- C. Browsing History View
- D. Chrome History View
Answer: C
NEW QUESTION # 118
Which of the following is the ECIH phase that involves removing or eliminating the root cause of an incident and closing all attack vectors to prevent similar incidents in the future?
- A. Eradication
- B. Containment
- C. Vulnerability management phase
- D. Recovery
Answer: A
NEW QUESTION # 119
One of the goals of CSIRT is to manage security problems by taking a certain approach towards the customers' security vulnerabilities and by responding effectively to potential information security incidents. Identify the incident response approach that focuses on developing the infrastructure and security processes before the occurrence or detection of an event or any incident:
- A. Qualitative approach
- B. Proactive approach
- C. Introductive approach
- D. Interactive approach
Answer: B
NEW QUESTION # 120
The flow chart gives a view of different roles played by the different personnel of CSIRT. Identify the incident response personnel denoted by A, B, C, D, E, F and G.
- A. A- Incident Manager, B-Incident Analyst, C- Public Relations, D-Administrator, E- Human Resource, F-Constituency, G-Incident Coordinator
- B. A- Incident Coordinator, B-Incident Analyst, C- Public Relations, D-Administrator, E- Human Resource, F-Constituency, G-Incident Manager
- C. A-Incident Analyst, B- Incident Coordinator, C- Public Relations, D-Administrator, E- Human Resource, F-Constituency, G-Incident Manager
- D. A- Incident Coordinator, B- Constituency, C-Administrator, D-Incident Manager, E- Human Resource, F-Incident Analyst, G-Public relations
Answer: D
NEW QUESTION # 121
US-CERT and Federal civilian agencies use the reporting timeframe criteria in the federal agency reporting categorization. What is the timeframe required to report an incident under the CAT 4 Federal Agency category?
- A. Within two (2) hours of discovery/detection
- B. Monthly
- C. Within four (4) hours of discovery/detection if the successful attack is still ongoing and agency is unable to successfully mitigate activity
- D. Weekly
Answer: D
NEW QUESTION # 122
The insider risk matrix consists of technical literacy and business process knowledge vectors. Considering the matrix, one can conclude that:
- A. If the insider's technical literacy and process knowledge are high, the risk posed by the threat will be high.
- B. If the insider's technical literacy and process knowledge are high, the risk posed by the threat will be insignificant.
- C. If the insider's technical literacy is low and process knowledge is high, the risk posed by the threat will be insignificant.
- D. If the insider's technical literacy is high and process knowledge is low, the risk posed by the threat will be high.
Answer: A
NEW QUESTION # 123
Frederick is in the eradication process in one of the incidents he is handing.
Which of the following is NOT an eradication process?
- A. Analyze the security model of the cloud provider interface.
- B. Conduct vulnerability scanning and configuration audits.
- C. Monitor the client's traffic for any malicious activities.
- D. CCs must train a few of their employees to use the cloud securely.
Answer: D
NEW QUESTION # 124
The Linux command used to make binary copies of computer media and as a disk imaging tool if given a raw disk device as its input is:
- A. "netstat" command
- B. "nslookup" command
- C. "find" command
- D. "dd" command
Answer: D
NEW QUESTION # 125
A payroll system has a vulnerability that cannot be exploited by current technology. Which of the following is correct about this scenario:
- A. The risk must be transferred immediately
- B. The risk is not present at this time
- C. The risk must be urgently mitigated
- D. The risk is accepted
Answer: B
NEW QUESTION # 126
Which of the following terms refers to vulnerable account management functions, including account update, recovery of forgotten or lost passwords, and password reset, that might weaken valid authentication schemes?
- A. Broken account management
- B. SQL injection
- C. Cross-site scripting
- D. Directory traversal
Answer: A
NEW QUESTION # 127
Which of the following is an inappropriate usage incident?
- A. Reconnaissance attack
- B. Denial-of-service attack
- C. Insider threat
- D. Access-control attack
Answer: C
NEW QUESTION # 128
John is performing a memory dump analysis in order to find traces of malware. He has employed Volatility tool in order to achieve his objective.
Which of the following volatility framework command she will use in order to analyze the running process from the memory dump?
- A. python vol.py pslist-profile=Win2008SP1x86 -f/root/Desktop/memdump.mem
- B. python vol.py svcscan--profile=Win2008SP1x86 -f/root/Desktop/memdump.mem | more
- C. python vol.py imageinfo -f/root/Desktop/memdump.mem
- D. python vol.py hivelist-prof le=Win2008SP1x86 -f/root Desktop/memdump.mem
Answer: A
NEW QUESTION # 129
The main feature offered by PGP Desktop Email is:
- A. End-to-end email communications
- B. Email service during incidents
- C. None of the above
- D. End-to-end secure email service
Answer: D
NEW QUESTION # 130
......
Pass Your 212-89 Exam Easily - Real 212-89 Practice Dump Updated Nov 29, 2023: https://torrentvce.pdfdumps.com/212-89-valid-exam.html