Get Ready to Pass the 212-89 exam with EC-COUNCIL Latest Practice Exam
Get Prepared for Your 212-89 Exam With Actual EC-COUNCIL Study Guide!
NEW QUESTION # 163
Following a security alert, the incident response team at a legal consulting firm suspects that an employee used a USB storage device to exfiltrate confidential client data. To confirm which USB device was connected and gather timestamps and identifiers, which method is most effective?
- A. Scan network logs for USB file upload patterns.
- B. Check Windows registry entries under Enum\USB.
- C. Use WHOIS lookup to trace USB activity.
- D. Review Windows SetupAPI.dev.log file entries.
Answer: B
Explanation:
Comprehensive and Detailed Explanation (ECIH-aligned):
ECIH forensic readiness guidance identifies the Windows Registry as a primary source for USB device artifacts. The Enum\USB registry key stores vendor IDs, product IDs, serial numbers, and connection history.
Option A is correct because it provides direct evidence of which USB devices were connected, when they were installed, and on which system-critical for insider investigations.
Option B cannot reliably identify physical USB usage. Option C contains driver installation data but is less comprehensive. Option D is irrelevant.
Registry analysis is a foundational forensic technique in ECIH, making Option A correct.
NEW QUESTION # 164
You area systems administrator for a company. You are accessing your fileserver remotely for maintenance. Suddenly, you are unable to access the server. After contacting others in your department, you find out that they cannot access the file server either. You can ping the file server but not connect to it via RD. You check the Active Directory Server, and all is well. You check the email server and find that emails are sent and received normally.
What is the most likely issue?
- A. A denial-of-service issue
- B. An admin account issue
- C. The fileserver has shutdown
- D. An email service issue
Answer: A
NEW QUESTION # 165
The USB tool (depicted below) that is connected to male USB Keyboard cable and not detected by anti-spyware tools is most likely called:
- A. Software Key Grabber
- B. Hardware Keylogger
- C. USB adapter
- D. Anti-Keylogger
Answer: B
NEW QUESTION # 166
Quantitative risk is the numerical determination of the probability of an adverse event and the extent of the losses due to the event. Quantitative risk is calculated as:
- A. (Probability of Loss) / (Loss)
- B. Significant Risks X Probability of Loss X Loss
- C. (Loss) / (Probability of Loss)
- D. (Probability of Loss) X (Loss)
Answer: D
NEW QUESTION # 167
An incident handler is analyzing email headers to find out suspicious emails.
Which of the following tools he/she must use in order to accomplish the task?
- A. Barracuda Email Security Gateway
- B. SPAMfighter
- C. Gophish
Answer: A
Explanation:
The Barracuda Email Security Gateway is designed to manage and filter inbound and outbound email traffic to protect organizations from email-borne threats and data leaks. As an incident handler analyzing email headers to find out suspicious emails, using a tool like the Barracuda Email Security Gateway would be appropriate.
This tool can help identify and block spam, phishing, malware, and other malicious email threats, making it easier to focus on analyzing potentially harmful emails more closely.
NEW QUESTION # 168
Ikeo Corp.hired an incident response team to assess the enterprise security. As part of the incident handling and response process, the IR team is reviewing the current se cunty policies implemented by the enterprise. The IR team finds that employees of the organization do not have any restrictions on Internet access: they are allowed to visit any site, download any appl cation, and access a computer or network from a remote location. Considering this as the main security threat, the IR team plans to change this policy as it can be easily exploited by attackers.
Which of the following security policies is the IR team planning to modify?
- A. Permissive policy
- B. Paranoid policy
- C. Promiscuous policy
- D. Prudent policy
Answer: C
NEW QUESTION # 169
Which of the following is a technique used by attackers to make a message difficult to understand through the use of ambiguous language?
- A. Steganography
- B. Encryption
- C. Obfuscation
- D. Spoofing
Answer: C
NEW QUESTION # 170
The type of relationship between CSIRT and its constituency have an impact on the services provided by the CSIRT. Identify the level of the authority that enables members of CSIRT to undertake any necessary actions on behalf of their constituency?
- A. Mid-level authority
- B. Half-level authority
- C. Shared-level authority
- D. Full-level authority
Answer: D
NEW QUESTION # 171
A global bank's IH&R team is investigating an intricate cyber-espionage campaign. Advanced persistent threat (APT) actors exfiltrated sensitive financial data over several months using both software vulnerabilities and human errors. What is the MOST appropriate immediate action for the IH&R team?
- A. Focus solely on patching known vulnerabilities.
- B. Publicize the breach to comply with laws.
- C. Leverage an Incident Response Automation and Orchestration (IRAO) tool to correlate data and automate threat hunting.
- D. Conduct organization-wide cybersecurity awareness training.
Answer: C
Explanation:
Advanced persistent threats require coordinated, intelligence-driven response. ECIH emphasizes that APT investigations generate massive volumes of telemetry across endpoints, networks, and cloud platforms.
Option D is correct because Incident Response Automation and Orchestration (IRAO) tools correlate disparate data sources, automate enrichment, and accelerate threat hunting. This enables responders to identify hidden persistence mechanisms and attacker TTPs efficiently.
Options A, B, and C are important but not immediate investigative actions.
ECIH explicitly recommends orchestration platforms for complex, multi-vector incidents such as APTs.
NEW QUESTION # 172
Sam. an employee of a multinational company, sends emails to third-party organizations with a spoofed email address of his organization. How can you categorize this type of incident?
- A. Inappropriate usage incident
- B. Unauthorized access incident.
- C. Denial-of-service incicent
- D. Network intrusion incident
Answer: A
Explanation:
An inappropriate usage incident involves misuse of the organization's resources or violations of its acceptable use policies. Sam's actions, where he sends emails to third-party organizations with a spoofed email address of his employer, constitute misuse of the organization's email system and misrepresentation of the organization.
This behavior can harm the organization's reputation, violate policy, and potentially lead to legal consequences. Inappropriate usage incidents can range from unauthorized use of systems for personal gain to the dissemination of unapproved content.
References:The Incident Handler (ECIH v3) by EC-Council includes discussions on various types of security incidents, emphasizing the importance of addressing and mitigating not just external threats but also internal misuse and policy violations.
NEW QUESTION # 173
Oscar receives an email from an unknown source containing his domain name oscar.com. Upon checking the link, he found that it contains a malicious URL that redirects to the website evilsite.org. What type of vulnerability is this?
- A. Unvalidated redirects and forwards
- B. SQL injection
- C. Malware
- D. Bolen
Answer: A
Explanation:
The scenario described, where Oscar receives an email with a link that contains a malicious URL redirecting to evilsite.org, exemplifies a vulnerability related to unvalidated redirects and forwards. This type of vulnerability occurs when a web application accepts untrusted input that could cause the web application to redirect the request to a URL contained within untrusted input. Attackers can exploit this vulnerability by crafting a malicious URL that leads unsuspecting users to phishing sites or other malicious websites, under the guise of a legitimate domain. This is distinct from malware, which refers to malicious software; SQL injection, which involves inserting malicious SQL queries through input fields to manipulate or exploit databases; and is not a term related to cybersecurity vulnerabilities.References:The Incident Handler (ECIH v3) certification materials often cover web application vulnerabilities, including unvalidated redirects and forwards, emphasizing the need for proper validation and sanitization of user input to prevent such exploits.
NEW QUESTION # 174
Agencies do NOT report an information security incident is because of:
- A. All the above
- B. Have full knowledge about how to handle the attack internally
- C. Afraid of negative publicity
- D. Do not want to pay the additional cost of reporting an incident
Answer: C
NEW QUESTION # 175
A regional airport recently upgraded its operations with smart IoT-based baggage handling and security camera systems. During a routine cyber resilience drill mimicking device disruption, operational staff experienced confusion in executing assigned duties and lacked clarity in the communication flow. There was uncertainty about who should engage with third-party vendors, how to retrieve diagnostic logs from affected systems, and which units required priority attention to maintain continuity. Which of the following would best address these preparedness gaps?
- A. Schedule periodic firmware patching for vulnerable IoT endpoints
- B. Automate alerts for anomalous activity across the IoT network using monitoring tools
- C. Transition critical airport infrastructure to a fallback manual mode during emergency events
- D. Conduct realistic simulations and clearly document responsibilities for each stakeholder
Answer: D
Explanation:
The EC-Council Incident Handler (ECIH) curriculum stresses that preparation is the most critical phase of incident response. Organizations must establish clearly defined roles, communication channels, escalation procedures, and documented response workflows before an incident occurs. The scenario highlights confusion during a resilience drill-specifically unclear stakeholder responsibilities, communication breakdowns, and uncertainty in vendor coordination and log retrieval.
ECIH emphasizes that conducting realistic simulations, tabletop exercises, and red/blue team drills strengthens organizational readiness. These exercises help validate escalation paths, clarify third-party engagement protocols, and ensure that evidence collection procedures-such as retrieving diagnostic logs- are well understood by operational teams.
Option A (automated alerts) improves detection but does not solve role ambiguity. Option B (firmware patching) addresses vulnerability management but not communication gaps. Option D (manual fallback mode) supports business continuity but does not resolve the confusion in responsibilities and escalation paths identified in the drill.
ECIH guidance clearly states that effective first response depends on documented playbooks, defined stakeholder responsibilities, vendor coordination procedures, and continuous testing of incident response plans. Simulation-based training exposes procedural weaknesses and ensures each department understands its operational and communication duties.
Therefore, conducting realistic simulations and clearly documenting responsibilities for each stakeholder is the most appropriate corrective action to close the preparedness gaps identified during the exercise.
NEW QUESTION # 176
What is the best staffing model for an incident response team if current employees' expertise is very low?
- A. All the above
- B. Fully insourced
- C. Fully outsourced
- D. Partially outsourced
Answer: C
NEW QUESTION # 177
The region where the CSIRT is bound to serve and what does it and give service to is known as:
- A. Constituency
- B. None of the above
- C. Confidentiality
- D. Consistency
Answer: A
NEW QUESTION # 178
FinTechHub, a financial tech startup, experienced a Cross-Site Scripting (XSS) attack on their main application. Post the incident the team is keen on implementing proactive measures to handle such vulnerabilities. What should be their primary focus to prevent future XSS attacks?
- A. Deploy a network-based intrusion detection system (IDS).
- B. Sanitize and validate all user inputs across the application.
- C. Implement rate limiting on the application.
- D. Regularly patch and update the server operating system.
Answer: B
Explanation:
Cross-Site Scripting attacks occur when untrusted input is processed and rendered by an application without proper validation or encoding. ECIH web application security guidance identifies input validation and output encoding as the most effective primary defense against XSS.
Option B is correct because sanitizing and validating all user input ensures that malicious scripts are neutralized before being stored or rendered. This addresses the root cause of XSS vulnerabilities.
Option A is a detection control, not a prevention mechanism. Option C improves system security but does not prevent application-level XSS flaws. Option D addresses abuse and DoS scenarios, not script injection.
Therefore, focusing on input validation is the most effective proactive control against XSS, as emphasized in the ECIH curriculum.
NEW QUESTION # 179
Which of the following terms refers to an organization's ability to make optimal use of digital evidence in a limited period of time and with minimal investigation costs?
- A. Data analysis
- B. Forensic readiness
- C. Threat assessment
- D. Risk assessment
Answer: B
Explanation:
Forensic readiness refers to an organization's ability to maximize its capability to use digital evidence effectively in an investigation, while minimizing the cost of an investigation and disruption to its operations.
It involves having policies, procedures, and technologies in place to collect, preserve, and analyze digital evidence efficiently, so when an incident occurs, the organization is prepared to handle it quickly and with minimal costs. Forensic readiness not only helps in reducing the time and resources spent on investigations but also ensures that the evidence is reliable and can be used in legal proceedings if necessary.
References:The concept of forensic readiness is part of the Incident Handler (ECIH v3) curriculum, emphasizing the strategic importance of preparing for incidents in advance, including the preservation of evidence and the ability to conduct effective and efficient investigations.
NEW QUESTION # 180
......
Pass Your Next 212-89 Certification Exam Easily & Hassle Free: https://www.actual4labs.com/EC-COUNCIL/212-89-actual-exam-dumps.html
Free EC-COUNCIL 212-89 Exam Question Practice Exams: https://drive.google.com/open?id=1fOWAd7BZ7aF6EDlMRg0svCWDBm9q7MBw