EC-Council Certified Incident Handler (ECIH v2) Real 212-89 Exam Questions Released [3-12-2022]

Regina2022-03-22T09:18:27+00:00

By Regina EC-Council, ECIH, Free Questions Online 212-89, 212-89 exam questions

To help candidates be a EC-Council Certified Incident Handler (ECIH) certified successfully, ITExamShop’s professional team have released real 212-89 exam questions on March 12 with great Q&As for preparation. ITExamShop 212-89 exam questions have the latest questions and verified answers, which have the ability to get you through the EC-Council 212-89 exam at your first attempt.

EC-Council ECIH Certification 212-89 Free Exam Questions Are Also Available

Page 1 of 3

1. The goal of incident response is to handle the incident in a way that minimizes damage and reduces recovery time and cost.

Which of the following does NOT constitute a goal of incident response?

Dealing with human resources department and various employee conflict behaviors.

Using information gathered during incident handling to prepare for handling future incidents in a better way and to provide stronger protection for systems and data.

Helping personal to recover quickly and efficiently from security incidents, minimizing loss or theft and disruption of services.

Dealing properly with legal issues that may arise during incidents.

2. John is performing a memory dump analysis in order to find traces of malware. He has employed Volatility tool in order to achieve his objective.

Which of the following volatility framework command she will use in order to analyze the running process

from the memory dump?

python vol.py pslist--profile=Win2008SP1x86 -f/root/Desktop/memdump.mem

python vol.py imageinfo -f/root/Desktop/memdump.mem

python vol.py hivelist --prof le=Win2008SP1x86 -f/root/Desktop/mem dump.mem

python vol.py svcscan--profile=Win2008SP1x86 -f/root/Desktop/mem dump.mem | more

3. Quantitative risk is the numerical determination of the probability of an adverse event and the extent of the losses due to the event. Quantitative risk is calculated as:

(Probability of Loss) X (Loss)

(Loss) / (Probability of Loss)

(Probability of Loss) / (Loss)

Significant Risks X Probability of Loss X Loss

4. When an employee is terminated from his or her job, what should be the next immediate step taken by an organization?

All access rights of the employee to physical locations, networks, systems, applications and data should be disabled

The organization should enforce separation of duties

The access requests granted to an employee should be documented and vetted by the supervisor

The organization should monitor the activities of the system administrators and privileged users who have permissions to access the sensitive information

5. One of the main objectives of incident management is to prevent incidents and attacks by tightening the physical security of the system or infrastructure.

According to CERT’s incident management process, which stage focuses on implementing infrastructure improvements resulting from postmortem reviews or other process improvement mechanisms?

Protection

Preparation

Detection

Triage

6. Which of the following methods help incident responders to reduce the false-positive alert rates and further provide benefits of focusing on top priority issues, thereby reducing potential risk and corporate liabilities?

Threat attribution

Threat correlation

Threat contextualization

Threat profiling

7. Elizabeth, working for OBC organization as an incident responder, is assessing the risks facing the organizational security. During the assessment process, she calculates the probability of a threat source exploiting an existing system vulnerability.

Identify the risk assessment step Elizabeth is currently in.

System characterization

Impact analysis

Likelihood analysis

vulnerability identification

8. The insider risk matrix consists of technical literacy and business process knowledge vectors. Considering the matrix, one can conclude that:

If the insider’s technical literacy is low and process knowledge is high, the risk posed by the threat will be insignificant.

If the insider’s technical literacy and process knowledge are high, the risk posed by the threat will be insignificant.

If the insider’s technical literacy is high and process knowledge is low, the risk posed by the threat will be high.

If the insider’s technical literacy and process knowledge are high, the risk posed by the threat will be high.

9. In which of the steps of NIST’s risk assessment methodology are the boundary of the IT system, along with the resources and the information that constitute the system identified?

Likelihood Determination

Control recommendation

System characterization

Control analysis

10. An organization named Sam Morison Inc.decided to use cloud-based services to reduce the cost of their maintenance. They first identified various risks and threats associated with cloud service adoption and

migrating critical business data to third-party systems. Hence, the organization decided to deploy cloud-based security tools to prevent upcoming threats.

Which of the following tools would help the organization to secure cloud resources and services?

Alert Logic

Wire shark

Burp Suite

Nmap

Page 2 of 3

11. Which of the following is an appropriate flow of the incident recovery steps?

System Operation-System Restoration-System Validation-System Monitoring

System Validation-System Operation-System Restoration-System Monitoring

System Restoration-System Monitoring-System Validation-System Operations

System Restoration-System Validation-System Operations-System Monitoring

12. Computer forensics is methodical series of techniques and procedures for gathering evidence from computing equipment, various storage devices and or digital media that can be presented in a course of law in a coherent and meaningful format.

Which one of the following is an appropriate flow of steps in the computer forensics process?

Examination> Analysis > Preparation > Collection > Reporting

Preparation > Analysis > Collection > Examination > Reporting

Analysis > Preparation > Collection > Reporting > Examination

Preparation > Collection > Examination > Analysis > Reporting

13. US-CERT and Federal civilian agencies use the reporting timeframe criteria in the federal agency reporting categorization.

What is the timeframe required to report an incident under the CAT 4 Federal Agency category?

Weekly

Within four (4) hours of discovery/detection if the successful attack is still ongoing and agency is unable to successfully mitigate activity

Within two (2) hours of discovery/detection

Monthly

14. Identify the Sarbanes-Oxley Act (SOX) Title, which consists of only one section, that includes measures designed to help restore investor confidence in the reporting of securities analysts.

Title VI: Stud is and Reports

Title IX: White-Collar-Crime Penalty Enhancement

Title V: Analyst Conflicts of Interest

Title VIII: Corporate and Criminal Fraud Accountability

15. Insider threats can be detected by observing concerning behaviors exhibited by insiders, such as conflicts with supervisors and coworkers, decline in performance, tardiness or unexplained absenteeism.

Select the technique that helps in detecting insider threats:

Correlating known patterns of suspicious and malicious behavior

Protecting computer systems by implementing proper controls

Making is compulsory for employees to sign a none disclosure agreement

Categorizing information according to its sensitivity and access rights

16. Michael is an incident handler at CyberTech Solutions. He is performing detection and analysis of a cloud

security incident. He is also analyzing the filesystems, slack spaces, and metadata within the storage units to find hidden malware and evidence of malice.

Identify the cloud security incident handled by Michael:

Storage-related incident

Application-related incident

Server-related incident

Network-related incident

17. A computer Risk Policy is a set of ideas to be implemented to overcome the risk associated with computer security incidents. Identify the procedure that is NOT part of the computer risk policy?

Procedure to identify security funds to hedge risk

Procedure to monitor the efficiency of security controls

Procedure for the ongoing training of employees authorized to access the system

Provisions for continuing support if there is an interruption in the system or if the system crashes

18. Business continuity is defined as the ability of an organization to continue to function even after a disastrous event, accomplished through the deployment of redundant hardware and software, the use of fault tolerant systems, as well as a solid backup and recovery strategy.

Identify the plan which is mandatory part of a business continuity plan?

Forensics Procedure Plan

Business Recovery Plan

Sales and Marketing plan

New business strategy plan

19. Which policy recommends controls for securing and tracking organizational resources:

Access control policy

Administrative security policy

Acceptable use policy

Asset control policy

20. Which of the following information security personnel handles incidents from management and technical point of view?

Network administrators

Forensic investigators

Inc dent manager(IM)

Threat researchers

Page 3 of 3

21. A US Federal agency network was the target of a DoS attack that prevented and impaired the normal authorized functionality of the networks. According to agency’s reporting timeframe guidelines, this incident should be reported within two (2) HOURS of discovery/detection if the successful attack is still ongoing and the agency is unable to successfully mitigate the activity.

Which incident category of the US Federal Agency does this incident belong to?

CAT 5

CAT 1

CAT 2

CAT 6

Welcome To Choose Required IT Certification Exams Online

EC-Council Certified Incident Handler (ECIH v2) Real 212-89 Exam Questions Released [3-12-2022]

EC-Council ECIH Certification 212-89 Free Exam Questions Are Also Available

Author