Eccouncil EC-Council Certified Incident Handler v3 212-89 Exam Questions

Answer : C

The EC-Council Incident Handler (ECIH) curriculum categorizes incidents such as unauthorized software installation and policy violations under inappropriate usage incidents. In this scenario, the activity originated from a legitimate internal workstation and user account, not an external third party.

The repeated login failures outside business hours combined with installation of an unauthorized remote desktop tool indicate a breach of acceptable use policy and potentially malicious intent. However, the key factor is that the actions were performed by an internal user using valid access credentials, making this an insider-related policy violation rather than an external unauthorized access attack.

Option A implies legitimate remote work within policy boundaries, which is contradicted by the unauthorized software installation. Option B suggests a third-party compromise, but logs indicate activity from an internal user account. Option D (DoS attack) involves service disruption via traffic flooding, which is not described here.

ECIH stresses enforcing acceptable use policies, monitoring user behavior, restricting unauthorized software installation, and applying least privilege controls to mitigate insider misuse. Therefore, this scenario best fits inappropriate usage due to policy violation and unauthorized software installation.

Answer : A

Explanation (aligned to threat intelligence & detection):

A high-interaction honeypot is designed to attract and engage adversaries, providing realistic services so defenders can observe tactics, techniques, and procedures (TTPs) with higher fidelity than a low-interaction decoy. The goal is not to ''stop'' attacks directly, but to detect and learn: identify scanning patterns, credential stuffing attempts, exploit chains, payload delivery methods, and post-exploitation behaviors such as enumeration and lateral movement. That intelligence is then used to improve controls---signatures, detections, segmentation, and hardening priorities.

Sandboxing (B) is typically about detonating suspicious files/URLs to observe behavior in a controlled environment; it's not what a DMZ honeypot primarily does. ACL rules and DDoS blocking (C) are traffic filtering measures, not deception telemetry. Backup/recovery testing (D) is resilience planning, unrelated to studying attacker behavior in real-time.

In incident handling terms, honeypots support the ''preparation'' and ''detection'' posture---expanding visibility, generating early warning, and enriching threat intelligence. They can also reduce risk by luring opportunistic attackers away from production assets, but their primary value is behavioral observation and evidence collection.

Answer : A

A Denial of Service (DoS) attack aims to make a computer resource, network, or application unavailable to its intended users, thereby preventing legitimate users from using the service. This is achieved by overwhelming the target with a flood of internet traffic or sending information that triggers a crash. In contrast, fraud and theft involve the unauthorized acquisition of data or assets, unauthorized access refers to gaining entry into systems without permission, and malicious code or insider threat attacks relate to software designed to cause harm or unauthorized actions by trusted users within the organization. The specific intent of a DoS attack is to disrupt service, making it a distinct category focused on denial of availability.

Answer : C

This scenario represents a failure in the Preparation phase of the Incident Handling and Response (IH&R) lifecycle as defined by the EC-Council ECIH curriculum. Preparation focuses on establishing policies, procedures, standards, and awareness programs that define how systems and data must be used and protected. In this case, employees were sharing credentials via unauthorized channels because the organization failed to provide explicit rules governing acceptable communication practices.

Option C is correct because establishing defined protocols for approved digital channels directly addresses the root cause. ECIH emphasizes that organizations must define acceptable use policies, secure communication standards, and data handling procedures before incidents occur. These controls reduce the likelihood of human error and insider misuse by setting clear expectations and enforceable boundaries.

Option A relates to physical surveillance risks, which are unrelated to credential sharing. Option B is a recovery-focused control and does not prevent misuse. Option D is a detection mechanism that cannot compensate for missing governance controls.

By defining approved channels and educating users on their proper use, organizations significantly reduce the probability of credential leakage and insider-driven incidents, fulfilling a core ECIH preparation requirement.

Answer : C

The ECIH Endpoint Security module stresses that modern endpoint incidents require advanced detection capabilities beyond traditional antivirus or manual inspection. Intellectual property theft often involves stealthy techniques that evade basic controls.

Option C is correct because an Endpoint Detection and Response (EDR) solution provides deep visibility into endpoint behavior, including process execution, memory activity, file changes, and lateral movement. EDR enables analysts to detect, investigate, and validate incidents efficiently across multiple endpoints.

Option B is slow and error-prone. Option A is premature without validation. Option D identifies vulnerabilities, not active compromise.

ECIH highlights EDR as a cornerstone technology for endpoint incident detection and validation, especially in high-value environments such as R&D networks.

Answer : C

The DBCC LOG command is used in SQL Server environments to analyze the transaction log files of a database. It provides insights into the transactions that have occurred, which is crucial for forensic analysis in the event of an incident. The syntaxDBCC LOG(<database_name>, <output_level>)allows an incident handler to specify the level of detail they wish to retrieve from the log files. When an incident handler like Adam requires the full information on each operation along with the hex dump of the current transaction row, the output parameter should be set to 4. This level of output is the most verbose, providing comprehensive details about each transaction, including a hex dump which is essential for a deep forensic analysis. It helps in understanding the exact changes made by transactions, which can be pivotal in investigating incidents involving data manipulation or other unauthorized database activities.

Answer : D

Explanation (aligned to IH&R best practice):

Insider threats are most effectively reduced by combining least privilege with continuous detection of abnormal behavior. Regular access reviews ensure that users only retain permissions needed for their roles (reducing ''privilege creep''), while behavior analytics help detect misuse that still occurs within ''legitimate'' access. Password rotation (A) is largely hygiene and does not prevent a determined insider who already has authorized access; frequent forced changes can also push unsafe behaviors (writing passwords down, predictable patterns). A strict hierarchy (B) is not practical and does not map to ''need-to-know''---seniority is not the right control boundary, job function is. Biometrics (C) strengthens authentication, but the scenario's problem is not identity uncertainty; it is misuse by a valid insider. The most effective approach is therefore governance + monitoring: (1) define data access baselines, (2) review permissions routinely, (3) alert on suspicious actions such as unusual repository cloning, bulk downloads, access outside normal hours, or atypical branches, and (4) investigate quickly with HR/legal processes. These measures directly address motive-driven misuse by enabling early detection and limiting the blast radius. This aligns with the broader incident handling emphasis on identifying affected systems/data, understanding scope, and improving controls post-incident to prevent recurrence.