Eccouncil EC-Council Certified Incident Handler v3 212-89 Exam Practice Test

Page: 1 / 14
Total 172 questions
Question 1

[Introduction to Incident Handling and Response]

What is the most recent NIST standard for incident response?



Answer : A

As of my last update, the most recent NIST standard for incident response was NIST Special Publication 800-61 Revision 2 (800-61r2), titled 'Computer Security Incident Handling Guide.' This document provides guidelines for establishing an effective incident response program, including preparation, detection and analysis, containment, eradication, recovery, and post-incident activity.


Question 2

[Introduction to Incident Handling and Response]

Otis is an incident handler working in Delmont organization. Recently, the organization is facing several setbacks in the business and thereby its revenues are going down. Otis

was asked to take the charge and look into the matter. While auditing the enterprise security, he found the traces of an attack, where the proprietary information was stolen

from the enterprise network and was passed onto the competitors.

Which of the following information security incidents Delmont organization faced?



Answer : C

The Delmont organization faced an espionage incident, which involves the unauthorized access and theft of proprietary or confidential information for passing it onto competitors or other external entities. Espionage is targeted at obtaining secrets or intellectual property to gain a competitive advantage or for other strategic purposes. Unlike network and resource abuses or email-based abuse, which might not specifically target sensitive information, espionage directly aims at stealing valuable data. Unauthorized access is a method that could be used in an espionage attempt but does not fully capture the motive of passing stolen information to competitors.


Question 3

[Introduction to Incident Handling and Response]

Bran is an incident handler who is assessing the network of the organization. In the

process, he wants to detect ping sweep attempts on the network using Wireshark tool.

Which of the following Wireshark filter he must use to accomplish this task?



Answer : C

In Wireshark, the filtericmp.type==8is used to detect ping sweep attempts. ICMP type 8 messages are echo requests, which are used in ping operations to check the availability of a network device. A ping sweep involves sending ICMP echo requests to multiple addresses to discover active devices on a network. By filtering for ICMP type 8 messages in Wireshark, Bran can identify these echo requests, helping to pinpoint ping sweep activities on the network.


Question 4

[Handling and Responding to Malware Incidents]

Malicious Micky has moved from the delivery stage to the exploitation stage of the kill chain. This malware wants to find and report to the command center any useful services on the system. Which of the following recon attacks is the MOST LIKELY to provide this information?



Answer : D

When malware moves from the delivery stage to the exploitation stage in the cyber kill chain, its objective often shifts to identifying exploitable vulnerabilities within the targeted system. A port scan is a technique used to discover services that are listening on ports within a system. By scanning the system's ports, the malware can identify open ports and the services running on them, providing valuable information about potential entry points for further exploitation. This type of reconnaissance attack is aimed at gathering intelligence on the target system's network services, which can then be reported back to a command and control center for further malicious activity planning.

Port scanning is more relevant than IP range sweeps, packet sniffing, or session hijacking for identifying useful services on a system because it directly targets the discovery of accessible network services and their corresponding ports. While the other methods can also be part of the reconnaissance phase, they serve different purposes: IP range sweeps aim to identify active IP addresses, packet sniffing intercepts data packets to gather information, and session hijacking involves taking over a valid user session. In contrast, port scanning is specifically designed to enumerate services that could be exploited.


Question 5

[Handling and Responding to Network Security Incidents]

Which of the following is NOT a network forensic tool?



Answer : C

Network forensic tools are designed to capture, record, and analyze network traffic. Tools like Capsa Network Analyzer, Tcpdump, and Wireshark are specifically designed for this purpose, providing capabilities to capture live traffic, analyze packets, and understand network activities. Capsa Network Analyzer is a comprehensive network monitoring tool, Tcpdump is a powerful command-line packet analyzer, and Wireshark is a widely used network protocol analyzer that provides detailed information about network traffic.

Advanced NTFS Journaling Parser, on the other hand, is not a network forensic tool but a tool used for forensic analysis of NTFS file systems. It parses the NTFS journal ($LogFile), which contains a log of changes made to files on an NTFS volume. This tool is valuable for forensic analysts who are investigating the file system activities on a Windows system, such as file creation, modification, and deletion times, rather than analyzing network traffic. Therefore, it does not fit the category of a network forensic tool.


Question 6

[Introduction to Incident Handling and Response]

If the browser does not expire the session when the user fails to logout properly, which of the following OWASP Top 10 web vulnerabilities is caused?



Answer : C

When a browser does not expire a session after the user fails to logout properly, it is indicative of a vulnerability related to broken authentication. Broken authentication is a security issue where attackers can exploit flaws in the authentication mechanism to impersonate other users or take over their sessions. Failure to properly manage session lifetimes, such as not expiring sessions on logout, can allow an attacker to reuse old sessions or session IDs, potentially gaining unauthorized access to user accounts. This vulnerability is classified under A2: Broken Authentication in the OWASP Top 10, which lists the most critical web application security risks. The OWASP Top 10 serves as a guideline for developers and web application providers to understand and mitigate common security risks.


Question 7

[Introduction to Incident Handling and Response]

Which of the following is the BEST method to prevent email incidents?



Answer : D

While technical solutions like antivirus updates, disabling HTML in emails, and web proxy filtering play significant roles in securing email systems, the best method to prevent email incidents is often considered to be end-user training. This is because many email threats, such as phishing, rely on exploiting user behavior rather than technical vulnerabilities. By educating users on the risks associated with suspicious emails, how to recognize potentially harmful messages, and the importance of not clicking on unknown links or attachments, organizations can significantly reduce the risk of email-related incidents. End-user training empowers individuals to act as a critical line of defense against email-based threats, complementing technical safeguards.


Page:    1 / 14   
Total 172 questions