Practice 212-89 Questions With Certification guide Q&A from Training Expert PracticeMaterial
Free EC-COUNCIL 212-89 Test Practice Test Questions Exam Dumps
Becoming Certified Incident Handler
If you opt to become a Certified Incident Handler, your job scope will fall under one of Incident Management Team (IMT) or Incident Response Team (IRT). The ECIH certificate is meant to equip you with the skills you need to deal with and manage computer security issues within a certain information system. In the modern IT environments, a Certified Incident Handler is expected to become a knowledgeable professional who can manage different kinds of incidents and understand the methodologies of risk assessment, including the common policies associated with incident handling. In many organizations, an incident handler will be responsible for creating incident handling policies & dealing with different forms of incidents for security comprising insider attack threats and incidents for malicious code. Therefore, getting certified will earn you recognition as the designated and highly respected incident handler in your company.
NEW QUESTION 48
If the loss anticipated is greater than the agreed upon threshold; the organization will:
- A. Mitigate the risk
- B. Accept the risk but after management approval
- C. Do nothing
- D. Accept the risk
Answer: A
NEW QUESTION 49
Business continuity is defined as the ability of an organization to continue to function even after a disastrous event, accomplished through the deployment of redundant hardware and software, the use of fault tolerant systems, as well as a solid backup and recovery strategy. Identify the plan which is mandatory part of a business continuity plan?
- A. Sales and Marketing plan
- B. Forensics Procedure Plan
- C. Business Recovery Plan
- D. New business strategy plan
Answer: C
NEW QUESTION 50
Which of the following risk mitigation strategies involves the execution of controls to reduce the risk factor and bring it to an acceptable level, or accepts the potential risk and continues operating the IT system?
- A. Risk avoidance
- B. Risk assumption
- C. Risk planning
- D. Risk transference
Answer: B
NEW QUESTION 51
Mr.Smith is a lead incident responder of a small financial enterprise, which has a few branches in Australia. Recently, the company suffered a massive attack, losing$5M through an inter-banking system After an in-depth investigation, it was found that the incident occurred because the attackers penetrated the network through a minor vulnerability 6 months ago and maintained access without being detected by any user. They then tried to delete user fingerprints and performed a lateral movement to the computer of a person with privileges in the inter-banking system. The attackers finally gained access and performed fraudulent transactions.
In the above scenario, which of the following most accurately describes the type of attack?
- A. Ransom ware attack
- B. APT attack
- C. Denial-of-service attack
- D. Phishing
Answer: B
NEW QUESTION 52
Bit stream image copy of the digital evidence must be performed in order to:
- A. All the above
- B. Prevent alteration to the original disk
- C. Copy all disk sectors including slack space
- D. Copy the FAT table
Answer: C
NEW QUESTION 53
Which of the following is defined as the identification of the boundaries of an IT system along with the resources and information that constitute the system?
- A. System characterization
- B. Control analysis
- C. Threat identification
- D. Vulnerability identification
Answer: A
NEW QUESTION 54
Which is the incorrect statement about Anti-keyloggers scanners:
- A. Software tools
- B. Run in stealthy mode to record victims online activity
- C. Detect already installed Keyloggers in victim machines
Answer: B
NEW QUESTION 55
Identify a standard national process which establishes a set of activities, general tasks and a management
structure to certify and accredit systems that will maintain the information assurance (IA) and security posture
of a system or site.
- A. NIAAAP
- B. NIPACP
- C. NIACAP
- D. NIASAP
Answer: C
NEW QUESTION 56
The main feature offered by PGP Desktop Email is:
- A. None of the above
- B. End-to-end secure email service
- C. End-to-end email communications
- D. Email service during incidents
Answer: B
NEW QUESTION 57
Which of the following types of digital evidence is temporarily stored in a digital device that requires constant power supply and is deleted if the power supply is interrupted?
- A. Event logs
- B. Slack space
- C. Swap file
- D. Process memory
Answer: D
NEW QUESTION 58
Changing the web server contents, Accessing the workstation using a false ID and Copying sensitive data without authorization are examples of:
- A. Social Engineering attacks
- B. Malware attacks
- C. DDoS attacks
- D. Unauthorized access attacks
Answer: D
NEW QUESTION 59
In the cloud environment, an authorized security professional executes approved sanitation procedures using approved utilities to permanently remove data spilled from contaminated information systems and applications in the cloud.
This is an example of which of the following?
- A. Cloud eradication
- B. Cloud computing
- C. Cloud broker
- D. Cloud auditor
Answer: D
NEW QUESTION 60
Which of the following details are included in the evidence bags?
- A. Sensitive directories, personal, and organizational email address
- B. Software version information and web application source code
- C. Date and time of seizure, exhibit number, and name of incident responder
- D. Error messages that contain sensitive information and files containing passwords
Answer: C
NEW QUESTION 61
Contingency planning enables organizations to develop and maintain effective methods to handle emergencies. Every organization will have its own specific requirements that the planning should address. There are five major components of the IT contingency plan, namely supporting information, notification activation, recovery and reconstitution and plan appendices. What is the main purpose of the reconstitution plan?
- A. To restore the original site, tests systems to prevent the incident and terminates operations
- B. To define the notification procedures, damage assessments and offers the plan activation
- C. To provide the introduction and detailed concept of the contingency plan
- D. To provide a sequence of recovery activities with the help of recovery procedures
Answer: A
NEW QUESTION 62
Policies are designed to protect the organizational resources on the network by establishing the set rules and procedures. Which of the following policies authorizes a group of users to perform a set of actions on a set of resources?
- A. Documentation policy
- B. Logging policy
- C. Audit trail policy
- D. Access control policy
Answer: D
NEW QUESTION 63
Business Continuity provides a planning methodology that allows continuity in business operations:
- A. Before, during and after a disaster
- B. Before and after a disaster
- C. Before a disaster
- D. During and after a disaster
Answer: A
NEW QUESTION 64
The state of incident response preparedness that enables an organization to maximize its potential to use
digital evidence while minimizing the cost of an investigation is called:
- A. Computer Forensics
- B. Forensic Readiness
- C. Digital Forensic Policy
- D. Digital Forensic Analysis
Answer: B
NEW QUESTION 65
Computer Forensics is the branch of forensic science in which legal evidence is found in any computer or any digital media device. Of the following, who is responsible for examining the evidence acquired and separating the useful evidence?
- A. Evidence Supervisor
- B. Evidence Manager
- C. Evidence Documenter
- D. Evidence Examiner/ Investigator
Answer: D
NEW QUESTION 66
Introduction of malicious programs on to the device connected to the campus network (Trojan Horse, email bombs, virus, etc.) is called?
- A. Inappropriate Usage
- B. Authorize Access
- C. Un authorize Access
- D. Network Access
Answer: D
NEW QUESTION 67
Lack of forensic readiness may result in:
- A. Data manipulation, deletion, and theft
- B. System downtime
- C. Loss of clients thereby damaging the organization's reputation
- D. All the above
Answer: D
NEW QUESTION 68
Authorized users with privileged access who misuse the corporate informational assets and directly affects the
confidentiality, integrity, and availability of the assets are known as:
- A. Insider threats
- B. Outsider threats
- C. Social Engineers
- D. Zombies
Answer: A
NEW QUESTION 69
Dash wants to perform a DoS attack over 256 target URLs simultaneously.
Which of the following tools can Dash employ to achieve his objective?
- A. Ollydbg
- B. Open VAS
- C. IDA Pro
- D. HOIC
Answer: D
NEW QUESTION 70
Allan performed a reconnaissance attack on his corporate network as part of a red-team activity. He scanned the IP range to find live host IP addresses.
What type of technique did he use to exploit the network?
- A. Port scanning
- B. Social engineering
- C. DNS footprinting
- D. Ping sweeping
Answer: D
NEW QUESTION 71
A colleague wants to minimize their security responsibility because they are in a small organization. They are evaluating a new application that is offered in different forms.
Which form would result in the least amount of responsibility for the colleague?
- A. On-prem installation
- B. SaaS
- C. laaS
- D. PaaS
Answer: B
NEW QUESTION 72
Which of the following risk management processes identifies the risks, estimates the impact, and determines sources to recommend proper mitigation measures?
- A. Risk avoidance
- B. Risk mitigation
- C. Risk assumption
- D. Risk assessment
Answer: D
NEW QUESTION 73
......
ECCouncil 212-89 Exam
The Incident Manager Certification certified by the EC Council is designed to provide the fundamental skills to manage and respond to cybersecurity incidents in an information system. A certified accident controller is a qualified professional who can handle various types of accidents, risk assessment methodologies, and various accident management laws and policies. A certified incident controller will be capable to generate an incident response and management policies and control various types of computer security incidents, such as network security incidents, malicious code incidents, and threats of internal attacks.
Prepare Top EC-COUNCIL 212-89 Exam Audio Study Guide Practice Questions Edition: https://testking.practicematerial.com/212-89-questions-answers.html
