Welcome to download the Newest 2passeasy 212-89 dumps
https://www.2passeasy.com/dumps/212-89/ (163 New Questions)
Exam Questions 212-89
EC Council Certified Incident Handler (ECIH v2)
https://www.2passeasy.com/dumps/212-89/
Passing Certification Exams Made Easy visit - https://www.2PassEasy.com
Welcome to download the Newest 2passeasy 212-89 dumps
https://www.2passeasy.com/dumps/212-89/ (163 New Questions)
NEW QUESTION 1
The goal of incident response is to handle the incident in a way that minimizes damage and reduces recovery time and cost. Which of the following does NOT
constitute a goal of incident response?
A. Dealing with human resources department and various employee conflict behaviors.
B. Using information gathered during incident handling to prepare for handling future incidents in a better way and to provide stronger protection for systems and
data.
C. Helping personal to recover quickly and efficiently from security incidents, minimizing loss or theft and disruption of services.
D. Dealing properly with legal issues that may arise during incidents.
Answer: A
NEW QUESTION 2
Business continuity is defined as the ability of an organization to continue to function even after a disastrous event, accomplished through the deployment of
redundant hardware and software, the use of fault tolerant systems, as well as a solid backup and recovery strategy. Identify the plan which is mandatory part of a
business continuity plan?
A. Forensics Procedure Plan
B. Business Recovery Plan
C. Sales and Marketing plan
D. New business strategy plan
Answer: B
NEW QUESTION 3
The flow chart gives a view of different roles played by the different personnel of CSIRT. Identify the incident response personnel denoted by A, B, C, D, E, F and
G.
A. A-Incident Analyst, B- Incident Coordinator, C- Public Relations, D-Administrator, E- Human Resource, FConstituency, G-Incident Manager
B. A- Incident Coordinator, B-Incident Analyst, C- Public Relations, D-Administrator, E- Human Resource, FConstituency, G-Incident Manager
C. A- Incident Coordinator, B- Constituency, C-Administrator, D-Incident Manager, E- Human Resource, FIncident Analyst, G-Public relations
D. A- Incident Manager, B-Incident Analyst, C- Public Relations, D-Administrator, E- Human Resource, FConstituency, G-Incident Coordinator
Answer: C
NEW QUESTION 4
Which of the following is an appropriate flow of the incident recovery steps?
A. System Operation-System Restoration-System Validation-System Monitoring
B. System Validation-System Operation-System Restoration-System Monitoring
C. System Restoration-System Monitoring-System Validation-System Operations
D. System Restoration-System Validation-System Operations-System Monitoring
Answer: D
NEW QUESTION 5
A computer Risk Policy is a set of ideas to be implemented to overcome the risk associated with computer security incidents. Identify the procedure that is NOT
part of the computer risk policy?
A. Procedure to identify security funds to hedge risk
B. Procedure to monitor the efficiency of security controls
C. Procedure for the ongoing training of employees authorized to access the system
D. Provisions for continuing support if there is an interruption in the system or if the system crashes
Answer: C
Passing Certification Exams Made Easy visit - https://www.2PassEasy.com
Welcome to download the Newest 2passeasy 212-89 dumps
https://www.2passeasy.com/dumps/212-89/ (163 New Questions)
NEW QUESTION 6
Identify the network security incident where intended authorized users are prevented from using system, network, or applications by flooding the network with high
volume of traffic that consumes all existing network
resources.
A. URL Manipulation
B. XSS Attack
C. SQL Injection
D. Denial of Service Attack
Answer: D
NEW QUESTION 7
Quantitative risk is the numerical determination of the probability of an adverse event and the extent of the losses due to the event. Quantitative risk is calculated
as:
A. (Probability of Loss) X (Loss)
B. (Loss) / (Probability of Loss)
C. (Probability of Loss) / (Loss)
D. Significant Risks X Probability of Loss X Loss
Answer: A
NEW QUESTION 8
Computer forensics is methodical series of techniques and procedures for gathering evidence from computing equipment, various storage devices and or digital
media that can be presented in a course of law in a coherent and meaningful format. Which one of the following is an appropriate flow of steps in the computer
forensics process:
A. Examination> Analysis > Preparation > Collection > Reporting
B. Preparation > Analysis > Collection > Examination > Reporting
C. Analysis > Preparation > Collection > Reporting > Examination
D. Preparation > Collection > Examination > Analysis > Reporting
Answer: D
NEW QUESTION 9
US-CERT and Federal civilian agencies use the reporting timeframe criteria in the federal agency reporting categorization. What is the timeframe required to report
an incident under the CAT 4 Federal Agency category?
A. Weekly
B. Within four (4) hours of discovery/detection if the successful attack is still ongoing and agency is unable to successfully mitigate activity
C. Within two (2) hours of discovery/detection
D. Monthly
Answer: A
NEW QUESTION 10
A threat source does not present a risk if NO vulnerability that can be exercised for a particular threat source. Identify the step in which different threat sources are
defined:
A. Identification Vulnerabilities
B. Control analysis
C. Threat identification
D. System characterization
Answer: C
NEW QUESTION 10
In the Control Analysis stage of the NIST’s risk assessment methodology, technical and none technical control methods are classified into two categories. What
are these two control categories?
A. Preventive and Detective controls
B. Detective and Disguised controls
C. Predictive and Detective controls
D. Preventive and predictive controls
Answer: A
NEW QUESTION 12
Which of the following incident recovery testing methods works by creating a mock disaster, like fire to identify the reaction of the procedures that are implemented
Passing Certification Exams Made Easy visit - https://www.2PassEasy.com
Welcome to download the Newest 2passeasy 212-89 dumps
https://www.2passeasy.com/dumps/212-89/ (163 New Questions)
to handle such situations?
A. Scenario testing
B. Facility testing
C. Live walk-through testing
D. Procedure testing
Answer: D
NEW QUESTION 17
Which policy recommends controls for securing and tracking organizational resources:
A. Access control policy
B. Administrative security policy
C. Acceptable use policy
D. Asset control policy
Answer: D
NEW QUESTION 20
Organizations or incident response teams need to protect the evidence for any future legal actions that may be taken against perpetrators that intentionally
attacked the computer system. EVIDENCE PROTECTION is also required to meet legal compliance issues. Which of the following documents helps in protecting
evidence from physical or logical damage:
A. Network and host log records
B. Chain-of-Custody
C. Forensic analysis report
D. Chain-of-Precedence
Answer: B
NEW QUESTION 22
Except for some common roles, the roles in an IRT are distinct for every organization. Which among the following is the role played by the Incident Coordinator of
an IRT?
A. Links the appropriate technology to the incident to ensure that the foundation’s offices are returned to normal operations as quickly as possible
B. Links the groups that are affected by the incidents, such as legal, human resources, different business areas and management
C. Applies the appropriate technology and tries to eradicate and recover from the incident
D. Focuses on the incident and handles it from management and technical point of view
Answer: B
NEW QUESTION 23
In a qualitative risk analysis, risk is calculated in terms of:
A. (Attack Success + Criticality ) –(Countermeasures)
B. Asset criticality assessment – (Risks and Associated Risk Levels)
C. Probability of Loss X Loss
D. (Countermeasures + Magnitude of Impact) – (Reports from prior risk assessments)
Answer: C
NEW QUESTION 27
In which of the steps of NIST’s risk assessment methodology are the boundary of the IT system, along with the resources and the information that constitute the
system identified?
A. Likelihood Determination
B. Control recommendation
C. System characterization
D. Control analysis
Answer: C
NEW QUESTION 31
ADAM, an employee from a multinational company, uses his company’s accounts to send e-mails to a third party with their spoofed mail address. How can you
categorize this type of account?
A. Inappropriate usage incident
B. Unauthorized access incident
C. Network intrusion incident
D. Denial of Service incident
Answer: A
NEW QUESTION 34
Passing Certification Exams Made Easy visit - https://www.2PassEasy.com
Welcome to download the Newest 2passeasy 212-89 dumps
https://www.2passeasy.com/dumps/212-89/ (163 New Questions)
Digital evidence plays a major role in prosecuting cyber criminals. John is a cyber-crime investigator, is asked to investigate a child pornography case. The
personal computer of the criminal in question was confiscated by the county police. Which of the following evidence will lead John in his investigation?
A. SAM file
B. Web serve log
C. Routing table list
D. Web browser history
Answer: D
NEW QUESTION 39
One of the goals of CSIRT is to manage security problems by taking a certain approach towards the customers’ security vulnerabilities and by responding
effectively to potential information security incidents. Identify the incident response approach that focuses on developing the infrastructure and security processes
before the occurrence or detection of an event or any incident:
A. Interactive approach
B. Introductive approach
C. Proactive approach
D. Qualitative approach
Answer: C
NEW QUESTION 44
Incident management team provides support to all users in the organization that are affected by the threat or attack. The organization’s internal auditor is part of
the incident response team. Identify one of the responsibilities of the internal auditor as part of the incident response team:
A. Configure information security controls
B. Perform necessary action to block the network traffic from suspected intruder
C. Identify and report security loopholes to the management for necessary actions
D. Coordinate incident containment activities with the information security officer
Answer: C
NEW QUESTION 47
Based on the some statistics; what is the typical number one top incident?
A. Phishing
B. Policy violation
C. Un-authorized access
D. Malware
Answer: A
NEW QUESTION 48
The IDS and IPS system logs indicating an unusual deviation from typical network traffic flows; this is called:
A. A Precursor
B. An Indication
C. A Proactive
D. A Reactive
Answer: B
NEW QUESTION 51
The largest number of cyber-attacks are conducted by:
A. Insiders
B. Outsiders
C. Business partners
D. Suppliers
Answer: B
NEW QUESTION 52
Incidents such as DDoS that should be handled immediately may be considered as:
A. Level One incident
B. Level Two incident
C. Level Three incident
D. Level Four incident
Answer: C
NEW QUESTION 54
Which of the following can be considered synonymous:
Passing Certification Exams Made Easy visit - https://www.2PassEasy.com
Welcome to download the Newest 2passeasy 212-89 dumps
https://www.2passeasy.com/dumps/212-89/ (163 New Questions)
A. Hazard and Threat
B. Threat and Threat Agent
C. Precaution and countermeasure
D. Vulnerability and Danger
Answer: A
NEW QUESTION 57
Overall Likelihood rating of a Threat to Exploit a Vulnerability is driven by :
A. Threat-source motivation and capability
B. Nature of the vulnerability
C. Existence and effectiveness of the current controls
D. All the above
Answer: D
NEW QUESTION 62
What is correct about Quantitative Risk Analysis:
A. It is Subjective but faster than Qualitative Risk Analysis
B. Easily automated
C. Better than Qualitative Risk Analysis
D. Uses levels and descriptive expressions
Answer: B
NEW QUESTION 67
In NIST risk assessment/ methodology; the process of identifying the boundaries of an IT system along with the resources and information that constitute the
system is known as:
A. Asset Identification
B. System characterization
C. Asset valuation
D. System classification
Answer: B
NEW QUESTION 70
The correct sequence of Incident Response and Handling is:
A. Incident Identification, recording, initial response, communication and containment
B. Incident Identification, initial response, communication, recording and containment
C. Incident Identification, communication, recording, initial response and containment
D. Incident Identification, recording, initial response, containment and communication
Answer: A
NEW QUESTION 74
Preventing the incident from spreading and limiting the scope of the incident is known as:
A. Incident Eradication
B. Incident Protection
C. Incident Containment
D. Incident Classification
Answer: C
NEW QUESTION 76
Which of the following is an incident tracking, reporting and handling tool:
A. CRAMM
B. RTIR
C. NETSTAT
D. EAR/ Pilar
Answer: B
NEW QUESTION 81
Removing or eliminating the root cause of the incident is called:
A. Incident Eradication
B. Incident Protection
C. Incident Containment
D. Incident Classification
Passing Certification Exams Made Easy visit - https://www.2PassEasy.com
Welcome to download the Newest 2passeasy 212-89 dumps
https://www.2passeasy.com/dumps/212-89/ (163 New Questions)
Answer: A
NEW QUESTION 84
The role that applies appropriate technology and tries to eradicate and recover from the incident is known as:
A. Incident Manager
B. Incident Analyst
C. Incident Handler
D. Incident coordinator
Answer: B
NEW QUESTION 89
The region where the CSIRT is bound to serve and what does it and give service to is known as:
A. Consistency
B. Confidentiality
C. Constituency
D. None of the above
Answer: C
NEW QUESTION 93
CSIRT can be implemented at:
A. Internal enterprise level
B. National, government and military level
C. Vendor level
D. All the above
Answer: D
NEW QUESTION 97
An active vulnerability scanner featuring high speed discovery, configuration auditing, asset profiling, sensitive data discovery, and vulnerability analysis is called:
A. Nessus
B. CyberCop
C. EtherApe
D. nmap
Answer: A
NEW QUESTION 98
To respond to DDoS attacks; one of the following strategies can be used:
A. Using additional capacity to absorb attack
B. Identifying none critical services and stopping them
C. Shut down some services until the attack has subsided
D. All the above
Answer: D
NEW QUESTION 100
The very well-known free open source port, OS and service scanner and network discovery utility is called:
A. Wireshark
B. Nmap (Network Mapper)
C. Snort
D. SAINT
Answer: B
NEW QUESTION 102
The open source TCP/IP network intrusion prevention and detection system (IDS/IPS), uses a rule-driven language, performs real-time traffic analysis and packet
logging is known as:
A. Snort
B. Wireshark
C. Nessus
D. SAINT
Answer: A
NEW QUESTION 106
Passing Certification Exams Made Easy visit - https://www.2PassEasy.com
Welcome to download the Newest 2passeasy 212-89 dumps
https://www.2passeasy.com/dumps/212-89/ (163 New Questions)
A malware code that infects computer files, corrupts or deletes the data in them and requires a host file to propagate is called:
A. Trojan
B. Worm
C. Virus
D. RootKit
Answer: C
NEW QUESTION 110
Which of the following is a characteristic of adware?
A. Gathering information
B. Displaying popups
C. Intimidating users
D. Replicating
Answer: B
NEW QUESTION 115
______ attach(es) to files
A. adware
B. Spyware
C. Viruses
D. Worms
Answer: C
NEW QUESTION 118
The free utility which quickly scans Systems running Windows OS to find settings that may have been changed by spyware, malware, or other unwanted programs
is called:
A. Tripwire
B. HijackThis
C. Stinger
D. F-Secure Anti-virus
Answer: B
NEW QUESTION 119
The Malicious code that is installed on the computer without user’s knowledge to acquire information from the user’s machine and send it to the attacker who can
access it remotely is called:
A. Spyware
B. Logic Bomb
C. Trojan
D. Worm
Answer: A
NEW QUESTION 122
A Host is infected by worms that propagates through a vulnerable service; the sign(s) of the presence of the worm include:
A. Decrease in network usage
B. Established connection attempts targeted at the vulnerable services
C. System becomes instable or crashes
D. All the above
Answer: C
NEW QUESTION 126
Keyloggers do NOT:
A. Run in the background
B. Alter system files
C. Secretly records URLs visited in browser, keystrokes, chat conversations, ...etc
D. Send log file to attacker’s email or upload it to an ftp server
Answer: B
NEW QUESTION 130
Which is the incorrect statement about Anti-keyloggers scanners:
A. Detect already installed Keyloggers in victim machines
Passing Certification Exams Made Easy visit - https://www.2PassEasy.com
Welcome to download the Newest 2passeasy 212-89 dumps
https://www.2passeasy.com/dumps/212-89/ (163 New Questions)
B. Run in stealthy mode to record victims online activity
C. Software tools
Answer: B
NEW QUESTION 135
The USB tool (depicted below) that is connected to male USB Keyboard cable and not detected by antispyware tools is most likely called:
A. Software Key Grabber
B. Hardware Keylogger
C. USB adapter
D. Anti-Keylogger
Answer: B
NEW QUESTION 138
Lack of forensic readiness may result in:
A. Loss of clients thereby damaging the organization’s reputation
B. System downtime
C. Data manipulation, deletion, and theft
D. All the above
Answer: D
NEW QUESTION 142
What command does a Digital Forensic Examiner use to display the list of all open ports and the associated IP addresses on a victim computer to identify the
established connections on it:
A. “arp” command
B. “netstat –an” command
C. “dd” command
D. “ifconfig” command
Answer: B
NEW QUESTION 144
Digital evidence must:
A. Be Authentic, complete and reliable
B. Not prove the attackers actions
C. Be Volatile
D. Cast doubt on the authenticity and veracity of the evidence
Answer: A
NEW QUESTION 149
A methodical series of techniques and procedures for gathering evidence, from computing equipment and various storage devices and digital media, that can be
presented in a court of law in a coherent and meaningful format is called:
A. Forensic Analysis
B. Computer Forensics
C. Forensic Readiness
D. Steganalysis
Answer: B
NEW QUESTION 153
According to US-CERT; if an agency is unable to successfully mitigate a DOS attack it must be reported within:
A. One (1) hour of discovery/detection if the successful attack is still ongoing
B. Two (2) hours of discovery/detection if the successful attack is still ongoing
C. Three (3) hours of discovery/detection if the successful attack is still ongoing
Passing Certification Exams Made Easy visit - https://www.2PassEasy.com
Welcome to download the Newest 2passeasy 212-89 dumps
https://www.2passeasy.com/dumps/212-89/ (163 New Questions)
D. Four (4) hours of discovery/detection if the successful attack is still ongoing
Answer: B
NEW QUESTION 157
Which test is conducted to determine the incident recovery procedures effectiveness?
A. Live walk-throughs of procedures
B. Scenario testing
C. Department-level test
D. Facility-level test
Answer: A
NEW QUESTION 161
According to the Fourth Amendment of USA PATRIOT Act of 2001; if a search does NOT violate a person’s “reasonable” or “legitimate” expectation of privacy
then it is considered:
A. Constitutional/ Legitimate
B. Illegal/ illegitimate
C. Unethical
D. None of the above
Answer: A
NEW QUESTION 165
According to the Evidence Preservation policy, a forensic investigator should make at least ..................... image copies of the digital evidence.
A. One image copy
B. Two image copies
C. Three image copies
D. Four image copies
Answer: B
NEW QUESTION 166
......
Passing Certification Exams Made Easy visit - https://www.2PassEasy.com
Welcome to download the Newest 2passeasy 212-89 dumps
https://www.2passeasy.com/dumps/212-89/ (163 New Questions)
THANKS FOR TRYING THE DEMO OF OUR PRODUCT
Visit Our Site to Purchase the Full Set of Actual 212-89 Exam Questions With Answers.
We Also Provide Practice Exam Software That Simulates Real Exam Environment And Has Many Self-Assessment Features. Order the
212-89 Product From:
https://www.2passeasy.com/dumps/212-89/
Money Back Guarantee
212-89 Practice Exam Features:
* 212-89 Questions and Answers Updated Frequently
* 212-89 Practice Questions Verified by Expert Senior Certified Staff
* 212-89 Most Realistic Questions that Guarantee you a Pass on Your FirstTry
* 212-89 Practice Test Questions in Multiple Choice Formats and Updatesfor 1 Year
Passing Certification Exams Made Easy visit - https://www.2PassEasy.com
Powered by TCPDF (www.tcpdf.org)
