Free Preparation Discussions
MENU
Eccouncil 212-89 Exam Questions
- Topic 1: Handling and Responding to Insider Threats/ Forensic Readiness and First Response
- Topic 2: Handling and Responding to Cloud Security Incidents/ Incident Handling and Response Process
- Topic 3: Handling and Responding to Web Application Security Incidents/ Introduction to Incident Handling and Response
- Topic 4: Handling and Responding to Network Security Incidents/ Handling and Responding to Malware Incidents
- Topic 5: Handling and Responding to Email Security Incidents
Free Eccouncil 212-89 Exam Actual Questions
Note: Premium Questions for 212-89 were last updated On Mar. 28, 2025 (see below)
Bonney's system has been compromised by a gruesome malware.
What is the primary step that is advisable to Bonney in order to contain the malware
incident from spreading?
Turning off the infected machine is a common immediate response to contain a malware incident and prevent it from spreading to other systems on the network. This action halts any ongoing malicious activities by the malware, thereby limiting the potential for further damage or data exfiltration. However, it is essential to note that this step can lead to the loss of volatile data that might be useful for forensic analysis. Therefore, it is advisable only when it's critical to stop the malware immediately, and there's a strategy in place for forensic investigation that includes handling non-volatile data or when the preservation of volatile data is not possible.
Stenley is an incident handler working for Texa Corp. located in the United States. With the growing concern of increasing emails from outside the organization, Stenley was
asked to take appropriate actions to keep the security of the organization intact. In the process of detecting and containing malicious emails, Stenley was asked to check the
validity of the emails received by employees.
Identify the tools he can use to accomplish the given task.
Email Dossier is a tool designed to perform detailed investigations on email messages to verify their authenticity and trace their origin. It can analyze email headers and provide information about the route an email has taken, the servers it passed through, and potentially malicious links or origins. For an incident handler like Stenley, tasked with verifying the validity of emails and containing malicious email threats, Email Dossier serves as a practical tool for analyzing and validating emails received by employees. By using this tool, Stenley can identify fraudulent or suspicious emails, thereby helping to protect the organization from phishing attacks, malware distribution, and other email-based threats.
Which of the following methods help incident responders to reduce the false-positive
alert rates and further provide benefits of focusing on topmost priority issues reducing
potential risk and corporate liabilities?
Threat correlation is a method used by incident responders to analyze and associate various indicators of compromise (IoCs) and alerts to identify genuine threats. By correlating data from multiple sources and applying intelligence to distinguish between unrelated events and coordinated attack patterns, responders can significantly reduce the rate of false-positive alerts. This enables teams to prioritize their efforts on the most critical and likely threats, thereby reducing potential risks and corporate liabilities. Effective threat correlation involves the use of sophisticated security information and event management (SIEM) systems, threat intelligence platforms, and analytical techniques to identify relationships between seemingly disparate security events and alerts.
Clark is investigating a cybercrime at TechSoft Solutions. While investigating the case,
he needs to collect volatile information such as running services, their process IDs,
startmode, state, and status.
Which of the following commands will help Clark to collect such information from
running services?
WMIC (Windows Management Instrumentation Command-line) is a command-line tool that provides a unified interface for Windows management tasks, including the collection of system information. It allows administrators and forensic investigators to query the live system for information about running services, their process IDs, start modes, states, and statuses, among other data. The use of WMIC is particularly valuable in incident response scenarios for gathering volatile information from a system without having to install additional software, which might alter the state of the system being investigated. By executing specific WMIC commands, Clark can extract detailed information about the services running on a system at the time of the investigation, making it an essential tool for collecting volatile data in a forensically sound manner.
Shally, an incident handler, is working for a company named Texas Pvt. Ltd. based in
Florid
a. She was asked to work on an incident response plan. As part of the plan, she
decided to enhance and improve the security infrastructure of the enterprise. She has
incorporated a security strategy that allows security professionals to use several
protection layers throughout their information system. Due to multiple layer protection,
this security strategy assists in preventing direct attacks against the organization's
information system as a break in one layer only leads the attacker to the next layer.
Identify the security strategy Shally has incorporated in the incident response plan.
Shally has incorporated the Defense-in-depth strategy into the incident response plan for Texas Pvt. Ltd. Defense-in-depth is a layered security approach that involves implementing multiple security measures and controls throughout an information system. This strategy is designed to provide several defensive barriers to protect against threats and attacks, ensuring that if one layer is compromised, others still provide protection. The goal is to create a multi-faceted defense that addresses potential vulnerabilities in various areas, including physical security, network security, application security, and user education. Reference: The Incident Handler (ECIH v3) courses and study guides often emphasize the importance of a Defense-in-depth strategy in creating robust security infrastructures to protect against a wide range of cyber threats.
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Curtis
13 days agoDorothy
22 days agoDesirae
30 days agoAndree
1 months agoRosio
2 months agoArletta
2 months agoTeri
2 months agoAugustine
2 months agoQuiana
3 months agoTori
3 months agoKallie
3 months agoAlise
3 months agoMike
4 months agoStaci
4 months agoJulio
4 months agoAnnice
4 months agoAnnabelle
5 months agoElli
5 months agoCarisa
5 months agoEugene
5 months agoAdelina
5 months agoReed
6 months agoCecil
6 months agoPeggie
6 months agoMi
6 months agoLashonda
6 months agoCletus
7 months agoCharlesetta
7 months agoLanie
8 months agoAmos
8 months agoWilford
8 months agoBeckie
9 months agoAleta
9 months agoDaniel
10 months ago