시험덤프
매달, 우리는 1000명 이상의 사람들이 시험 준비를 잘하고 시험을 잘 통과할 수 있도록 도와줍니다.
 홈 / 212-89 덤프  / 212-89 문제 연습

EC-Council 212-89 시험

EC Council Certified Incident Handler (ECIH v2) 온라인 연습

최종 업데이트 시간: 2026년02월14일

당신은 온라인 연습 문제를 통해 EC-Council 212-89 시험지식에 대해 자신이 어떻게 알고 있는지 파악한 후 시험 참가 신청 여부를 결정할 수 있다.

시험을 100% 합격하고 시험 준비 시간을 35% 절약하기를 바라며 212-89 덤프 (최신 실제 시험 문제)를 사용 선택하여 현재 최신 163개의 시험 문제와 답을 포함하십시오.

 / 11

Question No : 1


An organization named Sam Morison Inc. decided to use cloud-based services to reduce the cost of maintenance. The organization identified various risks and threats associated with cloud service adoption and migrating business-critical data to third-party systems. Hence, the organization decided to deploy cloud-based security tools to prevent upcoming threats.
Which of the following tools help the organization to secure the cloud resources and services?

정답:
Explanation:
Alert Logic is a cloud-based security tool that provides Security-as-a-Service solutions including threat management, vulnerability assessment, and improved security outcomes. It is designed specifically to secure cloud resources and services, making it an ideal choice for organizations like Sam Morison Inc. that are moving their operations to the cloud and are concerned about the security of their data. Tools like Nmap, Burp Suite, and Wireshark, while valuable in certain contexts, do not offer the same cloud-focused security capabilities as Alert Logic.

Question No : 2


Which of the following is not a countermeasure to eradicate cloud security incidents?

정답:
Explanation:
Disabling security options such as two-factor authentication (2FA) and CAPTCHA is not a countermeasure to eradicate cloud security incidents. In fact, it is contrary to best security practices. 2FA adds an additional layer of security by requiring two forms of verification before granting access to an account or system. CAPTCHA helps prevent automated attacks by ensuring that the entity accessing the service is human. Both are important security measures that protect against unauthorized access and automated attacks, thereby enhancing cloud security.

Question No : 3


Create a vulnerability scan report
Identify the correct sequence of vulnerability assessment steps performed by the incident responders.

정답:
Explanation:
The correct sequence of steps performed by incident responders during the vulnerability assessment phase is as follows:
Perform OSINT information gathering to validate the vulnerabilities (4): Initially, Open Source Intelligence (OSINT) is used to gather information about the organization’s digital footprint and potential vulnerabilities.
Run vulnerability scans using tools (1): Next, specialized tools are employed to scan the organization's networks and systems for vulnerabilities.
Identify and prioritize vulnerabilities (2): The identified vulnerabilities are then analyzed and prioritized based on their severity and potential impact on the organization.
Examine and evaluate physical security (3): Physical security assessments are also crucial as they can impact the overall security posture and protection of digital assets.
Check for misconfigurations and human errors (6): This step involves looking for misconfigurations in systems and networks, as well as potential human errors that could lead to vulnerabilities.
Apply business and technology context to scanner results (5): The results from the scans are evaluated within the context of the business and its technology environment to accurately assess risks.
Create a vulnerability scan report (7): Finally, a comprehensive report is created, detailing the vulnerabilities, their severity, and recommended mitigation strategies.
This sequence ensures a thorough assessment, prioritizing vulnerabilities that pose the greatest risk and providing actionable insights for mitigation.
Reference: ECIH v3 courses and study guides elaborate on the vulnerability assessment process, detailing the steps involved in identifying, evaluating, and addressing security vulnerabilities within an organization's IT infrastructure.

Question No : 4


If a hacker cannot find any other way to attack an organization, they can influence an employee or a disgruntled staff member.
What type of threat is this?

정답:
Explanation:
If a hacker influences an employee or a disgruntled staff member to gain access to an organization's resources or sensitive information, this is classified as an insider attack. Insider attacks are perpetrated by individuals within the organization, such as employees, contractors, or business associates, who have inside information concerning the organization's security practices, data, and computer systems. The threat from insiders can be intentional, as in the case of a disgruntled employee seeking to harm the organization, or unintentional, where an employee is manipulated or coerced by external parties without realizing the implications of their actions. Phishing attacks, foot printing, and identity theft represent different types of cybersecurity threats where the attacker's method or objective differs from that of insider attacks.
Reference: The ECIH v3 certification program addresses various types of threats, including insider threats, emphasizing the importance of recognizing and mitigating risks posed by individuals within the organization.

Question No : 5


Which of the following is a term that describes the combination of strategies and services intended to restore data, applications, and other resources to the public cloud or dedicated service providers?

정답:
Explanation:
The term that describes the combination of strategies and services intended to restore data, applications, and other resources to the public cloud or dedicated service providers is "Cloud recovery." This term encompasses disaster recovery efforts focused on ensuring that an organization's digital assets can be quickly and effectively restored or moved to cloud environments in the event of data loss, system failure, or a disaster. Cloud recovery strategies are part of a broader disaster recovery and business continuity planning, ensuring minimal downtime and data loss by leveraging cloud computing's scalability and flexibility. Mitigation, analysis, and eradication are terms associated with other aspects of incident response and risk management, not specifically with the restoration of resources to cloud environments.
Reference: The Incident Handler (ECIH v3) curriculum includes discussions on disaster recovery and business continuity planning, highlighting cloud recovery as a vital component of ensuring organizational resilience against disruptions.

Question No : 6


Racheal is an incident handler working in Inception Tech organization. Recently, numerous employees are complaining about receiving emails from unknown senders. In order to prevent employees against spoofing emails and keeping security in mind, Racheal was asked to take appropriate actions in this matter. As a part of her assignment, she needs to analyze the email headers to check the authenticity of received emails.
Which of the following protocol/authentication standards she must check in email header to analyze the email authenticity?

정답:
Explanation:
Racheal should check for DKIM (DomainKeys Identified Mail) in the email headers to analyze the authenticity of received emails. DKIM is an email authentication method designed to detect email spoofing. It provides a way for the receiver to check that an email claimed to have come from a specific domain was indeed authorized by the owner of that domain. It achieves this by affixing a digital signature, linked to a domain name, to each outgoing email message. The recipient can verify this signature to confirm that the email was not altered during its transmission and that it indeed comes from the specified domain, thereby helping to prevent email spoofing. Other options like SNMP (Simple Network Management Protocol), POP (Post Office Protocol), and ARP (Address Resolution Protocol) are not directly related to email authenticity checks.
Reference: Incident Handler (ECIH v3) certification materials cover various protocols and standards for ensuring the security and authenticity of communications, including email security protocols like DKIM.

Question No : 7


SWA Cloud Services added PKI as one of their cloud security controls.
What does PKI stand for?

정답:
Explanation:
Public Key Infrastructure (PKI) is a framework used to manage digital certificates and public-key encryption. It enables secure electronic transfer of information for a range of network activities such as e-commerce, internet banking, and confidential email. PKI is fundamental to the management of encryption keys and digital certificates, ensuring the secure exchange of data over networks and verification of identity.
Reference: The ECIH v3 program covers the importance of PKI in cloud security controls, emphasizing its role in establishing and maintaining a secure cloud computing environment.

Question No : 8


What is the most recent NIST standard for incident response?

정답:
Explanation:
As of my last update, the most recent NIST standard for incident response was NIST Special Publication 800-61 Revision 2 (800-61r2), titled "Computer Security Incident Handling Guide." This document provides guidelines for establishing an effective incident response program, including preparation, detection and analysis, containment, eradication, recovery, and post-incident activity.
Reference: The document is a key resource in the field of incident response, frequently cited in the ECIH v3 curriculum for its comprehensive guidelines on managing and responding to cybersecurity incidents.

Question No : 9


Which of the following has been used to evade IDS and IPS?

정답:
Explanation:
Fragmentation is a technique used by attackers to evade detection by Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS). By breaking down packets into smaller fragments, attackers can make it more difficult for these security systems to detect malicious payloads or signature-based patterns associated with known attacks. This method exploits the fact that some IDS/IPS solutions may not properly reassemble packet fragments for analysis, thereby allowing malicious fragments to pass through undetected.
Reference: In its coverage of network security mechanisms and evasion techniques, the ECIH v3 certification details how attackers exploit vulnerabilities in the implementation of IDS and IPS systems, including the use of packet fragmentation.

Question No : 10


Which of the following is a technique used by attackers to make a message difficult to understand through the use of ambiguous language?

정답:
Explanation:
Obfuscation is a technique used to make data or code difficult to understand. It is often employed by attackers to conceal the true intent of their code or communications, making it harder for security professionals, automated tools, and others to analyze or detect malicious activity. Obfuscation can involve the use of ambiguous or misleading language, as well as more technical methods such as encoding, encryption, or the use of nonsensical variable names in source code to hide its true functionality.
Reference: The ECIH v3 program discusses various techniques attackers use to evade detection, including obfuscation, highlighting how it complicates the analysis and understanding of malicious payloads.

Question No : 11


Ren is assigned to handle a security incident of an organization. He is tasked with forensics investigation to find the evidence needed by the management.
Which of the following steps falls under the investigation phase of the computer forensics investigation process?

정답:
Explanation:
Evidence assessment is a critical step in the investigation phase of the computer forensics process. This step involves evaluating the evidence collected to determine its relevance and significance to the case at hand. It includes analyzing the secured data to identify what information can be used as evidence, its integrity, and how it can be related to the security incident. This phase is pivotal as it helps in building a coherent understanding of the incident and in establishing facts that can be presented in management reports or legal proceedings.
Reference: The Certified Incident Handler (ECIH v3) by EC-Council includes a comprehensive discussion on the computer forensics investigation process, detailing steps from securing evidence to analyzing and assessing it within the context of an investigation.

Question No : 12


Alexis works as an incident responder at XYZ organization. She was asked to identify and attribute the actors behind an attack that occurred recently. For this purpose, she is performing a type of threat attribution that deals with the identification of a specific person, society, or country sponsoring a well-planned and executed intrusion or attack on its target.
Which of the following types of threat attributions is Alexis performing?

정답:
Explanation:
Nation-state attribution involves identifying a specific country or government as the sponsor behind a cyber-attack or intrusion. This type of threat attribution is focused on determining the involvement of state actors in cyber operations against specific targets, which often involves sophisticated, well-planned, and executed cyber campaigns. Alexis's efforts to identify and attribute the actors behind the attack to a specific nation-state fall under this category, as she seeks to uncover the geopolitical motives and the extent of state sponsorship behind the incident. Nation-state attribution requires analyzing a variety of indicators, including technical evidence, tactics, techniques, and procedures (TTPs), and contextual intelligence. This is distinct from campaign attribution, which focuses on linking attacks to a specific campaign or operation, true attribution, which aims at identifying the actual individuals behind an attack, and intrusion set attribution, which involves attributing a set of malicious activities to a particular threat actor or group.
Reference: The Incident Handler (ECIH v3) certification program includes discussions on various types of threat attributions, highlighting the challenges and methodologies involved in attributing cyber-attacks to specific actors, including nation-states.

Question No : 13


Oscar receives an email from an unknown source containing his domain name oscar.com. Upon checking the link, he found that it contains a malicious URL that redirects to the website evilsite.org.
What type of vulnerability is this?

정답:
Explanation:
The scenario described, where Oscar receives an email with a link that contains a malicious URL redirecting to evilsite.org, exemplifies a vulnerability related to unvalidated redirects and forwards. This type of vulnerability occurs when a web application accepts untrusted input that could cause the web application to redirect the request to a URL contained within untrusted input. Attackers can exploit this vulnerability by crafting a malicious URL that leads unsuspecting users to phishing sites or other malicious websites, under the guise of a legitimate domain. This is distinct from malware, which refers to malicious software; SQL injection, which involves inserting malicious SQL queries through input fields to manipulate or exploit databases; and is not a term related to cybersecurity vulnerabilities.
Reference: The Incident Handler (ECIH v3) certification materials often cover web application vulnerabilities, including unvalidated redirects and forwards, emphasizing the need for proper validation and sanitization of user input to prevent such exploits.

Question No : 14


Investigator Ian gives you a drive image to investigate.
What type of analysis are you performing?

정답:
Explanation:
When Investigator Ian gives you a drive image to investigate, the type of analysis you are performing is static analysis. Static analysis involves examining the contents of a drive, file, or binary without executing the system or the application. It's about analyzing the data at rest. This type of analysis is crucial for forensics investigations because it allows for the examination of files, directories, and system information without altering any state or data, thereby preserving the integrity of the evidence. Static analysis is contrasted with dynamic analysis, which involves analyzing a system in operation (real-time or live) or executing the application to observe its behavior.
Reference: Incident Handler (ECIH v3) courses and study guides highlight the importance of static analysis in digital forensics, detailing methods for examining disk images, files, and other digital artifacts to gather evidence without compromising its integrity.

Question No : 15


Which of the following tools helps incident responders effectively contain a potential cloud security incident and gather required forensic evidence?

정답:
Explanation:
Cloud Passage Halo is a security platform designed to provide comprehensive visibility and protection for cloud environments, making it an effective tool for incident responders dealing with potential cloud security incidents. It offers capabilities for detecting, responding to, and containing threats across public, private, and hybrid cloud environments. With features like automated security policies, compliance monitoring, and threat detection, Cloud Passage Halo enables incident responders to quickly contain incidents and gather the required forensic evidence to investigate the scope and impact of a breach or security issue. Tools like Alert Logic and Qualys Cloud Platform also provide security and compliance solutions for cloud environments, but Cloud Passage Halo is specifically recognized for its robust incident response and containment capabilities.
Reference: The Incident Handler (ECIH v3) certification materials and courses discuss various tools and technologies that support cloud security incident response, including the role of platforms like Cloud Passage Halo in effective incident management.

 / 11
EC-Council