ExamsLabs 212-89 Real Exam Question Answers Updated [Dec 05, 2025]
Easily To Pass New EC-COUNCIL 212-89 Dumps with 174 Questions
The EC-Council Certified Incident Handler (ECIH v2) certification exam is a valuable certification for individuals who work in the field of cybersecurity. 212-89 exam covers a range of topics that are essential for handling security incidents effectively. EC Council Certified Incident Handler (ECIH v3) certification is vendor-neutral, which makes it suitable for individuals who work in different environments and with different technologies. 212-89 exam is conducted by the EC-Council, a global leader in the field of cybersecurity, and is based on the latest industry standards and best practices.
NEW QUESTION # 24
Which of the following terms refers to an organization's ability to make optimal use of digital evidence in a limited period of time and with minimal investigation costs?
- A. Data analysis
- B. Forensic readiness
- C. Threat assessment
- D. Risk assessment
Answer: B
Explanation:
Forensic readiness refers to an organization's ability to maximize its capability to use digital evidence effectively in an investigation, while minimizing the cost of an investigation and disruption to its operations. It involves having policies, procedures, and technologies in place to collect, preserve, and analyze digital evidence efficiently, so when an incident occurs, the organization is prepared to handle it quickly and with minimal costs. Forensic readiness not only helps in reducing the time and resources spent on investigations but also ensures that the evidence is reliable and can be used in legal proceedings if necessary.References:The concept of forensic readiness is part of the Incident Handler (ECIH v3) curriculum, emphasizing the strategic importance of preparing for incidents in advance, including the preservation of evidence and the ability to conduct effective and efficient investigations.
NEW QUESTION # 25
Alice is a disgruntled employee. She decided to acquire critical information from her organization for financial benefit. To acccomplish this, Alice started running a virtual machine on the same physical host as her victim's virtual machine and took advantage of shared physical resources (processor cache) to steal data (cryptographic key/plain text secrets) from the victim machine. Identify the type of attack Alice is performing in the above scenario.
- A. Man-in-the-cloud attack
- B. Service hijacking
- C. Side channel attack
- D. SQL injection attack
Answer: C
NEW QUESTION # 26
Malicious downloads that result from malicious office documents being manipulated are caused by which of the following?
- A. Registry key manipulation
- B. Impersonation
- C. Macro abuse
- D. Click jacking
Answer: C
NEW QUESTION # 27
Miko was hired as an incident handler in XYZ company. His first task was to identify the PING sweep attempts inside the network. For this purpose, he used Wire shark to analyze the traffic.
What filter did he use to identify ICMP ping sweep attempts?
- A. tcp.type==icmp
- B. icmp.type==icmp
- C. icmp.type ==8 or icmp.type== 0
- D. udp.type== 7
Answer: C
NEW QUESTION # 28
Dash wants to perform a DoS attack over 256 target URLs simultaneously.
Which of the following tools can Dash employ to achieve his objective?
- A. HOIC
- B. Ollydbg
- C. Open VAS
- D. IDA Pro
Answer: A
NEW QUESTION # 29
Business continuity is defined as the ability of an organization to continue to function even after a disastrous event, accomplished through the deployment of redundant hardware and software, the use of fault tolerant systems, as well as a solid backup and recovery strategy. Identify the plan which is mandatory part of a business continuity plan?
- A. Sales and Marketing plan
- B. New business strategy plan
- C. Forensics Procedure Plan
- D. Business Recovery Plan
Answer: D
NEW QUESTION # 30
Malicious software programs that infect computers and com up to r delete the data on them.
The above-mentioned statement defines which of the following terms?
- A. Trojan
- B. Worm
- C. Spyware
- D. Virus
Answer: D
NEW QUESTION # 31
Oscar receives an email from an unknown source containing his domain name oscar.com. Upon checking the link, he found that it contains a malicious URL that redirects to the website evilsite.org. What type of vulnerability is this?
- A. Malware
- B. Bolen
- C. Unvalidated redirects and forwards
- D. SQL injection
Answer: C
Explanation:
The scenario described, where Oscar receives an email with a link that contains a malicious URL redirecting to evilsite.org, exemplifies a vulnerability related to unvalidated redirects and forwards. This type of vulnerability occurs when a web application accepts untrusted input that could cause the web application to redirect the request to a URL contained within untrusted input. Attackers can exploit this vulnerability by crafting a malicious URL that leads unsuspecting users to phishing sites or other malicious websites, under the guise of a legitimate domain. This is distinct from malware, which refers to malicious software; SQL injection, which involves inserting malicious SQL queries through input fields to manipulate or exploit databases; and is not a term related to cybersecurity vulnerabilities.References:The Incident Handler (ECIH v3) certification materials often cover web application vulnerabilities, including unvalidated redirects and forwards, emphasizing the need for proper validation and sanitization of user input to prevent such exploits.
NEW QUESTION # 32
Incidents are reported in order to:
- A. Be prepared for handling future incidents
- B. Provide stronger protection for systems and data
- C. All the above
- D. Deal properly with legal issues
Answer: C
NEW QUESTION # 33
An information security policy must be:
- A. Written in simple language
- B. Enforceable and Regularly updated
- C. Distributed and communicated
- D. All the above
Answer: D
NEW QUESTION # 34
A malicious, security-breaking program is disguised as a useful program. Such executable programs, which are installed when a file is opened, allow others to control a user's system. What is this type of program called?
- A. Virus
- B. Trojan
- C. Worm
- D. Spyware
Answer: B
Explanation:
A Trojan, short for Trojan horse, is a type of malicious software that misleads users of its true intent. It disguises itself as a legitimate and useful program, but once executed, it allows unauthorized access to the user's system. Unlike viruses and worms, Trojans do not replicate themselves but can be just as destructive.
They are often used to create a backdoor to a computer system, allowing an attacker to gain access to the system or to deliver other malware. Trojans can be used for a variety of purposes, including stealing information, downloading or uploading files, monitoring the user's screen and keyboard, and more. The term
"Trojan" comes from the Greek story of the wooden horse that was used to sneak soldiers into the city of Troy, which is analogous to the deceptive nature of this type of malware in cyber security.
References:The EC-Council's Certified Incident Handler (ECIH v3) program covers various types of malware, including Trojans, in detail, explaining their mechanisms, how they can be identified, and the steps to take in response to such threats.
NEW QUESTION # 35
During the vulnerability assessment phase, the incident responders perform various steps as below:
1. Run vulnerability scans using tools
2. Identify and prioritize vulnerabilities
3. Examine and evaluate physical security
4. Perform OSINT information gathering to validate the vulnerabilities
5. Apply business and technology context to scanner results
6. Check for misconfigurations and human errors
7. Create a vulnerability scan report
Identify the correct sequence of vulnerability assessment steps performed by the incident responders.
- A. 4-->1-->2-->3-->6-->5-->7
- B. 1-->3-->2-->4-->5-->6-->7
- C. 3-->6-->1-->2-->5-->4-->7
- D. 2-->1-->4-->7-->5-->6-->3
Answer: A
Explanation:
The correct sequence of steps performed by incident responders during the vulnerability assessment phase is as follows:
* Perform OSINT information gathering to validate the vulnerabilities (4):Initially, Open Source Intelligence (OSINT) is used to gather information about the organization's digital footprint and potential vulnerabilities.
* Run vulnerability scans using tools (1):Next, specialized tools are employed to scan the organization's networks and systems for vulnerabilities.
* Identify and prioritize vulnerabilities (2):The identified vulnerabilities are then analyzed and prioritized based on their severity and potential impact on the organization.
* Examine and evaluate physical security (3):Physical security assessments are also crucial as they can impact the overall security posture and protection of digital assets.
* Check for misconfigurations and human errors (6):This step involves looking for misconfigurations in systems and networks, as well as potential human errors that could lead to vulnerabilities.
* Apply business and technology context to scanner results (5):The results from the scans are evaluated within the context of the business and its technology environment to accurately assess risks.
* Create a vulnerability scan report (7):Finally, a comprehensive report is created, detailing the vulnerabilities, their severity, and recommended mitigation strategies.
This sequence ensures a thorough assessment, prioritizing vulnerabilities that pose the greatest risk and providing actionable insights for mitigation.
References:ECIH v3 courses and study guides elaborate on the vulnerability assessment process, detailing the steps involved in identifying, evaluating, and addressing security vulnerabilities within an organization's IT infrastructure.
NEW QUESTION # 36
Business continuity is defined as the ability of an organization to continue to function even after a disastrous
event, accomplished through the deployment of redundant hardware and software, the use of fault tolerant
systems, as well as a solid backup and recovery strategy. Identify the plan which is mandatory part of a
business continuity plan?
- A. Sales and Marketing plan
- B. New business strategy plan
- C. Forensics Procedure Plan
- D. Business Recovery Plan
Answer: D
NEW QUESTION # 37
Francis received a spoof email asking for his bank information. He decided to use a tool to analyze the email headers. Which of the following should he use?
- A. PoliteMail
- B. MxTooIbox
- C. Email Checker
- D. EventLog Analyzer
Answer: B
Explanation:
MxToolbox is a comprehensive tool designed for analyzing email headers and diagnosing various email delivery issues. When Francis received a spoofed email asking for his bank information, using MxToolbox to analyze the email headers would be appropriate. This tool helps in examining the source of the email, tracking the email's path across the internet from the sender to the receiver, and identifying any signs of email spoofing or malicious activity. It provides detailed information about the email servers encountered along the way and can help in verifying the authenticity of the email sender. Other options like EventLog Analyzer, Email Checker, and PoliteMail are tools used for different purposes such as analyzing system event logs, checking email address validity, and managing email communications, respectively, and do not specifically focus on analyzing email headers to the extent required for investigating a spoofed email incident.
References:The use of MxToolbox in incident handling and email security analysis is commonly recommended in Incident Handler (ECIH v3) study materials as a practical tool for email header analysis and spoofing investigation.
NEW QUESTION # 38
Your manager hands you several items of digital evidence and asks you to investigate them in the order of volatility. Which of the following is the MOST volatile?
- A. Disk
- B. Temp files
- C. Cache
- D. Emails
Answer: C
Explanation:
In the context of digital evidence investigation, volatility refers to how quickly data can change or be lost when power is removed or systems are altered. Among the options provided, cache is the most volatile because it is temporary storage that is designed to speed up access to data and is frequently overwritten. Cache data resides in RAM and includes things like memory buffers, system and network information, and process execution data, which are lost upon reboot or power loss. This contrasts with disks, emails, and temp files, which are considered less volatile because they are stored on permanent or semi-permanent media and are less likely to be immediately lost or overwritten.References:The Incident Handler (ECIH v3) curriculum includes principles of digital evidence handling, which emphasizes the importance of collecting evidence in descending order of volatility to ensure that the most ephemeral data is preserved before it's lost.
NEW QUESTION # 39
Your company holds a large amount of customer PH. and you want to protect those data from theft or unauthorized modification. Among other actions, you classify and encrypt the data. In this process, which of the following OWASP security risks are you guarding against?
- A. Broken authentication
- B. Insecure deserialization
- C. Sensitive data exposure
- D. Security misconfiguration
Answer: C
Explanation:
By classifying and encrypting customer Personally Identifiable Information (PHI), you are specifically guarding against the risk of Sensitive Data Exposure. This OWASP security risk involves the accidental or unlawful exposure of protected data to unauthorized individuals. Encryption serves as a critical defense mechanism by ensuring that, even if data is accessed without authorization, it remains unintelligible and useless to the attacker without the decryption keys. Data classification further supports this by identifying which data is sensitive and requires such protections, ensuring that appropriate security controls are applied to prevent exposure.
References:OWASP Top 10, a widely respected document that outlines the most critical web application security risks, identifies Sensitive Data Exposure as a key risk area. Incident Handler (ECIH v3) courses and study guides often refer to the OWASP Top 10 to explain common web security risks and appropriate countermeasures, including the importance of encrypting sensitive data.
NEW QUESTION # 40
Which of the following is an attack that attempts to prevent the use of systems, networks, or applications by the intended users?
- A. Denial of service (DoS) attack
- B. Unauthorized access
- C. Malicious code or insider threat attack
- D. Fraud and theft
Answer: A
NEW QUESTION # 41
The type of relationship between CSIRT and its constituency have an impact on the services provided by the CSIRT. Identify the level of the authority that enables members of CSIRT to undertake any necessary actions on behalf of their constituency?
- A. Full-level authority
- B. Shared-level authority
- C. Mid-level authority
- D. Half-level authority
Answer: A
NEW QUESTION # 42
Your company sells SaaS, and your company itself is hosted in the cloud (using it as a PaaS). In case of a malware incident in your customer's database, who is responsible for eradicating the malicious software?
- A. Your company
- B. The PaaS provider
- C. The customer
- D. Building management
Answer: A
Explanation:
In the scenario where your company sells Software as a Service (SaaS) and is hosted on the cloud using it as a Platform as a Service (PaaS), your company is responsible for eradicating malware in your customer's database. This is because, as the SaaS provider, your company manages the software and is responsible for its security and maintenance, including the databases that store customer data. While the PaaS provider is responsible for the underlying infrastructure, platform, and possibly some middleware security aspects, the application layer security, including data and application management, falls to the SaaS provider. Building management would not be involved in digital security matters, and while customers are responsible for their data, the actual software maintenance and security in a SaaS model are the provider's responsibility.
References:Incident Handler (ECIH v3) certification materials often discuss cloud service models (IaaS, PaaS, SaaS) and their associated security responsibilities, highlighting the importance of understanding who is responsible for what in cloud environments.
NEW QUESTION # 43
Alice is a disgruntled employee. She decided to acquire critical information from her organization for financial benefit. To acccomplish this, Alice started running a virtual machine on the same physical host as her victim's virtual machine and took advantage of shared physical resources (processor cache) to steal data (cryptographic key/plain text secrets) from the victim machine. Identify the type of attack Alice is performing in the above scenario.
- A. Man-in-the-cloud attack
- B. Service hijacking
- C. Side channel attack
- D. SQL injection attack
Answer: C
Explanation:
A side channel attack, as described in the scenario, involves an attacker using indirect methods to gather information from a system. In this case, Alice is exploiting the shared physical resources, specifically the processor cache, of a virtual machine host to steal data from another virtual machine on the same host. This type of attack does not directly breach the system through conventional means like breaking encryption but instead takes advantage of the information leaked by the physical implementation of the system, such as timing information, power consumption, electromagnetic leaks, or, as in this case, shared resource utilization, to infer the secret data.
References:The EC-Council's Certified Incident Handler (ECIH v3) program covers various types of cyber attacks, including advanced techniques like side channel attacks, highlighting the need for comprehensive security strategies that consider both direct and indirect attack vectors.
NEW QUESTION # 44
Rose is an incident-handling person and she is responsible for detecting and eliminating any kind of scanning attempts over the network by any malicious threat actors. Rose uses Wireshark tool to sniff the network and detect any malicious activities going on.
Which of the following Wireshark filters can be used by her to detect TCP Xmas scan attempt by the attacker?
- A. tcp.flags==0X000
- B. tcp.flags==0X029
- C. tcp.dstport==7
- D. tcp.flags.reset==1
Answer: B
Explanation:
A TCP Xmas scan is a type of network scanning technique used by attackers to identify open ports on a target machine. The name "Xmas" comes from the set of flags that are turned on within the packet, making it 'lit up like a Christmas tree'. Specifically, the FIN, PSH, and URG flags are set, which corresponds to the hexadecimal value 0X029 in the TCP header's flags field. Wireshark, a popular network protocol analyzer, allows users to create custom filters to detect specific types of network traffic, including malicious scanning attempts. By using the filtertcp.flags==0X029, Rose can detect packets that have these specific flags set, indicating a potential TCP Xmas scan attempt.
References:The technique of using Wireshark to detect specific types of scans, including the TCP Xmas scan, is covered in cybersecurity training materials and documentation related to network analysis and incident handling, such as those associated with the ECIH certification.
NEW QUESTION # 45
Investigator Ian gives you a drive image to investigate. What type of analysis are you performing?
- A. Live
- B. Real-time
- C. Dynamic
- D. Static
Answer: D
Explanation:
When Investigator Ian gives you a drive image to investigate, the type of analysis you are performing is static analysis. Static analysis involves examining the contents of a drive, file, or binary without executing the system or the application. It's about analyzing the data at rest. This type of analysis is crucial for forensics investigations because it allows for the examination of files, directories, and system information without altering any state or data, thereby preserving the integrity of the evidence. Static analysis is contrasted with dynamic analysis, which involves analyzing a system in operation (real-time or live) or executing the application to observe its behavior.
References:Incident Handler (ECIH v3) courses and study guides highlight the importance of static analysis in digital forensics, detailing methods for examining disk images, files, and other digital artifacts to gather evidence without compromising its integrity.
NEW QUESTION # 46
......
Latest 212-89 Study Guides 2025 - With Test Engine PDF: https://www.examslabs.com/EC-COUNCIL/ECIH-Certification/best-212-89-exam-dumps.html
Get New 212-89 Practice Test Questions Answers: https://drive.google.com/open?id=1oCdKIdqTk4MHxQDeuhA8PkXMWe8gVzAh