04 December, 2021

Renewal EC Council Certified Incident Handler (ECIH V2) 212-89 Free Practice Exam

Exam Code: 212-89 (Practice Exam Latest Test Questions VCE PDF)
Exam Name: EC Council Certified Incident Handler (ECIH v2)
Certification Provider: EC-Council
Free Today! Guaranteed Training- Pass 212-89 Exam.

Check 212-89 free dumps before getting the full version:

Page: 1 / 13

Total 163 questions Full Exam Access

Question 1

Multiple component incidents consist of a combination of two or more attacks in a system. Which of the following is not a multiple component incident?

An insider intentionally deleting files from a workstation

An attacker redirecting user to a malicious website and infects his system with Trojan

An attacker infecting a machine to launch a DDoS attack

An attacker using email with malicious code to infect internal workstation

Question 2

The main feature offered by PGP Desktop Email is:

Email service during incidents

End-to-end email communications

End-to-end secure email service

None of the above

Question 3

The USB tool (depicted below) that is connected to male USB Keyboard cable and not detected by antispyware tools is most likely called:
212-89 dumps exhibit

Software Key Grabber

Hardware Keylogger

USB adapter

Anti-Keylogger

Question 4

Risk management consists of three processes, risk assessment, mitigation and evaluation. Risk assessment determines the extent of the potential threat and the risk associated with an IT system through its SDLC. How many primary steps does NIST’s risk assessment methodology involve?

Twelve

Four

Six

Nine

Question 5

What command does a Digital Forensic Examiner use to display the list of all open ports and the associated IP addresses on a victim computer to identify the established connections on it:

“arp” command

“netstat –an” command

“dd” command

“ifconfig” command

Question 6

Which of the following is NOT a digital forensic analysis tool:

Access Data FTK

EAR/ Pilar

Guidance Software EnCase Forensic

Helix

Question 7

The goal of incident response is to handle the incident in a way that minimizes damage and reduces recovery time and cost. Which of the following does NOT constitute a goal of incident response?

Dealing with human resources department and various employee conflict behaviors.

Using information gathered during incident handling to prepare for handling future incidents in a better way and to provide stronger protection for systems and data.

Helping personal to recover quickly and efficiently from security incidents, minimizing loss or theft and disruption of services.

Dealing properly with legal issues that may arise during incidents.

Question 8

The program that helps to train people to be better prepared to respond to emergency situations in their communities is known as:

Community Emergency Response Team (CERT)

Incident Response Team (IRT)

Security Incident Response Team (SIRT)

All the above

Question 9

In a qualitative risk analysis, risk is calculated in terms of:

(Attack Success + Criticality ) –(Countermeasures)

Asset criticality assessment – (Risks and Associated Risk Levels)

Probability of Loss X Loss

(Countermeasures + Magnitude of Impact) – (Reports from prior risk assessments)

Question 10

Based on the some statistics; what is the typical number one top incident?

Phishing

Policy violation

Un-authorized access

Malware

Question 11

Digital evidence plays a major role in prosecuting cyber criminals. John is a cyber-crime investigator, is asked to investigate a child pornography case. The personal computer of the criminal in question was confiscated by the county police. Which of the following evidence will lead John in his investigation?

SAM file

Web serve log

Routing table list

Web browser history

Question 12

Which is the incorrect statement about Anti-keyloggers scanners:

Detect already installed Keyloggers in victim machines

Run in stealthy mode to record victims online activity

Software tools

Question 13

The steps followed to recover computer systems after an incident are:

System restoration, validation, operation and monitoring

System restoration, operation, validation, and monitoring

System monitoring, validation, operation and restoration

System validation, restoration, operation and monitoring

Question 14

The role that applies appropriate technology and tries to eradicate and recover from the incident is known as:

Incident Manager

Incident Analyst

Incident Handler

Incident coordinator

Question 15

A threat source does not present a risk if NO vulnerability that can be exercised for a particular threat source. Identify the step in which different threat sources are defined:
212-89 dumps exhibit

Identification Vulnerabilities

Control analysis

Threat identification

System characterization

Question 16

A software application in which advertising banners are displayed while the program is running that delivers ads to display pop-up windows or bars that appears on a computer screen or browser is called:

adware (spelled all lower case)

Trojan

RootKit

Virus

Worm

Question 17

The region where the CSIRT is bound to serve and what does it and give service to is known as:

Consistency

Confidentiality

Constituency

None of the above

Question 18

Identify the malicious program that is masked as a genuine harmless program and gives the attacker unrestricted access to the user’s information and system. These programs may unleash dangerous programs that may erase the unsuspecting user’s disk and send the victim’s credit card numbers and passwords to a stranger.

Cookie tracker

Worm

Trojan

Virus

Page: 1 / 13

Total 163 questions Full Exam Access