100% Pass Guaranteed Accurate 212-89 Answers 365 Days Free Updates
212-89 DUMPS Q&As with Explanations Verified & Correct Answers
Prerequisites
The target candidates for the EC-Council 212-89 exam are the risk assessment administrators, penetration testers, cyber forensic investigators, incident handlers, venerability assessment auditors, firewall administrators, system engineers, network managers, system administrators, IT managers, and other IT professionals looking to gain validation for their skills in incident handling & response.
Please note that you are required to fulfill one prerequisite before going for the exam. You need to complete the ECIH training course, which can be taken as the instructor-led option, academia studying, or online learning. Those candidates who opt for self-study must possess at least one year of practical work experience in the domain of information security. Also, you are required to submit a completed eligibility form to get approval to take the test.
The ECIH v2 certification exam is an excellent choice for cybersecurity professionals who want to demonstrate their ability to handle and respond to various types of cybersecurity incidents. EC Council Certified Incident Handler (ECIH v3) certification exam is designed to provide individuals with the necessary skills and knowledge to effectively identify, contain, and respond to cyber threats. EC Council Certified Incident Handler (ECIH v3) certification is also ideal for individuals who want to advance their careers in the cybersecurity industry and demonstrate their expertise and commitment to the field.
NEW QUESTION # 181
Stanley works as an incident responder at a top MNC based in Singapore. He was asked to investigate a cybersecurity incident that recently occurred in the company. While investigating the incident, he collected evidence from the victim systems. He must present this evidence in a clear and comprehensible manner to the members of a jury so that the evidence clarifies the facts and further helps in obtaining an expert opinion on the incident to confirm the investigation process. In the above scenario, which of the following characteristics of the digital evidence did Stanley attempt to preserve?
- A. Completeness
- B. Believability
- C. Authenticity
- D. Admissibility
Answer: D
Explanation:
In the scenario described, Stanley's effort to present evidence in a clear and comprehensible manner to the members of a jury, with the intention of clarifying facts and aiding in obtaining expert opinion, aligns with the characteristic of admissibility. The admissibility of digital evidence pertains to its acceptability in a court of law, which hinges on the evidence being collected, handled, and presented in a manner that complies with legal standards and procedures. This includes ensuring the evidence is relevant, reliable, and not overly prejudicial. By preparing to present the evidence in a way that the jury can understand and use to confirm the investigation process, Stanley is focusing on ensuring that the evidence meets the criteria for admissibility in the legal proceedings. Completeness, believability, and authenticity are also important characteristics of digital evidence, but the context provided indicates that Stanley's primary focus is on meeting the legal requirements for the evidence to be considered valid in court.References:The Incident Handler (ECIH v3) certification materials cover the legal aspects of incident response, including the importance of ensuring the admissibility of evidence in legal proceedings as a fundamental objective of the evidence collection and presentation process.
NEW QUESTION # 182
Robert is an incident handler working for X security Inc. One day, his organization faced a massive cyberattack and all of the websites related to the organization went offline. Robert was on duty during the incident and he was responsible for handling the incident and maintaining business continuity. He immediately restored the web application service with the help of the existing backups.
According to the scenario, which of the following stages of incident handling and response (IH&R) process did Robert perform?
- A. Recovery
- B. Not if cation
- C. Eradication
- D. Evidence gathering and forensics analysis
Answer: A
NEW QUESTION # 183
Darwin is an attacker residing within the organization and is performing network sniffing by running his system in promiscuous mode. He is capturing and viewing all the network packets transmitted within the organization. Edwin is an incident handler in the same organization.
In the above situation, which of the following Nmap commands Edwin must use to detect Darwin's system that is running in promiscuous mode?
- A. nmap --script=sniffer-detect [Target IP Address/Range of IP addresses]
- B. nmap --script hostmap
- C. nmap -sU -p 500
- D. nmap -sV -T4 -O -F -version-light
Answer: A
Explanation:
The GPG18 and Forensic readiness planning (SPF) principles outline various guidelines to enhance an organization's readiness for forensic investigation and response. Principle 5, which suggests that organizations should adopt a scenario-based Forensic Readiness Planning approach that learns from experience gained within the business, emphasizes the importance of being prepared for a wide range of potential incidents by leveraging lessons learned from past experiences. This approach helps in continuously improving forensic readiness and response capabilities by adapting to the evolving threat landscape and organizational changes.
References:While specific documentation from GPG18 and SPF might detail these principles, the ECIH v3 program by EC-Council covers the concept of forensic readiness planning, including adopting scenario-based approaches and learning from past incidents as a fundamental aspect of enhancing an organization's incident response and forensic capabilities.
NEW QUESTION # 184
In an international bank, the IT security team identified unusual network traffic indicating a potential malware infection. Further analysis revealed that several high-value transaction servers were communicating with an external command and control server. The team needs to decide the immediate action to best handle this malware incident triage. What should they prioritize to mitigate the threat and safeguard sensitive data effectively?
- A. Disconnecting the affected servers from the network to prevent further data exfiltration
- B. Immediately updating antivirus signatures on all network devices and servers
- C. Performing a memory dump of the affected servers for in-depth forensic analysis
- D. Initiating a controlled shutdown of the transaction servers to preserve their current state
Answer: A
Explanation:
This scenario describes an active malware infection with confirmed command-and-control (C2) communication, which represents an immediate and severe risk to sensitive financial data.
According to the EC-Council ECIH malware incident handling process, the first priority in such cases is containment, specifically stopping ongoing malicious activity and preventing further data exfiltration.
Option A is correct because disconnecting the affected servers from the network immediately severs the attacker's control channel and halts outbound data leakage. ECIH emphasizes that when C2 traffic is observed, responders must act decisively to isolate compromised systems before pursuing deeper forensic analysis or remediation. Containment minimizes damage and reduces legal, financial, and reputational impact.
Option B may preserve system state but allows continued exfiltration until shutdown is complete and may disrupt critical banking operations. Option C is a preventive measure and does not stop an active infection. Option D is valuable for investigation but should occur after containment, not before.
ECIH guidance consistently prioritizes stopping harm over gathering evidence when critical assets are at risk. Therefore, immediate network disconnection of affected servers is the correct triage action.
NEW QUESTION # 185
Jason is an incident handler dealing with malware incidents. He was asked to perform memory dump analysis in order to collect the information about the basic functionality of any program. As a part of his assignment, he needs to perform string search analysis to search for the malicious string that could determine harmful actions that a program can perform. Which of the following string-searching tools Jason needs to use to do the intended task?
- A. Process Explorer
- B. PEView
- C. BinText
- D. Dependency Walker
Answer: C
NEW QUESTION # 186
Logan, a network security analyst, notices a pattern of repeated ICMP echo requests being sent to a broad range of IP addresses within the company's internal subnet. To confirm his suspicion of a possible reconnaissance attempt, he opens Wireshark and starts analyzing the traffic for unusual scanning behavior.
What technique is most likely being used by the attacker?
- A. SYN flooding
- B. Ping sweep
- C. DNS poisoning
- D. Port scanning
Answer: B
Explanation:
The described activity-ICMP echo requests sent sequentially across many IP addresses-is a classic ping sweep, a reconnaissance technique used to identify live hosts on a network. ECIH network incident handling identifies reconnaissance as an early-stage attack activity that often precedes exploitation.
Option B is correct because ping sweeps use ICMP echo requests to determine which hosts respond, allowing attackers to map the network. This aligns exactly with the observed traffic.
Option A involves DNS manipulation. Option C involves probing TCP/UDP ports rather than ICMP. Option D describes a denial-of-service technique, not reconnaissance.
Recognizing reconnaissance activity early allows defenders to implement controls before exploitation occurs, aligning with ECIH detection and prevention guidance.
NEW QUESTION # 187
In which of the following stages of the incident handling and response (IH&R) process do the incident handlers try to find the root cause of the incident along with the threat actors behind the incidents, threat vectors, etc.?
- A. Post-incident activities
- B. Incident recording and assignment
- C. Incident triage
- D. Evidence gathering and forensics analysis
Answer: D
Explanation:
In the evidence gathering and forensics analysis stage, incident handlers focus on identifying the root cause of the incident, determining the threat actors involved, understanding the threat vectors, and analyzing the details surrounding the incident. This phase is crucial for identifying how the attack occurred, who was responsible, and what methods were used, allowing for more effective containment, mitigation, and future prevention strategies.
NEW QUESTION # 188
Bob, an incident responder at CyberTech Solutions, is investigating a cybercrime attack occurred in the client company. He acquired the evidence data, preserved it, and started performing analysis on acquired evidentiary data to identify the source of the crime and the culprit behind the incident.
Identify the forensic investigation phase in which Bob is currently in.
- A. Post-investigation phase
- B. Investigation phas
- C. Vulnerability assessment phase
- D. Pre-investigation phase
Answer: B
Explanation:
Bob is in the Investigation phase of the forensic investigation process. This phase involves the detailed examination and analysis of the collected evidence to identify the source of the crime and the perpetrator behind the incident. It is a crucial step that follows the acquisition and preservation of evidence, where the incident responder applies various techniques and methodologies to analyze the evidentiary data. This analysis aims to uncover how the cybercrime was committed, trace the activities of the culprit, and gather actionable intelligence to support legal actions and prevent future incidents.
NEW QUESTION # 189
At a major healthcare provider, staff received phishing emails impersonating HR. Reporting via email failed due to mail system issues. The IR team introduced VOIP and SMS-based reporting mechanisms. Which preparatory step was implemented?
- A. Training on phishing indicators
- B. Creating backup archives
- C. Email content filtering
- D. Establishing out-of-band communication
Answer: D
Explanation:
Comprehensive and Detailed Explanation (ECIH-aligned):
This scenario highlights a preparation phase improvement. ECIH strongly emphasizes the importance of out- of-band communication during incidents, especially when primary systems are compromised.
Option D is correct because VOIP and SMS reporting channels allow incident reporting even when email systems are unavailable or under attack. ECIH identifies out-of-band communication as critical for maintaining coordination and timely escalation during incidents.
Options A-C do not address the reporting failure described.
Establishing alternate communication channels strengthens incident readiness and response resilience, aligning directly with ECIH best practices.
NEW QUESTION # 190
Elena, a first responder at a multinational firm, receives multiple reports from employees claiming they were asked to update their payroll information through an email that appears to be from HR. The email includes a URL directing users to a login page identical to the company's intranet but hosted on an unfamiliar domain.
Elena immediately informs the IH&R team, preserves the email headers, captures screenshots of the spoofed page, and blocks the domain at the network level. What type of email security incident is Elena handling?
- A. Mail storm attack
- B. Deceptive phishing attack
- C. DNS cache poisoning
- D. Email spamming
Answer: B
Explanation:
This scenario is a clear example of a deceptive phishing attack, which is extensively covered in the ECIH Email Security Incident module. Deceptive phishing involves impersonating a trusted internal entity-such as HR-to trick recipients into disclosing sensitive information like credentials or personal data.
Option D is correct because the email impersonates HR, uses social engineering, and directs users to a visually identical but fraudulent login page hosted on an unfamiliar domain. These characteristics are classic indicators of deceptive phishing.
Option A refers to DNS manipulation and is not evidenced here. Option B involves overwhelming email volume rather than deception. Option C refers to unsolicited bulk email without impersonation.
Elena's actions align with ECIH best practices: preserving headers for forensic validation, capturing screenshots to document fraudulent infrastructure, and blocking malicious domains to prevent further exposure. Correctly categorizing the incident as deceptive phishing ensures appropriate eradication, awareness, and reporting measures.
NEW QUESTION # 191
Electronic evidence may reside in the following:
- A. Backup tapes
- B. All the above
- C. Data Files
- D. Other media sources
Answer: B
NEW QUESTION # 192
Racheal is an incident handler working in InceptionTech organization. Recently, numerous employees are complaining about receiving emails from unknown senders. In order to prevent employees against spoofing emails and keeping security in mind, Racheal was asked to take appropriate actions in this matter. As a part of her assignment, she needs to analyze the email headers to check the authenticity of received emails.
Which of the following protocol/authentication standards she must check in email header to analyze the email authenticity?
- A. DKIM
- B. ARP
- C. POP
- D. SNMP
Answer: A
Explanation:
Racheal should check for DKIM (DomainKeys Identified Mail) in the email headers to analyze the authenticity of received emails. DKIM is an email authentication method designed to detect email spoofing. It provides a way for the receiver to check that an email claimed to have come from a specific domain was indeed authorized by the owner of that domain. It achieves this by affixing a digital signature, linked to a domain name, to each outgoing email message. The recipient can verify this signature to confirm that the email was not altered during its transmission and that it indeed comes from the specified domain, thereby helping to prevent email spoofing. Other options like SNMP (Simple Network Management Protocol), POP (Post Office Protocol), and ARP (Address Resolution Protocol) are not directly related to email authenticity checks.References:Incident Handler (ECIH v3) certification materials cover various protocols and standards for ensuring the security and authenticity of communications, including email security protocols like DKIM.
NEW QUESTION # 193
Rinni is an incident handler and she is performing memory dump analysis.
Which of following tools she can use in order to perform memory dump analysis?
- A. OllyDbg and IDA Pro
- B. Scylla and OllyDumpEx
- C. iNetSim
- D. Procmon and ProcessExplorer
Answer: A
Explanation:
For memory dump analysis, tools like Scylla and OllyDumpEx are more suited. These tools are designed to analyze and extract information from memory dumps, which can be crucial for understanding the state of a system at the time of an incident. Scylla is used for reconstructing imports in dumped binaries, while OllyDumpEx is an OllyDbg plugin used for dumping process memory. Both tools are valuable for incident handlers like Rinni who are performing memory dump analysis to uncover evidence or understand the behavior of malicious software.
NEW QUESTION # 194
Which one of the following is the correct flow of the stages in an incident handling and response (IH&R) process?
- A. Incident triage -* Eradication - Containment -* Incident recording -* Preparation -* Recovery
-* Post-incident activities - B. Containment -* Incident recording -* Incident triage -> Preparation -* Recovery -> Eradication -* Post-incident activities
- C. Preparation -* Incident recording -> Incident triage -* Containment -* Eradication -* Recovery
-* Post-incident activities - D. Incident recording -> Preparation -> Containment * Incident triage -> Recovery > Eradication -* Post-incident activities
Answer: C
Explanation:
The correct flow of stages in an Incident Handling and Response (IH&R) process as outlined in the Incident Handler (ECIH v3) by EC-Council begins with Preparation. This phase involves getting ready for potential incidents by developing plans, policies, and procedures, and ensuring that tools and team training are up to date. Incident Recording is the next stage, where incidents are documented and reported. Incident Triage follows, prioritizing incidents based on their impact and urgency. Containment is next, aiming to limit the damage of the incident and prevent further spread. Eradication comes after containment, where the root cause of the incident is removed. Recovery is the stage where affected systems are restored to their operational status. Post-Incident Activities conclude the process, reviewing and learning from the incident to improve future response efforts.
References:This structured approach is foundational in the ECIH v3 program, ensuring that incident handlers are prepared to systematically address and manage cybersecurity incidents efficiently.
NEW QUESTION # 195
While handling and responding to a potential web application security incident, you are required to conduct a vulnerability scan of your website. As an EC-Council Certified Incident Handler(ECIH), which of the following steps is NOT part of the process of performing web application vulnerability scanning using Acunetix Web Vulnerability Scanner(WVS)?
- A. Use the built-in HTTP Editor and HTTP Fuzzer of Acunetix WVS to manually test and validate potential vulnerabilities before scanning.
- B. After scanning, view vulnerabilities, analyze their details, and formulate a plan to fix them.
- C. Perform a full scan, select OWASP Top 10 2017 from the report, and schedule the scan instantly.
- D. Install Acunetix WVS on a Windows 10 virtual machine and log in with the provided credentials.
Answer: A
NEW QUESTION # 196
Which of the following is a risk assessment tool:
- A. Nessus
- B. Wireshark
- C. CRAMM
- D. Nmap
Answer: C
NEW QUESTION # 197
An employee reports that their company-issued smartphone was stolen, which contained sensitive company data. What is the first step in the incident response process for handling this mobile-based security incident?
- A. Locate the stolen smartphone using its CPS tracking feature
- B. Notify the affected employee's supervisor and senior management
- C. Change the affected employee's login credentials and passwords
- D. Remotely wipe the data from the stolen smartphone
Answer: D
NEW QUESTION # 198
Which of the following details are included in the evidence bags?
- A. Error messages that contain sensitive information and files containing passwords
- B. Date and time of seizure, exhibit number, and name of incident responder
- C. Sensitive directories, personal, and organizational email address
- D. Software version information and web application source code
Answer: B
NEW QUESTION # 199
Malicious downloads that result from malicious office documents being manipulated are caused by which of the following?
- A. Click jacking
- B. Macro abuse
- C. Impersonation
- D. Registry key manipulation
Answer: B
NEW QUESTION # 200
Francis is an incident handler and security expert. He works at MorisonTech Solutions based in Sydney, Australia. He was assigned a task to detect phishing/spam mails for the client organization.
Which of the following tools can assist Francis to perform the required task?
- A. Nessus
- B. Netcraft
- C. BTCrack
- D. Cain and Abel
Answer: B
Explanation:
Netcraft is a tool that provides internet security services, including the detection of phishing and spam emails.
It offers a range of services that can help organizations identify fraudulent websites and phishing activities by analyzing web content and email messages for known phishing signatures and heuristics. This makes it a useful tool for incident handlers like Francis, who is tasked with detecting phishing and spam emails for client organizations. Other options listed, such as Nessus (a vulnerability scanner), BTCrack (a Bluetooth pin and link-key cracker), and Cain and Abel (a password recovery tool), do not specialize in detecting phishing or spam emails but serve different purposes in cybersecurity.
References:The Incident Handler (ECIH v3) curriculum includes discussions on tools and methodologies for detecting and mitigating various cyber threats, including phishing and spam, highlighting tools like Netcraft for their utility in these areas.
NEW QUESTION # 201
Investigator lan gives you a drive image to investigate.
What type of analysis are you performing?
- A. Real-time
- B. Live
- C. Dynamic
- D. Static
Answer: D
NEW QUESTION # 202
Nervous Nat often sends emails with screenshots of what he thinks are serious incidents, but they always turn out to be false positives. Today, he sends another screenshot, suspecting a nation-state attack. As usual, you go through your list of questions, check your resources for information to determine whether the screenshot shows a real attack, and determine the condition of your network. Which step of IR did you just perform?
- A. Recovery
- B. Detection anc analysis (or identification)
- C. Remediation
- D. Preparation
Answer: B
Explanation:
When you receive a screenshot from Nervous Nat and go through a list of questions, check resources for information to determine the nature of the screenshot, and assess the condition of your network, you are engaging in the Detection and Analysis (or Identification) phase of Incident Response (IR). This phase is about identifying potential security incidents based on reported concerns, anomalies detected by security tools, or through the analysis of security alerts. In this scenario, despite the historical context of false positives, each report is treated seriously, requiring you to collect and analyze information to determine whether a real attack is happening. This involves verifying the validity of the incident, assessing its nature, scope, and impact, and deciding on the appropriate next steps. The detection and analysis phase is critical for determining the course of the IR process, including whether escalation is needed and what response measures should be initiated.References:The ECIH v3 certification materials outline the Incident Response process, detailing steps from preparation, detection and analysis, containment, eradication, and recovery, to post-incident activities, highlighting the importance of thorough detection and analysis as the foundation for effective incident management.
NEW QUESTION # 203
Alexis is working as an incident responder in XYZ organization. She was asked to identify and attribute the actors behind an attack that took place recently. In order to do so, she is performing threat attribution that deals with the identification of the specific person, society, or a country sponsoring a well-planned and executed intrusion or attack over its target. Which of the following types of threat attributions Alexis performed?
- A. Campaign attributio
- B. Intrusion-set attribution
- C. True attribution
- D. Nation-state attribution
Answer: C
Explanation:
True attribution in the context of cyber incidents involves the identification of the actual individuals, groups, or entities behind an attack. This can include pinpointing specific persons, organizations, societies, or even countries that sponsor or carry out cyber intrusions or attacks.
Alexis's efforts to identify and attribute the actors behind a recent attack by distinguishing the specific origins of the threat align with the concept of true attribution, which goes beyond mere speculation to provide concrete evidence about the perpetrators.
NEW QUESTION # 204
Which of the following might be an insider threat?
- A. Disgruntled system administrators
- B. Business partners
- C. Current employee
- D. All of these
Answer: D
NEW QUESTION # 205
Tyler, a system administrator, notices high CPU usage and unknown processes on a workstation used to download unauthorized applications. Which indicator best describes this inappropriate usage incident?
- A. Attack against an external party
- B. Inappropriate resource usage
- C. Access to inappropriate materials
- D. Unauthorized service usage
Answer: B
Explanation:
This scenario reflects misuse of system resources, a category defined in ECIH network and endpoint incident classification.
Option C is correct because unauthorized software caused excessive CPU usage and system strain, violating acceptable use policies.
Options A, B, and D do not match the behavior described.
ECIH classifies such activity as a security incident because it impacts availability, performance, and risk exposure.
NEW QUESTION # 206
......
EC-COUNCIL 212-89 exam is ideal for security professionals, incident handlers, IT managers, network administrators, and anyone interested in enhancing their knowledge and skills in the field of incident handling and response. EC Council Certified Incident Handler (ECIH v3) certification is particularly useful for those who are responsible for managing and responding to security incidents in their organization.
212-89 dumps Exam Material with 447 Questions: https://testking.testpassed.com/212-89-pass-rate.html