ECCouncil 212-89 - EC Council Certified Incident Handler (ECIH v3)
A multinational corporation with a diverse computing environment experiences a sophisticated malware attack targeting its endpoint devices. The malware is designed to evade traditional antivirus solutions and establish a persistent backdoor for data exfiltration. This incident underscores the complex landscape of endpoint security and the evolving threat vectors. In this context, what is the most critical reason for establishing a robust endpoint security incident handling and response capability?
Otis is an incident handler working in Delmont organization. Recently, the organization is facing several setbacks in the business and thereby its revenues are going down. Otis
was asked to take the charge and look into the matter. While auditing the enterprise security, he found the traces of an attack, where the proprietary information was stolen
from the enterprise network and was passed onto the competitors.
Which of the following information security incidents Delmont organization faced?
An insider threat response plan helps an organization minimize the damage caused by malicious insiders. One of the approaches to mitigate these threats is setting up controls from the human resources department. Which of the following guidelines can the human resources department use?
Your manager hands you several items of digital evidence and asks you to investigate them in the order of volatility. Which of the following is the MOST volatile?
An incident handler is analyzing email headers to find out suspicious emails.
Which of the following tools he/she must use in order to accomplish the task?
Sameer, part of the incident response team, is alerted that several employees unknowingly entered credentials on a fake login page after receiving a spoofed internal notification. The domain name used in the attack had subtle character changes. What kind of unauthorized access incident did this attack begin with?
An organization suffers a financial loss after an executive responds to a fraudulent email crafted as part of a spear phishing attack. After isolating affected systems and notifying internal stakeholders, the incident response team prepares a detailed report outlining the attack timeline, suspicious IP addresses, email metadata, phone scam details, and the amount lost. This report is forwarded to a government agency specializing in cybercrime to aid further investigation and potential restitution. Which aspect of the recovery process is the organization addressing?
Identify Sarbanes–Oxley Act (SOX) Title, which consists of only one section, that includes measures designed to help restore investor confidence in the reporting of
securities analysts.
Andrew, an incident responder, is performing risk assessment of the client organization.
As a part of risk assessment process, he identified the boundaries of the IT systems,
along with the resources and the information that constitute the systems.
Identify the risk assessment step Andrew is performing.
Tibson works as an incident responder for MNC based in Singapore. He is investigating
a web application security incident recently faced by the company. The attack is
performed on a MS SQL Server hosted by the company. In the detection and analysis
phase, he used regular expressions to analyze and detect SQL meta-characters that led
to SQL injection attack.
Identify the regular expression used by Tibson to detect SQL injection attack on MS
SQL Server.
