Pre-Summer Sale Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: xmas50

ECCouncil 212-89 - EC Council Certified Incident Handler (ECIH v3)

Page: 3 / 10
Total 305 questions

A ransomware attack recently disrupted operations at a manufacturing facility, specifically targeting its IoT-integrated conveyor system. While attempting to recover from the incident, the incident response team discovered that the available backups were incomplete—several critical sensor logs and control commands were missing, which caused delays in restoring device functions and syncing with other systems. The team concludes that relying on traditional backup routines alone is insufficient for restoring full IoT functionality after an attack. Which strategy would best prevent such issues in future recovery efforts?

A.

Use long-term tape archival for all IoT firmware images.

B.

Store historical sensor logs in compressed ZIP archives on shared drives.

C.

Schedule periodic external hard drive backups for operator terminals.

D.

Maintain synchronized cloud replicas of critical IoT resources.

Stenley is an incident handler working for Texa Corp. located in the United States. With the growing concern of increasing emails from outside the organization, Stenley was

asked to take appropriate actions to keep the security of the organization intact. In the process of detecting and containing malicious emails, Stenley was asked to check the

validity of the emails received by employees.

Identify the tools he can use to accomplish the given task.

A.

PointofMail

B.

Email Dossier

C.

PoliteMail

D.

EventLog Analyzer

Khai was tasked with examining the logs from a Linux email server. The server uses Sendmail to execute the command to send emailsand Syslog to maintain logs. To validate the data within email headers, which of the following directories should Khai check for information such as source and destination IP addresses, dates, and timestamps?

A.

/Var/log/mailog

B.

/✓ar/log/sendmail

C.

/va r/log/mai11og

D.

/va r/log/sendmail/mailog

You are talking to a colleague who Is deciding what information they should include in their organization’s logs to help with security auditing. Which of the following items should you tell them to NOT log?

A.

Timestamp

B.

Session ID

C.

Source IP eddross

D.

userid

In response to suspicious communications originating from executive accounts, the organization's response team traced the root cause to spoofed identity relays exploiting unsecured DNS entries. The attack had triggered internal alerts but required deeper remediation to eliminate recurring forged message injections and restore the integrity of interdepartmental mail routing. What action reflects an appropriate eradication strategy in this context?

A.

Requesting legal review of communication failures post-incident

B.

Investigating the delay in threat detection due to analysis

C.

Sharing phishing indicators with external peer communities

D.

Strengthening SPF, DKIM, and DMARC configurations

Logan, an incident handler, ensures the chain of custody is documented while handling backup media post-attack. The goal is to preserve evidence integrity while restoring critical systems. Which recovery principle is Logan adhering to?

A.

Forensic compliance

B.

Network segmentation

C.

Immutable infrastructure

D.

Enhanced authentication

During the vulnerability assessment phase, the incident responders perform various

steps as below:

1. Run vulnerability scans using tools

2. Identify and prioritize vulnerabilities

3. Examine and evaluate physical security

4. Perform OSINT information gathering to validate the vulnerabilities

5. Apply business and technology context to scanner results

6. Check for misconfigurations and human errors

7. Create a vulnerability scan report

Identify the correct sequence of vulnerability assessment steps performed by the

incident responders.

A.

3-->6-->1-->2-->5-->4-->7

B.

1-->3-->2-->4-->5-->6-->7

C.

4-->1-->2-->3-->6-->5-->7

D.

2-->1-->4-->7-->5-->6-->3

An organization notices unusual API activity in its AWS account, suggesting unauthorized access and potential data exfiltration. What is the most critical immediate action to take to mitigate this security incident?

A.

Increase the security group's restrictions to limit access to the affected resources.

B.

Enable AWS CloudTrail logs for all regions to track future API activities.

C.

Deploy AWS Shield to protect against potential DDoS attacks as a precaution.

D.

Rotate all AWS IAM access keys and review IAM policies for excessive permissions.

DeltaDynamics, a large-scale data analytics firm, found that one of its data scientists was sharing proprietary algorithms with external parties. The firm wishes to monitor its employees more closely without breaching privacy laws. What is the most effective measure it should consider?

A.

Use an advanced Employee Monitoring Tool that respects user privacy.

B.

Implement keystroke logging on all company devices.

C.

Install CCTV cameras in all workstations.

D.

Randomly inspect employee personal devices every week.

A global retail enterprise operating across multiple e-commerce platforms and physical locations has recently been targeted by a well-orchestrated cyberattack that disrupted transaction processing systems and led to a temporary shutdown of online services. Following the incident, customer confidence dropped, and the board demanded immediate corrective and preventive measures to strengthen cybersecurity resilience. The Chief Information Security Officer (CISO) directed the incident response team to establish a forward-looking approach that not only mitigates such incidents but also ensures that all stakeholders are trained in advance. This includes defining clear roles and responsibilities, creating and training a dedicated response team, conducting simulation exercises, reviewing existing IR tools, auditing organizational assets, and developing a comprehensive set of policies and playbooks. Which phase of the IH&R process should the organization focus on to achieve this?