ECCouncil 212-89 - EC Council Certified Incident Handler (ECIH v3)
Which of the following tools helps incident responders effectively contain a potential cloud security incident and gather required forensic evidence?
OmegaTech Corp identified unauthorized remote access to its primary server and data exfiltration tunnels. Simultaneously, IoT device firmware corruption was reported. As the first responder, what should Olivia prioritize?
Eric works as a system administrator in ABC organization. He granted privileged users with unlimited permissions to access the systems. These privileged users can misuse
their rights unintentionally or maliciously or attackers can trick them to perform malicious activities.
Which of the following guidelines helps incident handlers to eradicate insider attacks by privileged users?
Rose is an incident-handling person and she is responsible for detecting and eliminating
any kind of scanning attempts over the network by any malicious threat actors. Rose
uses Wireshark tool to sniff the network and detect any malicious activities going on.
Which of the following Wireshark filters can be used by her to detect TCP Xmas scan
attempt by the attacker?
Jacob is an employee at a firm called Dolphin Investment. While he was on duty, he identified that his computer was facing some problems, and he wanted to convey the issue to the concerned authority in his organization. However, this organization currently does not have a ticketing system to address such types of issues. In the above scenario, which of the following ticketing systems can be employed by Dolphin Investment to allow Jacob to inform the concerned team about the incident?
Michael is an incident handler at CyberTech Solutions. He is performing detection and analysis of a cloud security incident. He is analyzing the file systems, slack spaces, and
metadata of the storage units to find hidden malware and evidence of malice.
Identify the cloud security incident handled by Michael.
In which of the following confidentiality attacks attackers try to lure users by posing themselves as authorized AP by beaconing the WLAN's SSID?
Matt is an incident handler working for one of the largest social network companies, which was affected by malware. According to the company’s reporting timeframe guidelines, a malware incident should be reported within 1 h of discovery/detection after its spread across the company. Which category does this incident belong to?
Smith employs various malware detection techniques to thoroughly examine the
network and its systems for suspicious and malicious malware files. Among all
techniques, which one involves analyzing the memory dumps or binary codes for the
traces of malware?
During a security audit, analysts identified unusual GET requests to a financial application where external resources were fetched using numeric IPs combined with unexpected trailing characters. These inputs were not properly filtered by the system, allowing external content to be processed and embedded in server responses. The issue was traced to a feature that dynamically loads input-specified content without strict validation. Which type of attack/technique is most likely being analyzed in this scenario?
