Best Value Available! 2023 Realistic Verified Free 212-89 Exam Questions
Pass Your Exam Easily! 212-89 Real Question Answers Updated
NEW QUESTION # 38
A malware code that infects computer files, corrupts or deletes the data in them and requires a host file to propagate is called:
- A. Virus
- B. Trojan
- C. Worm
- D. RootKit
Answer: A
NEW QUESTION # 39
Which of the following is not called volatile data?
- A. Open sockets or open ports
- B. Creation dates off les
- C. The date and time of the system
- D. State of the network interface
Answer: B
NEW QUESTION # 40
An information security policy must be:
- A. Written in simple language
- B. All the above
- C. Enforceable and Regularly updated
- D. Distributed and communicated
Answer: B
NEW QUESTION # 41
Which of the following types of digital evidence is temporarily stored in a digital device that requires constant power supply and is deleted if the power supply is interrupted?
- A. Process memory
- B. Event logs
- C. Swap file
- D. Slack space
Answer: A
NEW QUESTION # 42
Which of the following is NOT a digital forensic analysis tool:
- A. Guidance Software EnCase Forensic
- B. Access Data FTK
- C. EAR/ Pilar
- D. Helix
Answer: C
NEW QUESTION # 43
A malicious security-breaking code that is disguised as any useful program that installs an executable
programs when a file is opened and allows others to control the victim's system is called:
- A. Trojan
- B. Virus
- C. Worm
- D. RootKit
Answer: A
Explanation:
Explanation
NEW QUESTION # 44
A colleague wants to minimize their security responsibility because they are in a small organization. They are evaluating a new application that is offered in different forms.
Which form would result in the least amount of responsibility for the colleague?
- A. SaaS
- B. PaaS
- C. laaS
- D. On-prem installation
Answer: A
NEW QUESTION # 45
Except for some common roles, the roles in an IRT are distinct for every organization. Which among the following is the role played by the Incident Coordinator of an IRT?
- A. Focuses on the incident and handles it from management and technical point of view
- B. Links the groups that are affected by the incidents, such as legal, human resources, different business areas and management
- C. Applies the appropriate technology and tries to eradicate and recover from the incident
- D. Links the appropriate technology to the incident to ensure that the foundation's offices are returned to normal operations as quickly as possible
Answer: B
NEW QUESTION # 46
Francis received a spoof email asking for his bank information. He decided to use a tool to analyze the email headers.
Which of the following should he use?
- A. Mx Toolbox
- B. Polite Mail
- C. EventLog Analyzer
- D. Email Checker
Answer: A
NEW QUESTION # 47
They type of attack that prevents the authorized users to access networks, systems, or applications by
exhausting the network resources and sending illegal requests to an application is known as:
- A. Session Hijacking attack
- B. Man in the Middle attack
- C. Denial of Service attack
- D. SQL injection attack
Answer: C
NEW QUESTION # 48
Incident handling and response steps help you to detect, identify, respond and manage an incident. Which of the following helps in recognizing and separating the infected hosts from the information system?
- A. Configuring firewall to default settings
- B. Inspecting the process running on the system
- C. Browsing particular government websites
- D. Sending mails to only group of friends
Answer: B
NEW QUESTION # 49
An audit trail policy collects all audit trails such as series of records of computer events, about an operating
system, application or user activities. Which of the following statements is NOT true for an audit trail policy:
- A. It helps tracking individual actions and allows users to be personally accountable for their actions
- B. It helps calculating intangible losses to the organization due to incident
- C. It helps in compliance to various regulatory laws, rules,and guidelines
- D. It helps in reconstructing the events after a problem has occurred
Answer: B
NEW QUESTION # 50
Andrew, an incident responder, is performing risk assessment of the client organization. As a part of the risk assessment process, he identified the boundaries of the IT systems, along with the resources and the information that constitute the systems.
Identify the risk assessment step Andrew is performing.
- A. Control analysis
- B. Control recommendations
- C. Likelihood determination
- D. System characterization
Answer: D
NEW QUESTION # 51
What command does a Digital Forensic Examiner use to display the list of all open ports and the associated IP addresses on a victim computer to identify the established connections on it:
- A. "netstat -an" command
- B. "ifconfig" command
- C. "arp" command
- D. "dd" command
Answer: A
NEW QUESTION # 52
Zaimasoft, a prominent IT organization, was attacked by perpetrators who directly targeted the hardware and caused irreversible damage to the hardware. In result, replacing or reinstalling the hardware was the only solution. Identify the type of denial-of-service attack performed on Zaimasoft.
- A. PDoS
- B. DDoS
- C. DRDoS
- D. DoS
Answer: A
NEW QUESTION # 53
Shiela is working at night as an incident handler. During a shit, servers were affected by a massive cyber-attack. After she classified and prioritized the incident, she must report the incident, obtain necessary permissions, and perform other incident response functions.
What list should she check to notify other responsible personnel?
- A. Email list
- B. Point of contact
- C. Phone number list
- D. HR logbook
Answer: B
NEW QUESTION # 54
Which of the following is an attack that occurs when a malicious program causes a user's browser to perform man unwanted action on a trusted site for which the user is currently authenticated?
- A. Cross-site scripting
- B. Insecure direct object references
- C. Cross-site request forgery
- D. SQL injection
Answer: C
NEW QUESTION # 55
A distributed Denial of Service (DDoS) attack is a more common type of DoS Attack, where a single system is targeted by a large number of infected machines over the Internet. In a DDoS attack, attackers first infect multiple systems which are known as:
- A. Spyware
- B. Zombies
- C. Worms
- D. Trojans
Answer: B
NEW QUESTION # 56
Introduction of malicious programs on to the device connected to the campus network (Trojan Horse, email bombs, virus, etc.) is called?
- A. Un authorize Access
- B. Inappropriate Usage
- C. Authorize Access
- D. Network Access
Answer: D
NEW QUESTION # 57
The person who offers his formal opinion as a testimony about a computer crime incident in the court of law is known as:
- A. Evidence Documenter
- B. Incident Analyzer
- C. Incident Responder
- D. Expert Witness
Answer: D
NEW QUESTION # 58
An information security incident is
- A. All of the above
- B. Any real or suspected adverse event in relation to the security of computer systems or networks
- C. Any event that disrupts normal today's business functions
- D. Any event that breaches the availability of information assets
Answer: A
NEW QUESTION # 59
A risk mitigation strategy determines the circumstances under which an action has to be taken to minimize and overcome risks. Identify the risk mitigation strategy that focuses on minimizing the probability of risk and losses by searching for vulnerabilities in the system and appropriate controls:
- A. Research and acknowledgment
- B. Risk limitation
- C. Risk Assumption
- D. Risk absorption
Answer: A
NEW QUESTION # 60
You area systems administrator for a company. You are accessing your fileserver remotely for maintenance. Suddenly, you are unable to access the server. After contacting others in your department, you find out that they cannot access the file server either. You can ping the file server but not connect to it via RD. You check the Active Directory Server, and all is well. You check the email server and find that emails are sent and received normally.
What is the most likely issue?
- A. An admin account issue
- B. The fileserver has shutdown
- C. An email service issue
- D. A denial-of-service issue
Answer: D
NEW QUESTION # 61
Which of the following is NOT a network forensic tool?
- A. Caps a Network Analyzer
- B. Wire shark
- C. Tcpdump
- D. Advanced NTFS Journaling Parser
Answer: D
NEW QUESTION # 62
......
Prerequisites
The target candidates for the EC-Council 212-89 exam are the risk assessment administrators, penetration testers, cyber forensic investigators, incident handlers, venerability assessment auditors, firewall administrators, system engineers, network managers, system administrators, IT managers, and other IT professionals looking to gain validation for their skills in incident handling & response.
Please note that you are required to fulfill one prerequisite before going for the exam. You need to complete the ECIH training course, which can be taken as the instructor-led option, academia studying, or online learning. Those candidates who opt for self-study must possess at least one year of practical work experience in the domain of information security. Also, you are required to submit a completed eligibility form to get approval to take the test.
Actual Questions Answers Pass With Real 212-89 Exam Dumps: https://pass4sure.exam-killer.com/212-89-valid-questions.html
