Free 212-89 Questions for EC-COUNCIL EC Council Certified Incident Handler (ECIH v3) 212-89 Exam as PDF & Practice Test Engine

Darwin is an attacker residing within the organization and is performing network sniffing by running his system in promiscuous mode. He is capturing and viewing all the network packets transmitted within the organization. Edwin is an incident handler in the same organization.
In the above situation, which of the following Nmap commands Edwin must use to detect Darwin's system that is running in promiscuous mode?

Which of the following risk mitigation strategies involves execution of controls to reduce the risk factor and brings it to an acceptable level or accepts the potential risk and continues operating the IT system?

You are talking to a colleague who Is deciding what information they should include in their organization's logs to help with security auditing. Which of the following items should you tell them to NOT log?

During a recent incident response, the Blue Team of Contoso Corp. discovered a series of sophisticated spear-phishing emails sent to senior executives. The emails leveraged zero-day vulnerabilities. To enhance its proactive defenses, the team decided to incorporate more robust threat intelligence into their response strategy. Which approach would best address the situation?

John, a system administrator, has been with the company for several years and has access to sensitive company data. However, he has recently become disgruntled due to a denied promotion. He decides to seek revenge on the company by compromising its resources. Which type of insider threat does John represent?

Which of the following terms refers to vulnerable account management functions, including account update, recovery of forgotten or lost passwords, and password reset, that might weaken valid authentication schemes?

Which of the following digital evidence temporarily stored on a digital device that requires a constant power supply and is deleted if the power supply is interrupted?

Which of the following has been used to evade IDS and IPS?

Stanley works as an incident responder at a top MNC based in Singapore. He was asked to investigate a cybersecurity incident that recently occurred in the company. While investigating the incident, he collected evidence from the victim systems. He must present this evidence in a clear and comprehensible manner to the members of a jury so that the evidence clarifies the facts and further helps in obtaining an expert opinion on the incident to confirm the investigation process. In the above scenario, which of the following characteristics of the digital evidence did Stanley attempt to preserve?

Lena, a SOC analyst, observes a pattern of unusual login attempts originating from multiple foreign IP addresses tied to shared drive links circulating within the organization. These links were embedded in emails appearing to come from the HR department and marked with urgent subject lines. Upon deeper inspection, Lena finds multiple similar messages still pending in the mail server's delivery queue. To prevent widespread exposure, she takes immediate action to eliminate these messages before they reach employees' inboxes. Which incident response action best describes Lena's action?

Ren is assigned to handle a security incident of an organization. He is tasked with forensics investigation to find the evidence needed by the management. Which of the following steps falls under the investigation phase of the computer forensics investigation process?

David, a certified digital first responder, arrives at the scene of a reported security breach in the HR department of a corporate office. The breach involves multiple digital endpoints, including desktop systems and mobile devices. Upon entering the scene, David observes that one desktop computer is still powered ON and logged in, showing a sensitive financial dashboard on the screen. Realizing the importance of preserving this evidence, David refrains from interacting directly with the keyboard or running applications. Instead, he takes high-resolution photographs of the screen to capture the current session details, including open applications and time- sensitive data. To avoid altering the system state, David gently moves the mouse without clicking, just enough to dismiss a screen saver without triggering any on-screen changes. He records the system's behavior, notes any visible alerts or programs running, and tags all connected cables and peripheral ports for proper documentation. What step in the evidence handling process is David demonstrating?

A social media analytics company uses a cloud-based platform to deploy and manage modular workloads. Following an alert in a background module, the incident response team began log analysis and configuration reviews. While they had access to deployment artifacts and resource usage settings, they lacked visibility into system-level activity, such as task scheduling and component runtime behavior. This information is needed to determine whether the issue originated from the underlying cloud environment. Who holds primary responsibility for providing such access in this cloud model to support the investigation?