EC-COUNCIL 212-89 Test Engine Practice Test Questions, Exam Dumps [Q96-Q118]

NEW QUESTION 96
Farheen is an incident responder at reputed IT Firm based in Florida. Farheen was asked to investigate a recent cybercrime faced by the organization. As part of this process, she collected static data from a victim system. She used dd, a command line tool, to perform forensic duplication to obtain an NTFS image of the original disk. She created a sector-by-sector mirror imaging of the disk and saved the output image file as image.dd. Identify the static data collection process step performed by Farheen while collecting static data.

NEW QUESTION 97
Insider threats can be detected by observing concerning behaviors exhibited by insiders, such as conflicts with
supervisors and coworkers, decline in performance, tardiness or unexplained absenteeism. Select the
technique that helps in detecting insider threats:

NEW QUESTION 98
Jacobi san employee at a firm called Dolphin Investment. While he was on duty, he identified that his computer was facing some problems, and he wanted to convey the issue to the c once med authority in his organization. However, this organization currently does not have a ticketing system to address such types of issues.
In the above scenario, which of the following ticketing systems can be employed by Dolphin Investment to allow Jacob to inform the c once med team about the incident?

NEW QUESTION 99
Malicious Micky has moved from the delivery stage to the exploitation stage of the kill chain. This malware wants to find and report to the command center any useful services on the system.
Which of the following recon attacks is the MOST LIKELY to provide this information?

NEW QUESTION 100
The service organization that provides 24×7 computer security incident response services to any user, company, government agency, or organization is known as:

NEW QUESTION 101
Alexis works as an incident responder at XYZ organization. She was asked to identify and attribute the actors behind an attack that occurred recently. For this purpose, she is performing a type of threat attribution that deals with the identification of a specific person, society, or country sponsoring a well-planned and executed intrusion or attack on its target.
Which of the following types of threat attributions is Alexis performing?

NEW QUESTION 102
An organization faced an information security incident where a disgruntled employee passed sensitive access control information to a competitor. The organization’s incident response manager, upon investigation, found that the incident must be handled within a few hours on the same day to maintain business continuity and market competitiveness. How would you categorize such information security incident?

NEW QUESTION 103
According to the Fourth Amendment of USA PATRIOT Act of 2001; if a search does NOT violate a person’s “reasonable” or “legitimate” expectation of privacy then it is considered:

NEW QUESTION 104
In a DDoS attack, attackers first infect multiple systems, which are then used to attack a particular target directly. Those systems are called:

NEW QUESTION 105
An incident recovery plan is a statement of actions that should be taken before, during or after an incident.
Identify which of the following is NOT an objective of the incident recovery plan?

NEW QUESTION 106
Which of the following is not the responsibility of first responders?

NEW QUESTION 107
An attack on a network is BEST blocked using which of the following?

NEW QUESTION 108
Bran is an incident handler who is assessing the network of the organization. He wants to detect ping sweep attempts on the network using Wire shark.
Which of the following W re shark filters would Bran use to accomplish this task?

NEW QUESTION 109
Bit stream image copy of the digital evidence must be performed in order to:

NEW QUESTION 110
Incident management team provides support to all users in the organization that are affected by the threat or attack. The organization’s internal auditor is part of the incident response team. Identify one of the responsibilities of the internal auditor as part of the incident response team:

NEW QUESTION 111
Policies are designed to protect the organizational resources on the network by establishing the set rules and procedures. Which of the following policies authorizes a group of users to perform a set of actions on a set of resources?

NEW QUESTION 112
Which of the following is a written or textual record of an event that usually includes a timestamp, responsible party, and action?

NEW QUESTION 113
According to the Evidence Preservation policy, a forensic investigator should make at least ………………… image
copies of the digital evidence.

NEW QUESTION 114
Which of the following is an attack that occurs when a malicious program causes a user’s browser to perform man unwanted action on a trusted site for which the user is currently authenticated?

NEW QUESTION 115
If the loss anticipated is greater than the agreed upon threshold; the organization will:

NEW QUESTION 116
After malware is removed from a system and a clean scan is returned, which of the following steps should be taken for the affected device?

NEW QUESTION 117
If a hacker cannot find any other way to attack an organization, they can influence an employee or a disgruntled staff member.
What type of threat is this?

NEW QUESTION 118
James has been appointed as an incident handing and response (IH&R) team lead and was assigned to build an IH&R plan and his own team in the company. Identify the IH&R process step James is currently working on.