Spring Sale Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = simple70
Pass the ECCouncil ECIH 212-89 Questions and answers with Dumpstech
Nervous Nat often sends emails with screenshots of what he thinks are serious incidents, but they always turn out to be false positives. Today, he sends another screenshot, suspecting a nation-state attack. As usual, you go through your list of questions, check your resources for information to determine whether the screenshot shows a real attack, and determine the condition of your network. Which step of IR did you just perform?
Rose is an incident-handling person and she is responsible for detecting and eliminating
any kind of scanning attempts over the network by any malicious threat actors. Rose
uses Wireshark tool to sniff the network and detect any malicious activities going on.
Which of the following Wireshark filters can be used by her to detect TCP Xmas scan
attempt by the attacker?
During a security audit, analysts identified unusual GET requests to a financial application where external resources were fetched using numeric IPs combined with unexpected trailing characters. These inputs were not properly filtered by the system, allowing external content to be processed and embedded in server responses. The issue was traced to a feature that dynamically loads input-specified content without strict validation. Which type of attack/technique is most likely being analyzed in this scenario?
Ren is assigned to handle a security incident of an organization. He is tasked with forensics investigation to find the evidence needed by the management. Which of the following steps falls under the investigation phase of the computer forensics investigation process?
After experiencing a large-scale distributed denial-of-service (DDoS) attack that caused service outages, a national telecom provider recovered its web platform. The IH&R team must now implement post-recovery measures to enhance resilience against future DDoS attempts. Which action would be most effective?
Sam. an employee of a multinational company, sends emails to third-party organizations with a spoofed email address of his organization. How can you categorize this type of incident?
Alexis works as an incident responder at XYZ organization. She was asked to identify and attribute the actors behind an attack that occurred recently. For this purpose, she is performing a type of threat attribution that deals with the identification of a specific person, society, or country sponsoring a well-planned and executed intrusion or attack on its target. Which of the following types of threat attributions is Alexis performing?
BadGuy Bob hid files in the slack space, changed the file headers, hid suspicious files in executables, and changed the metadata for all types of files on his hacker laptop. What has he committed?
A global manufacturing company detected unauthorized privilege escalation on an OT workstation connected to production systems. The attacker’s persistence and data exfiltration are not fully identified. The CISO wants to limit lateral movement without alerting the attacker. Which containment action best aligns with this objective?
A US Federal Agency network was the target of a DoS attack that prevented and
impaired the normal authorized functionality of the networks. According to agency’s
reporting timeframe guidelines, this incident should be reported within 2 h of
discovery/detection if the successful attack is still ongoing and the agency is unable to
successfully mitigate the activity.
Which incident category of US Federal Agency does this incident belong to?
