EC-COUNCIL EC Council Certified Incident Handler (ECIH v3) - 212-89 Exam Questions

QUESTION NO: 1
In which of the following types of fuzz testing strategies the new data will be generated from scratch and the amount of data to be generated are predefined based on the testing model?

QUESTION NO: 2
If the browser does not expire the session when the user fails to logout properly, which of the following OWASP Top 10 web vulnerabilities is caused?

QUESTION NO: 3
Dan is a newly appointed information security professional in a renowned organization. He is supposed to follow multiple security strategies to eradicate malware incidents. Which of the following is not considered as a good practice for maintaining information security and eradicating malware incidents?

QUESTION NO: 4
Mei, a forensic analyst, is analyzing logs from a compromised blog platform. She finds evidence that an attacker posted content using a valid account, and later, users who visited the blog were redirected to a phishing site containing session cookies in the URL. What kind of attack does this best describe?

QUESTION NO: 5
Zaimasoft, a prominent IT organization, was attacked by perpetrators who directly targeted the hardware and caused irreversible damage to the hardware. In result, replacing or reinstalling the hardware was the only solution.
Identify the type of denial-of-service attack performed on Zaimasoft.

QUESTION NO: 6
During routine monitoring, a cloud-based application hosting provider detects an anomaly suggesting an ongoing DDoS attack targeting one of its hosted applications. The provider ' s incident response team must quickly mitigate the attack while ensuring minimal service disruption. Which of the following strategies should they prioritize?

QUESTION NO: 7
Jason is an incident handler dealing with malware incidents. He was asked to perform memory dump analysis in order to collect the information about the basic functionality of any program. As a part of his assignment, he needs to perform string search analysis to search for the malicious string that could determine harmful actions that a program can perform. Which of the following string-searching tools Jason needs to use to do the intended task?

QUESTION NO: 8
An organization named Sam Morison Inc. decided to use cloud-based services to reduce the cost of maintenance. The organization identified various risks and threats associated with cloud service adoption and migrating business-critical data to thirdparty systems. Hence, the organization decided to deploy cloud-based security tools to prevent upcoming threats.
Which of the following tools help the organization to secure the cloud resources and services?

QUESTION NO: 9
In the wake of a sophisticated cyberattack at a global financial institution that resulted in a suspected breach of sensitive customer data through encrypted communication channels, an incident handler is the first responder at the affected systems. The situation involves potentially volatile memory that should be preserved for forensic investigation. Given the likelihood that sophisticated malware may have been used for data exfiltration, the handler must act swiftly to secure digital evidence that could be critical in tracing the attack vector and understanding the breach ' s scope. To maintain evidence integrity, which should be the incident handler ' s immediate action to preserve the integrity of volatile data while ensuring the scene ' s security for a detailed forensic analysis?

QUESTION NO: 10
Liam, a certified digital forensics technician, is dispatched to a corporate office after a suspected insider breach involving unauthorized data exfiltration. Upon arrival, he immediately begins organizing the collection process. He carefully labels each seized device-including laptops, USB drives, and smartphones-with exhibit tags that include his initials, the date and time of seizure, and a unique exhibit number. For each item, he records detailed descriptions in an official evidence logbook, noting the device make, serial number, condition, and where it was found. He also ensures that all items are photographed in their original positions before being moved. As he prepares them for secure packaging and transport, Liam initials each log entry and keeps a running record of who will take charge of the evidence next. Which aspect of evidence handling is Liam demonstrating?

QUESTION NO: 11
After experiencing a large-scale distributed denial-of-service (DDoS) attack that caused service outages, a national telecom provider recovered its web platform. The IH & R team must now implement post-recovery measures to enhance resilience against future DDoS attempts. Which action would be most effective?

QUESTION NO: 12
In the lead-up to a major product launch, a technology company reviews its endpoint security strategy to safeguard its intellectual property against potential cyber threats. The company utilizes a wide range of endpoints, from developers ' laptops to test servers running in a hybrid cloud environment. Recognizing the heightened risk of targeted attacks during this critical period, what is the most essential element to incorporate into their incident response strategy for endpoints?

QUESTION NO: 13
A cloud service provider detected anomalous activities pointing to a potential compromise of its infrastructure. The IH & R team is confronted with vast amounts of data from various cloud-native logging mechanisms. To ensure swift and effective incident triage, what should be their primary course of action?

QUESTION NO: 14
An attacker traced out and found the kind of websites a target company/individual is frequently surfing and tested those particular websites to identify any possible vulnerabilities. When the attacker detected vulnerabilities in the website, the attacker started injecting malicious script/code into the web application that can redirect the webpage and download the malware onto the victim's machine. After infecting the vulnerable web application, the attacker waited for the victim to access the infected web application.
Identify the type of attack performed by the attacker.