212-89 PDF Dumps Real 2025 Recently Updated Questions [Q63-Q87]

Rate this post

212-89 PDF Dumps Real 2025 Recently Updated Questions

Released EC-COUNCIL 212-89 Updated Questions PDF

The ECIH certification is offered by the EC-Council, which is a leading provider of information security certifications and training programs. The EC-Council is known for its rigorous certification programs that are designed to test an individual’s knowledge and skills in various areas of information security. The ECIH certification program is no exception, and is designed to test an individual’s ability to manage and respond to security incidents in a real-world environment.

The ECIH certification exam covers a wide range of topics, including incident handling and response, computer forensics, and network security. 212-89 exam is designed to test an individual’s knowledge and skills in each of these areas, and is intended to be challenging and comprehensive. 212-89 exam consists of 50 multiple-choice questions, and candidates have 2 hours to complete the exam. In order to pass the exam, candidates must achieve a score of at least 70%.

NEW QUESTION 63
Which of the following is a risk assessment tool:

Nessus

Wireshark

CRAMM

Nmap

NEW QUESTION 64
Except for some common roles, the roles in an IRT are distinct for every organization. Which among the following is the role played by the Incident Coordinator of an IRT?

Links the appropriate technology to the incident to ensure that the foundation’s offices are returned to normal operations as quickly as possible

Links the groups that are affected by the incidents, such as legal, human resources, different business areas and management

Applies the appropriate technology and tries to eradicate and recover from the incident

Focuses on the incident and handles it from management and technical point of view

NEW QUESTION 65
Employee monitoring tools are mostly used by employers to find which of the following?

Lost registry keys

Malicious insider threats

Conspiracies

Stolen credentials

NEW QUESTION 66
Insider threats can be detected by observing concerning behaviors exhibited by insiders, such as conflicts with
supervisors and coworkers, decline in performance, tardiness or unexplained absenteeism. Select the
technique that helps in detecting insider threats:

Correlating known patterns of suspicious and malicious behavior

Protecting computer systems by implementing proper controls

Making is compulsory for employees to sign a none disclosure agreement

Categorizing information according to its sensitivity and access rights

NEW QUESTION 67
Risk management consists of three processes, risk assessment, mitigation and evaluation. Risk assessment determines the extent of the potential threat and the risk associated with an IT system through its SDLC. How many primary steps does NIST’s risk assessment methodology involve?

Twelve

Four

Six

Nine

NEW QUESTION 68
Miko was hired as an incident handler in XYZ company. His first task was to identify the PING sweep attempts inside the network. For this purpose, he used Wireshark to analyze the traffic. What filter did he use to identify ICMP ping sweep attempts?

tcp.typc == icmp

icrrip.lype == icmp

icmp.type == 8 or icmp.type ==0

udp.lype – 7

NEW QUESTION 69
An organization named Sam Morison Inc. decided to use cloud-based services to reduce the cost of their maintenance. They first identified various risks and threats associated with cloud .. adoption and migrating critical business data to third-party systems. Hence, the organization decided to deploy cloud-based security tools to prevent upcoming threats. Which of the following tools would help the organization to secure cloud resources and services?

Nmap

Alert Logic

Burp Suite

Wireshark

NEW QUESTION 70
The type of relationship between CSIRT and its constituency have an impact on the services provided by the CSIRT. Identify the level of the authority that enables members of CSIRT to undertake any necessary actions on behalf of their constituency?

Full-level authority

Mid-level authority

Half-level authority

Shared-level authority

NEW QUESTION 71
You are a systems administrator for a company. You are accessing your file server remotely for maintenance. Suddenly, you are unable to access the server. After contacting others in your department, you find out that they cannot access the file server either. You can ping the file server but not connect to it via RDP. You check the Active Directory Server, and all is well. You check the email server and find that emails are sent and received normally. What is the most likely issue?

An e-mail service issue

The file server has shut down

A denial-of-service issue

An admin account issue

NEW QUESTION 72
If the browser does not expire the session when the user fails to logout properly, which of the following OWASP Top 10 web vulnerabilities is caused?

A7: Cross-site scripting

A3: Sensitive- data exposure

A2: Broken authentication

A5: Broken access control

NEW QUESTION 73
If a hacker cannot find any other way to attack an organization, they can influence an employee or a disgruntled staff member.
What type of threat is this?

Identity the t

Footprinting

Insider attack

Phishing attack

NEW QUESTION 74
You area systems administrator for a company. You are accessing your fileserver remotely for maintenance. Suddenly, you are unable to access the server. After contacting others in your department, you find out that they cannot access the file server either. You can ping the file server but not connect to it via RD. You check the Active Directory Server, and all is well. You check the email server and find that emails are sent and received normally.
What is the most likely issue?

An admin account issue

An email service issue

A denial-of-service issue

The fileserver has shutdown

NEW QUESTION 75
Agencies do NOT report an information security incident is because of:

Afraid of negative publicity

Have full knowledge about how to handle the attack internally

Do not want to pay the additional cost of reporting an incident

All the above

NEW QUESTION 76
Michael is an incident handler at CyberTech Solutions. He is performing detection and analysis of a cloud security incident. He is analyzing the file systems, slack spaces, and metadata of the storage units to find hidden malware and evidence of malice.
Identify the cloud security incident handled by Michael.

Network-related incident

Storage-related incident

Application-related incident

Server-related incident

NEW QUESTION 77
The largest number of cyber-attacks are conducted by:

Insiders

Outsiders

Business partners

Suppliers

NEW QUESTION 78
An assault on system security that is derived from an intelligent threat is called:

Threat Agent

Vulnerability

Attack

Risk

NEW QUESTION 79
In which of the following types of fuzz testing strategies the new data will be generated from scratch and the amount of data to be generated are predefined based on the testing model?

Log-based fuzz testing

Generation-based fuzz testing

Mutation-based fuzz testing

Protocol-based fuzz testing

NEW QUESTION 80
Which of the following is a type of malicious code or software that appears legitimate but can take control of your computer?

Phishing attack

DDoS

Trojan attack

Password attack

NEW QUESTION 81
An information security policy must be:

Distributed and communicated

Enforceable and Regularly updated

Written in simple language

All the above

NEW QUESTION 82
An insider threat response plan help san organization minimize the damage caused by malicious insiders.
One of the approaches to mitigate these threats is setting up controls from the human resources department.
Which of the following guidelines can the human resources department use?

Monitor and secure the organization’s physical environment.

Disable the default administrative account to ensure accountability.

Access granted to users should be documented and vetted by a supervisor.

Implement a person-to-person rule to secure the backup process and physical media.

NEW QUESTION 83
A security policy will take the form of a document or a collection of documents, depending on the situation or
usage. It can become a point of reference in case a violation occurs that results in dismissal or other penalty.
Which of the following is NOT true for a good security policy?

It must be enforceable with security tools where appropriate and with sanctions where actual prevention is
not technically feasible

It must be approved by court of law after verifications of the stated terms and facts

It must be implemented through system administration procedures, publishing of acceptable use guide lines
or other appropriate methods

It must clearly define the areas of responsibilities of the users, administrators and management

NEW QUESTION 84
Eric is an incident responder working on developing incident-handling plans and procedures. As part of this process, he is analyzing the organizational network to generate a report and develop policies based on the acquired results.
Which of the following tools will help him in analyzing his network and the related traffic?

FaceNiff

Whois

Burp Suite

Wireshark

NEW QUESTION 85
CERT members can provide critical support services to first responders such as:

Immediate assistance to victims

Consolidated automated service process management platform

Organizing spontaneous volunteers at a disaster site

A + C

NEW QUESTION 86
The insider risk matrix consists of technical literacy and business process knowledge vectors. Considering the matrix, one can conclude that:

If the insider’s technical literacy is low and process knowledge is high, the risk posed by the threat will be insignificant.

If the insider’s technical literacy and process knowledge are high, the risk posed by the threat will be insignificant.

If the insider’s technical literacy is high and process knowledge is low, the risk posed by the threat will be high.

If the insider’s technical literacy and process knowledge are high, the risk posed by the threat will be high.

NEW QUESTION 87
Eric works as a system administrator in ABC organization. He granted privileged users with unlimited permissions to access the systems. These privileged users can misuse their rights unintentionally or maliciously or attackers can trick them to perform malicious activities.
Which of the following guidelines helps incident handlers to eradicate insider attacks by privileged users?

Do not use encryption methods to prevent administrators and privileged users from accessing backup tapes and sensitive information

Do not control the access to administrators and privileged users

Do not enable the default administrative accounts to ensure accountability

Do not allow administrators to use unique accounts during the installation process