최신EC-COUNCIL EC Council Certified Incident Handler (ECIH v3) - 212-89무료샘플문제
문제1
A multinational corporation with a diverse computing environment experiences a sophisticated malware attack targeting its endpoint devices. The malware is designed to evade traditional antivirus solutions and establish a persistent backdoor for data exfiltration. This incident underscores the complex landscape of endpoint security and the evolving threat vectors. In this context, what is the most critical reason for establishing a robust endpoint security incident handling and response capability?
A multinational corporation with a diverse computing environment experiences a sophisticated malware attack targeting its endpoint devices. The malware is designed to evade traditional antivirus solutions and establish a persistent backdoor for data exfiltration. This incident underscores the complex landscape of endpoint security and the evolving threat vectors. In this context, what is the most critical reason for establishing a robust endpoint security incident handling and response capability?
정답: D
설명: (ITDumpsKR 회원만 볼 수 있음)
문제2
Which of the following is defined as the identification of the boundaries of an IT system along with the resources and information that constitute the system?
Which of the following is defined as the identification of the boundaries of an IT system along with the resources and information that constitute the system?
정답: D
설명: (ITDumpsKR 회원만 볼 수 있음)
문제3
During routine checks, EduSoft, an educational software provider, identified malware within their digital examination tools. This malware not only provided answers to students but mined personal data. With a digital forensic tool and an encryption protocol tool, what's the ideal primary action?
During routine checks, EduSoft, an educational software provider, identified malware within their digital examination tools. This malware not only provided answers to students but mined personal data. With a digital forensic tool and an encryption protocol tool, what's the ideal primary action?
정답: C
설명: (ITDumpsKR 회원만 볼 수 있음)
문제4
A ransomware attack recently disrupted operations at a manufacturing facility, specifically targeting its IoT- integrated conveyor system. While attempting to recover from the incident, the incident response team discovered that the available backups were incomplete-several critical sensor logs and control commands were missing, which caused delays in restoring device functions and syncing with other systems. The team concludes that relying on traditional backup routines alone is insufficient for restoring full IoT functionality after an attack. Which strategy would best prevent such issues in future recovery efforts?
A ransomware attack recently disrupted operations at a manufacturing facility, specifically targeting its IoT- integrated conveyor system. While attempting to recover from the incident, the incident response team discovered that the available backups were incomplete-several critical sensor logs and control commands were missing, which caused delays in restoring device functions and syncing with other systems. The team concludes that relying on traditional backup routines alone is insufficient for restoring full IoT functionality after an attack. Which strategy would best prevent such issues in future recovery efforts?
정답: D
설명: (ITDumpsKR 회원만 볼 수 있음)
문제5
An energy company discovers unusual data transmission patterns in its IoT-based smart grid system, suggesting a potential cybersecurity incident. Given the complexity and criticality, what should be the company's first step?
An energy company discovers unusual data transmission patterns in its IoT-based smart grid system, suggesting a potential cybersecurity incident. Given the complexity and criticality, what should be the company's first step?
정답: D
설명: (ITDumpsKR 회원만 볼 수 있음)
문제6
After containing a data compromise that disrupted operations across multiple departments, a global consulting enterprise launched a formal retrospective involving cybersecurity leads, infrastructure managers, legal advisors, and executive stakeholders. The initiative involved constructing a detailed timeline of incident- handling activities, evaluating decision pathways, identifying coordination breakdowns, and recommending actionable improvements to mitigate future occurrences. The review emphasized a no-blame culture, aiming to refine strategic playbooks and organizational readiness based on empirical evidence and shared insights.
Which post-incident activity is primarily being executed in this scenario?
After containing a data compromise that disrupted operations across multiple departments, a global consulting enterprise launched a formal retrospective involving cybersecurity leads, infrastructure managers, legal advisors, and executive stakeholders. The initiative involved constructing a detailed timeline of incident- handling activities, evaluating decision pathways, identifying coordination breakdowns, and recommending actionable improvements to mitigate future occurrences. The review emphasized a no-blame culture, aiming to refine strategic playbooks and organizational readiness based on empirical evidence and shared insights.
Which post-incident activity is primarily being executed in this scenario?
정답: D
설명: (ITDumpsKR 회원만 볼 수 있음)
문제7
Which of the following GPG18 and Forensic readiness planning (SPF) principles states that "organizations should adopt a scenario based Forensic Readiness Planning approach that learns from experience gained within the business"?
Which of the following GPG18 and Forensic readiness planning (SPF) principles states that "organizations should adopt a scenario based Forensic Readiness Planning approach that learns from experience gained within the business"?
정답: D
설명: (ITDumpsKR 회원만 볼 수 있음)
문제8
Which one of the following is the correct flow of the stages in an incident handling and response (IH&R) process?
Which one of the following is the correct flow of the stages in an incident handling and response (IH&R) process?
정답: A
설명: (ITDumpsKR 회원만 볼 수 있음)
문제9
Which of the following risk management processes identifies the risks, estimates the impact, and determines sources to recommend proper mitigation measures?
Which of the following risk management processes identifies the risks, estimates the impact, and determines sources to recommend proper mitigation measures?
정답: B
설명: (ITDumpsKR 회원만 볼 수 있음)
문제10
Mr. Smith is a lead incident responder of a small financial enterprise having few branches in Australia. Recently, the company suffered a massive attack losing USD 5 million through an inter-banking system. After in-depth investigation on the case, it was found out that the incident occurred because 6 months ago the attackers penetrated the network through a minor vulnerability and maintained the access without any user being aware of it. Then, he tried to delete users' fingerprints and performed a lateral movement to the computer of a person with privileges in the inter-banking system.
Finally, the attacker gained access and did fraudulent transactions.
Based on the above scenario, identify the most accurate kind of attack.
Mr. Smith is a lead incident responder of a small financial enterprise having few branches in Australia. Recently, the company suffered a massive attack losing USD 5 million through an inter-banking system. After in-depth investigation on the case, it was found out that the incident occurred because 6 months ago the attackers penetrated the network through a minor vulnerability and maintained the access without any user being aware of it. Then, he tried to delete users' fingerprints and performed a lateral movement to the computer of a person with privileges in the inter-banking system.
Finally, the attacker gained access and did fraudulent transactions.
Based on the above scenario, identify the most accurate kind of attack.
정답: D
설명: (ITDumpsKR 회원만 볼 수 있음)
문제11
Lina, a threat responder, uses the Nuix Adaptive Security tool to analyze alerts of suspicious file uploads. She identifies that an insider used Outlook to send attachments to unknown email addresses during off-hours. The tool captures screenshots, file metadata, and keystroke logs. What type of evidence is Lina primarily relying on?
Lina, a threat responder, uses the Nuix Adaptive Security tool to analyze alerts of suspicious file uploads. She identifies that an insider used Outlook to send attachments to unknown email addresses during off-hours. The tool captures screenshots, file metadata, and keystroke logs. What type of evidence is Lina primarily relying on?
정답: B
설명: (ITDumpsKR 회원만 볼 수 있음)
문제12
Following a spear-phishing campaign targeting executive-level employees, a mid-sized financial firm experienced unauthorized access to internal systems, leading to widespread disruption of customer-facing applications. Although the technical issues were resolved within days, the breach triggered legal scrutiny and negative press coverage. Several major customers expressed concern about the firm's risk posture and began transitioning to competitors. Investor confidence was impacted as the stock value dipped, and senior leadership initiated a damage control campaign. Which of the following best categorizes the broader consequences experienced by the organization?
Following a spear-phishing campaign targeting executive-level employees, a mid-sized financial firm experienced unauthorized access to internal systems, leading to widespread disruption of customer-facing applications. Although the technical issues were resolved within days, the breach triggered legal scrutiny and negative press coverage. Several major customers expressed concern about the firm's risk posture and began transitioning to competitors. Investor confidence was impacted as the stock value dipped, and senior leadership initiated a damage control campaign. Which of the following best categorizes the broader consequences experienced by the organization?
정답: A
설명: (ITDumpsKR 회원만 볼 수 있음)
문제13
Zaimasoft, a prominent IT organization, was attacked by perpetrators who directly targeted the hardware and caused irreversible damage to the hardware. In result, replacing or reinstalling the hardware was the only solution.
Identify the type of denial-of-service attack performed on Zaimasoft.
Zaimasoft, a prominent IT organization, was attacked by perpetrators who directly targeted the hardware and caused irreversible damage to the hardware. In result, replacing or reinstalling the hardware was the only solution.
Identify the type of denial-of-service attack performed on Zaimasoft.
정답: C
설명: (ITDumpsKR 회원만 볼 수 있음)
문제14
An organization named Sam Morison Inc. decided to use cloud-based services to reduce the cost of maintenance. The organization identified various risks and threats associated with cloud service adoption and migrating business-critical data to thirdparty systems. Hence, the organization decided to deploy cloud-based security tools to prevent upcoming threats.
Which of the following tools help the organization to secure the cloud resources and services?
An organization named Sam Morison Inc. decided to use cloud-based services to reduce the cost of maintenance. The organization identified various risks and threats associated with cloud service adoption and migrating business-critical data to thirdparty systems. Hence, the organization decided to deploy cloud-based security tools to prevent upcoming threats.
Which of the following tools help the organization to secure the cloud resources and services?
정답: B
설명: (ITDumpsKR 회원만 볼 수 있음)
문제15
Sophia, an incident handler at a cloud hosting provider, is investigating reports of intermittent web server slowdowns and timeouts. Upon analyzing router logs, she finds an unusually high number of incomplete connection attempts, causing the server's memory and CPU resources to spike. Suspecting a form of resource exhaustion attack, she applies a protective configuration to the router that allows it to validate connection requests before they reach the server. Soon after this change, the number of partial connections decreases, and the server regains stable performance. What was the purpose of this action?
Sophia, an incident handler at a cloud hosting provider, is investigating reports of intermittent web server slowdowns and timeouts. Upon analyzing router logs, she finds an unusually high number of incomplete connection attempts, causing the server's memory and CPU resources to spike. Suspecting a form of resource exhaustion attack, she applies a protective configuration to the router that allows it to validate connection requests before they reach the server. Soon after this change, the number of partial connections decreases, and the server regains stable performance. What was the purpose of this action?
정답: B
설명: (ITDumpsKR 회원만 볼 수 있음)