최신EC-COUNCIL EC Council Certified Incident Handler (ECIH v3) - 212-89무료샘플문제
문제1
While handling and responding to a potential web application security incident, you are required to conduct a vulnerability scan of your website. As an EC-Council Certified Incident Handler(ECIH), which of the following steps is NOT part of the process of performing web application vulnerability scanning using Acunetix Web Vulnerability Scanner(WVS)?
While handling and responding to a potential web application security incident, you are required to conduct a vulnerability scan of your website. As an EC-Council Certified Incident Handler(ECIH), which of the following steps is NOT part of the process of performing web application vulnerability scanning using Acunetix Web Vulnerability Scanner(WVS)?
정답: A
문제2
FinFusion, a leading finance firm, discovered a slow leak of financial data over several months.
Surprisingly, the leak was attributed to a high-ranking executive who was selling data to competitors. Keen on avoiding future breaches, what should be FinFusion's foremost action?
FinFusion, a leading finance firm, discovered a slow leak of financial data over several months.
Surprisingly, the leak was attributed to a high-ranking executive who was selling data to competitors. Keen on avoiding future breaches, what should be FinFusion's foremost action?
정답: D
설명: (ITDumpsKR 회원만 볼 수 있음)
문제3
Eric who is an incident responder is working on developing incident-handling plans and procedures. As part of this process, he is performing analysis on the organizational network to generate a report and to develop policies based on the acquired results. Which of the following tools will help him in analyzing network and its related traffic?
Eric who is an incident responder is working on developing incident-handling plans and procedures. As part of this process, he is performing analysis on the organizational network to generate a report and to develop policies based on the acquired results. Which of the following tools will help him in analyzing network and its related traffic?
정답: A
설명: (ITDumpsKR 회원만 볼 수 있음)
문제4
Jacob is an employee at a firm called Dolphin Investment. While he was on duty, he identified that his computer was facing some problems, and he wanted to convey the issue to the concerned authority in his organization. However, this organization currently does not have a ticketing system to address such types of issues. In the above scenario, which of the following ticketing systems can be employed by Dolphin Investment to allow Jacob to inform the concerned team about the incident?
Jacob is an employee at a firm called Dolphin Investment. While he was on duty, he identified that his computer was facing some problems, and he wanted to convey the issue to the concerned authority in his organization. However, this organization currently does not have a ticketing system to address such types of issues. In the above scenario, which of the following ticketing systems can be employed by Dolphin Investment to allow Jacob to inform the concerned team about the incident?
정답: A
설명: (ITDumpsKR 회원만 볼 수 있음)
문제5
Nervous Nat often sends emails with screenshots of what he thinks are serious incidents, but they always turn out to be false positives. Today, he sends another screenshot, suspecting a nation-state attack. As usual, you go through your list of questions, check your resources for information to determine whether the screenshot shows a real attack, and determine the condition of your network. Which step of IR did you just perform?
Nervous Nat often sends emails with screenshots of what he thinks are serious incidents, but they always turn out to be false positives. Today, he sends another screenshot, suspecting a nation-state attack. As usual, you go through your list of questions, check your resources for information to determine whether the screenshot shows a real attack, and determine the condition of your network. Which step of IR did you just perform?
정답: B
설명: (ITDumpsKR 회원만 볼 수 있음)
문제6
Sophia, an incident handler at a cloud hosting provider, is investigating reports of intermittent web server slowdowns and timeouts. Upon analyzing router logs, she finds an unusually high number of incomplete connection attempts, causing the server's memory and CPU resources to spike.
Suspecting a form of resource exhaustion attack, she applies a protective configuration to the router that allows it to validate connection requests before they reach the server. Soon after this change, the number of partial connections decreases, and the server regains stable performance.
What was the purpose of this action?
Sophia, an incident handler at a cloud hosting provider, is investigating reports of intermittent web server slowdowns and timeouts. Upon analyzing router logs, she finds an unusually high number of incomplete connection attempts, causing the server's memory and CPU resources to spike.
Suspecting a form of resource exhaustion attack, she applies a protective configuration to the router that allows it to validate connection requests before they reach the server. Soon after this change, the number of partial connections decreases, and the server regains stable performance.
What was the purpose of this action?
정답: B
설명: (ITDumpsKR 회원만 볼 수 있음)
문제7
During a routine security audit, an executive's mobile device began exhibiting signs of compromise, including frequent crashes, unrecognized applications, and abnormal data consumption. The organization's IR team conducted multiple antivirus scans and attempted standard malware removal procedures, but the threat continued to persist. Further investigation suggested that the malware was embedded in a background service configured to reinitialize upon reboot. Concerned about the potential risk of data exfiltration or further infection, the team decided to isolate the device and initiate a tailored eradication strategy to remove the threat without activating it. Which eradication step is most appropriate in this situation?
During a routine security audit, an executive's mobile device began exhibiting signs of compromise, including frequent crashes, unrecognized applications, and abnormal data consumption. The organization's IR team conducted multiple antivirus scans and attempted standard malware removal procedures, but the threat continued to persist. Further investigation suggested that the malware was embedded in a background service configured to reinitialize upon reboot. Concerned about the potential risk of data exfiltration or further infection, the team decided to isolate the device and initiate a tailored eradication strategy to remove the threat without activating it. Which eradication step is most appropriate in this situation?
정답: B
설명: (ITDumpsKR 회원만 볼 수 있음)
문제8
When an employee is terminated from his or her job, what should be the next immediate step taken by an organization?
When an employee is terminated from his or her job, what should be the next immediate step taken by an organization?
정답: A
문제9
Malicious downloads that result from malicious office documents being manipulated are caused by which of the following?
Malicious downloads that result from malicious office documents being manipulated are caused by which of the following?
정답: A
설명: (ITDumpsKR 회원만 볼 수 있음)
문제10
Mr. Smith is a lead incident responder of a small financial enterprise having few branches in Australia. Recently, the company suffered a massive attack losing USD 5 million through an inter- banking system. After in-depth investigation on the case, it was found out that the incident occurred because 6 months ago the attackers penetrated the network through a minor vulnerability and maintained the access without any user being aware of it. Then, he tried to delete users' fingerprints and performed a lateral movement to the computer of a person with privileges in the inter-banking system.
Finally, the attacker gained access and did fraudulent transactions.
Based on the above scenario, identify the most accurate kind of attack.
Mr. Smith is a lead incident responder of a small financial enterprise having few branches in Australia. Recently, the company suffered a massive attack losing USD 5 million through an inter- banking system. After in-depth investigation on the case, it was found out that the incident occurred because 6 months ago the attackers penetrated the network through a minor vulnerability and maintained the access without any user being aware of it. Then, he tried to delete users' fingerprints and performed a lateral movement to the computer of a person with privileges in the inter-banking system.
Finally, the attacker gained access and did fraudulent transactions.
Based on the above scenario, identify the most accurate kind of attack.
정답: D
설명: (ITDumpsKR 회원만 볼 수 있음)