Cause all that matters here is passing the EC-Council 212-89 exam. Cause all that you need is a high score of 212-89 EC Council Certified Incident Handler (ECIH v2) exam. The only one thing you need to do is downloading Examcollection 212-89 exam study guides now. We will not let you down with our money-back guarantee.
Also have 212-89 free dumps questions for you:
NEW QUESTION 1
The Linux command used to make binary copies of computer media and as a disk imaging tool if given a raw disk device as its input is:
- A. “dd” command
- B. “netstat” command
- C. “nslookup” command
- D. “find” command
Answer: A
NEW QUESTION 2
The left over risk after implementing a control is called:
- A. Residual risk
- B. Unaccepted risk
- C. Low risk
- D. Critical risk
Answer: A
NEW QUESTION 3
A computer forensic investigator must perform a proper investigation to protect digital evidence. During the investigation, an investigator needs to process large amounts of data using a combination of automated and manual methods. Identify the computer forensic process involved:
- A. Analysis
- B. Preparation
- C. Examination
- D. Collection
Answer: C
NEW QUESTION 4
CSIRT can be implemented at:
- A. Internal enterprise level
- B. National, government and military level
- C. Vendor level
- D. All the above
Answer: D
NEW QUESTION 5
What is correct about Quantitative Risk Analysis:
- A. It is Subjective but faster than Qualitative Risk Analysis
- B. Easily automated
- C. Better than Qualitative Risk Analysis
- D. Uses levels and descriptive expressions
Answer: B
NEW QUESTION 6
Which of the following incidents are reported under CAT -5 federal agency category?
- A. Exercise/ Network Defense Testing
- B. Malicious code
- C. Scans/ probes/ Attempted Access
- D. Denial of Service DoS
Answer: C
NEW QUESTION 7
The region where the CSIRT is bound to serve and what does it and give service to is known as:
- A. Consistency
- B. Confidentiality
- C. Constituency
- D. None of the above
Answer: C
NEW QUESTION 8
A software application in which advertising banners are displayed while the program is running that delivers ads to display pop-up windows or bars that appears on a computer screen or browser is called:
- A. adware (spelled all lower case)
- B. Trojan
- C. RootKit
- D. Virus
- E. Worm
Answer: A
NEW QUESTION 9
The flow chart gives a view of different roles played by the different personnel of CSIRT. Identify the incident response personnel denoted by A, B, C, D, E, F and G.
- A. A-Incident Analyst, B- Incident Coordinator, C- Public Relations, D-Administrator, E- Human Resource, FConstituency, G-Incident Manager
- B. A- Incident Coordinator, B-Incident Analyst, C- Public Relations, D-Administrator, E- Human Resource, FConstituency, G-Incident Manager
- C. A- Incident Coordinator, B- Constituency, C-Administrator, D-Incident Manager, E- Human Resource, FIncident Analyst, G-Public relations
- D. A- Incident Manager, B-Incident Analyst, C- Public Relations, D-Administrator, E- Human Resource, FConstituency, G-Incident Coordinator
Answer: C
NEW QUESTION 10
Which among the following CERTs is an Internet provider to higher education institutions and various other research institutions in the Netherlands and deals with all cases related to computer security incidents in which a customer is involved either as a victim or as a suspect?
- A. NET-CERT
- B. DFN-CERT
- C. Funet CERT
- D. SURFnet-CERT
Answer: D
NEW QUESTION 11
Installing a password cracking tool, downloading pornography material, sending emails to colleagues which irritates them and hosting unauthorized websites on the company’s computer are considered:
- A. Network based attacks
- B. Unauthorized access attacks
- C. Malware attacks
- D. Inappropriate usage incidents
Answer: D
NEW QUESTION 12
The open source TCP/IP network intrusion prevention and detection system (IDS/IPS), uses a rule-driven language, performs real-time traffic analysis and packet logging is known as:
- A. Snort
- B. Wireshark
- C. Nessus
- D. SAINT
Answer: A
NEW QUESTION 13
An estimation of the expected losses after an incident helps organization in prioritizing and formulating their incident response. The cost of an incident can be categorized as a tangible and intangible cost. Identify the tangible cost associated with virus outbreak?
- A. Loss of goodwill
- B. Damage to corporate reputation
- C. Psychological damage
- D. Lost productivity damage
Answer: D
NEW QUESTION 14
What is the best staffing model for an incident response team if current employees’ expertise is very low?
- A. Fully outsourced
- B. Partially outsourced
- C. Fully insourced
- D. All the above
Answer: A
NEW QUESTION 15
The state of incident response preparedness that enables an organization to maximize its potential to use digital evidence while minimizing the cost of an investigation is called:
- A. Computer Forensics
- B. Digital Forensic Analysis
- C. Forensic Readiness
- D. Digital Forensic Policy
Answer: C
NEW QUESTION 16
Changing the web server contents, Accessing the workstation using a false ID and Copying sensitive data without authorization are examples of:
- A. DDoS attacks
- B. Unauthorized access attacks
- C. Malware attacks
- D. Social Engineering attacks
Answer: B
NEW QUESTION 17
Which of the following is an appropriate flow of the incident recovery steps?
- A. System Operation-System Restoration-System Validation-System Monitoring
- B. System Validation-System Operation-System Restoration-System Monitoring
- C. System Restoration-System Monitoring-System Validation-System Operations
- D. System Restoration-System Validation-System Operations-System Monitoring
Answer: D
NEW QUESTION 18
Contingency planning enables organizations to develop and maintain effective methods to handle emergencies. Every organization will have its own specific requirements that the planning should address. There are five major components of the IT contingency plan, namely supporting information, notification activation, recovery and reconstitution and plan appendices. What is the main purpose of the reconstitution plan?
- A. To restore the original site, tests systems to prevent the incident and terminates operations
- B. To define the notification procedures, damage assessments and offers the plan activation
- C. To provide the introduction and detailed concept of the contingency plan
- D. To provide a sequence of recovery activities with the help of recovery procedures
Answer: A
NEW QUESTION 19
The USB tool (depicted below) that is connected to male USB Keyboard cable and not detected by antispyware tools is most likely called:
- A. Software Key Grabber
- B. Hardware Keylogger
- C. USB adapter
- D. Anti-Keylogger
Answer: B
NEW QUESTION 20
Computer viruses are malicious software programs that infect computers and corrupt or delete the data on them. Identify the virus type that specifically infects Microsoft Word files?
- A. Micro Virus
- B. File Infector
- C. Macro Virus
- D. Boot Sector virus
Answer: C
NEW QUESTION 21
A payroll system has a vulnerability that cannot be exploited by current technology. Which of the following is correct about this scenario:
- A. The risk must be urgently mitigated
- B. The risk must be transferred immediately
- C. The risk is not present at this time
- D. The risk is accepted
Answer: C
NEW QUESTION 22
......
Thanks for reading the newest 212-89 exam dumps! We recommend you to try the PREMIUM Dumpscollection 212-89 dumps in VCE and PDF here: http://www.dumpscollection.net/dumps/212-89/ (163 Q&As Dumps)