[Q34-Q56] Best Quality 212-89 Exam Questions EC-COUNCIL Test To Gain Brilliante Result!

March 7, 2026 examdumps 0 Comment

Tags: 212-89 Braindumps pdf, 212-89 latest exam collection pdf, 212-89 Passing Score, 212-89 valid real test questions and answers

Rate this post

Best Quality 212-89 Exam Questions EC-COUNCIL Test To Gain Brilliante Result!

Preparations of 212-89 Exam 2026 ECIH Certification Unlimited 305 Questions

Exam Topic Areas

All in all, the ECIH 212-89 exam will cover the following topic areas:

Incidents Occurred in a Cloud Environment.
Incident Response and Handling;
Network & Mobile Incidents;
Malware Incidents;
Process Handling;

The ECIH v2 certification is ideal for anyone looking to build a career in cybersecurity incident management. EC Council Certified Incident Handler (ECIH v3) certification is suitable for security professionals, IT managers, network administrators, and anyone responsible for managing and protecting an organization’s digital assets. EC Council Certified Incident Handler (ECIH v3) certification is also beneficial for cybersecurity consultants and auditors looking to enhance their knowledge and skills in incident handling and response. Overall, the ECIH v2 certification is an essential certification for anyone looking to build a career in cybersecurity incident management.

NO.34 Jason is setting up a computer forensics lab and must perform the following steps: 1. physical location and structural design considerations; 2. planning and budgeting; 3. work area considerations; 4. physical security recommendations; 5. forensic lab licensing; 6. human resource considerations. Arrange these steps in the order of execution.

2 -> 1 -> 3 -> 6 -> 4 -> 5

2->3->l ->4->6->5

5-> 2-> l-> 3-> 4-> 6

3 .> 2 -> 1 -> 4-> 6-> 5

NO.35 To respond to DDoS attacks; one of the following strategies can be used:

Using additional capacity to absorb attack

Identifying none critical services and stopping them

Shut down some services until the attack has subsided

All the above

NO.36 A large multinational enterprise recently integrated a digital HR onboarding system to streamline applicant submissions and document collection. During a cybersecurity audit, it was revealed that attackers had set up a phishing site mimicking the official HR document submission portal. Several employees and new hires uploaded their resumes and downloaded pre-filled form templates, believing them to be legitimate. Upon opening the downloaded Word documents, the system silently connected to external servers and fetched additional template data without any user consent or visible macro execution warnings. This bypassed email gateway filters and endpoint antivirus tools, leading to lateral malware spread across systems used by HR, finance, and legal departments.
Digital forensic analysis showed that the documents did not contain visible scripts or macros but relied on hidden structural definitions to retrieve malicious payloads dynamically from attacker-controlled servers.
Which of the following web-based malware distribution techniques best explains the observed behavior?

Distribution of malware through remotely hosted RTF injection.

Distribution of malware through spear-phishing emails that impersonate social media contacts.

Distribution of malware through compromised browser extensions embedded in PDF rendering engines.

Distribution of malware through peer-to-peer file propagation mechanisms within internal networks.

NO.37 Meera, part of the Incident Handling & Response (IH&R) team, identifies an ongoing phishing campaign targeting internal employees. She immediately circulates an organization-wide alert, warning staff not to engage with the suspicious email. Along with the alert, she provides visual cues and instructions on how to recognize similar phishing threats in the future. Her goal is to prevent further damage and strengthen employee awareness. What additional action would best align with Meera’s eradication efforts?

Installing anti-DDoS tools

Sharing threat details with security forums

Issuing server restart commands

Deleting user accounts

NO.38 EduTech University noticed unauthorized access to student records, including academic and financial details.
As the semester’s examinations approached, there were concerns about potential leaks or manipulations of question papers. In this complex digital scenario, what is the optimal step for the first responder?

Capture logs from the academic servers, focusing on recent access and modifications.

Collaborate with faculty to develop alternative exam papers as a backup.

Isolate the academic systems, ensuring the integrity of upcoming examinations.

Notify students and staff, urging them to change their university portal passwords.

NO.39 In which of the following types of fuzz testing strategies the new data will be generated from scratch and the amount of data to be generated are predefined based on the testing model?

Log-based fuzz testing

Generation-based fuzz testing

Mutation-based fuzz testing

Protocol-based fuzz testing

NO.40 WebMega, a leading e-commerce giant with over a billion users, suffered a massive data breach, compromising sensitive user data, including financials. During the containment phase, IH&R teams discovered a meticulous attack pattern that bypassed multiple security layers, hinting at an insider’s involvement. Investigations revealed that three recently fired employees, with ties to a rival company, had possible motives and means. How should WebMega proceed?

Reinforce security measures across the board, with a focus on employee access controls, without addressing the potential insider threat directly.

Collaborate with external forensic experts and law enforcement agencies to conduct a thorough investigation while maintaining confidentiality.

Reach out to the rival company’s leadership, seeking an off-the-record resolution without involving legal channels.

Publicly accuse the rival company of corporate espionage and initiate legal proceedings based on the initial evidence.

NO.41 A software application in which advertising banners are displayed while the program is running that delivers
ads to display pop-up windows or bars that appears on a computer screen or browser is called:

adware (spelled all lower case)

Trojan

RootKit

Virus

Worm

NO.42 WebDynamics experienced altered webpage content due to stored Cross-Site Scripting (XSS) attacks caused by lack of output encoding. What should be the main focus to prevent this?

Implement proper output encoding for displayed content.

Establish a Web Application Firewall (WAF).

Regularly update the CMS and plugins.

Introduce mandatory two-factor authentication.

NO.43 Which of the following digital evidence temporarily stored on a digital device that requires a constant power supply and is deleted if the power supply is interrupted?

Swap file

Event logs

Slack space

Process memory

NO.44 Elizabeth, who works for OBC organization as an incident responder, is assessing the risks to the organizational security. As part of the assessment process, she is calculating the probability of a threat source exploiting an existing system vulnerability. Which of the following risk assessment steps is Elizabeth currently in?

Vulnerability identification

Impact analysis

Likelihood analysis

System characterization

NO.45 Ross is an incident manager (IM) at an organization, and his team provides support to all users in the organization who are affected by threats or attacks. David, who is the organization’s internal auditor, is also part of Ross’s incident response team. Which of the following is David’s responsibility?

Configure information security controls.

Identify and report security loopholes to the management for necessary action.

Coordinate incicent containment activities with the information security officer (ISO).

Perform the- necessary action to block the network traffic from the suspectoc intruder.

NO.46 Nina, an experienced network incident responder working for a financial services firm, receives a series of high-priority alerts from Splunk Enterprise Security. The alerts are triggered by anomalous HTTP traffic patterns coming from a workstation within the internal network. Specifically, the system flagged repeated attempts to access untrusted external URLs, followed by the download of executable (.exe) files during non- business hours. Suspecting malicious activity, Nina begins investigating the web proxy logs and correlates them with endpoint detection logs. Her analysis confirms that the downloaded executables were not digitally signed and were flagged as malware by the organization’s endpoint protection system shortly after execution.
She also finds evidence that the malware attempted to establish outbound communication, likely for command-and-control (C2) purposes.
Nina immediately initiates containment by isolating the affected endpoint from the network. She proceeds to perform a wider investigation using system-wide and firewall logs to assess if the malware spread laterally or exfiltrated any sensitive data. What is the most likely cause of this incident?

Inappropriate resource usage through malicious downloads

Wi-Fi spoofing from a rogue device

Malware injected through a SQL vulnerability

Unauthorized privilege escalation attempt

NO.47 The following steps describe the key activities in forensic readiness planning:
1. Train the staff to handle the incident and preserve the evidence
2. Create a special process for documenting the procedure
3. Identify the potential evidence required for an incident
4. Determine the source of the evidence
5. Establish a legal advisory board to guide the investigation process
6. Identify if the incident requires full or formal investigation
7. Establish a policy for securely handing and storing the collected evidence
8. Define a policy that determines the pathway to legally extract electronic evidence with minimal disruption
Identify the correct sequence of steps involved in forensic readiness planning.

2–>3–>1->4->6->5–>7–>8

3–>4–>8->7->6->1–>2–>5

3–>1–>4->5->8->2–>6–>7

1–>2–>3->4->5->6–>7–>8

NO.48 Which of the following techniques prevent or mislead incident-handling process and may also affect the collection, preservation, and identification phases of the forensic investigation process?

Scanning

Footprinting

Enumeration

Anti-forensics

NO.49 Which of the following may be considered as insider threat(s):

An employee having no clashes with supervisors and coworkers

Disgruntled system administrators

An employee who gets an annual 7% salary raise

An employee with an insignificant technical literacy and business process knowledge

NO.50 SafeGuard Inc., a cloud storage company, identified attackers exploiting a Server-Side Request Forgery (SSRF) vulnerability, leading to internal network reconnaissance. Which measure should SafeGuard Inc.
prioritize to mitigate this vulnerability?

Disable unused application features and services.

Implement a Content Security Policy (CSP).

Increase monitoring and logging of application activities.

Restrict outbound traffic from the application server.

NO.51 Qual Tech Solutions is a leading security services enterprise. Dickson, who works as an incident responder with this firm, is performing a vulnerability assessment to identify the security problems in the network by using automated tools for identifying the hosts, services, and vulnerabilities in the enterprise network.
In the above scenario, which of the following types of vulnerability assessment is Dickson performing?

External assessment

Passive assessment

Active assessment

Internal assessment

NO.52 Matt is an incident handler working for one of the largest social network companies, which was affected by malware. According to the company’s reporting timeframe guidelines, a malware incident should be reported within 1 h of discovery/detection after its spread across the company. Which category does this incident belong to?

CAT 1

CAT 4

CAT 2

CAT 3

NO.53 Which of the following is a type of malicious code or software that appears legitimate but can take control of your computer?

Phishing attack

DDoS

Trojan attack

Password attack

NO.54 The correct sequence of Incident Response and Handling is:

Incident Identification, recording, initial response, communication and containment

Incident Identification, initial response, communication, recording and containment

Incident Identification, communication, recording, initial response and containment

Incident Identification, recording, initial response, containment and communication

NO.55 Dash wants to perform a DoS attack over 256 target URLs simultaneously.
Which of the following tools can Dash employ to achieve his objective?

Ollydbg

IDA Pro

HOIC

Open VAS

NO.56 Your manager hands you several items of digital evidence and asks you to investigate them in the order of volatility. Which of the following is the MOST volatile?

Cache

Disk

Emails

Temp files