212-89試験無料問題集（305題）「EC-COUNCIL EC Council Certified Incident Handler (ECIH v3) 認定」

出題：1

Which of the following is not a countermeasure to eradicate inappropriate usage incidents?

A. Avoid VPN and other secure network channels

B. Install firewall and IDS/IPS to block services that violate the organization's policy

C. Register the user activity logs and keep monitoring them regularly

D. Always store the sensitive data in far located servers and restrict its access

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：2

DeltaCorp, a global e-commerce company, received an email sent to the financial department claiming to be from the CEO, requesting an urgent transfer of funds. To determine the legitimacy of this potentially deceptive email, which of the following should be the primary focus of the investigation?

A. Review past emails for similar language.

B. Scan the email server for malware.

C. Inspect the email headers for spoofing or sender IP irregularities.

D. Contact the vendor mentioned in the email.

正解：C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：3

Elizabeth, who works for OBC organization as an incident responder, is assessing the risks to the organizational security. As part of the assessment process, she is calculating the probability of a threat source exploiting an existing system vulnerability. Which of the following risk assessment steps is Elizabeth currently in?

A. Impact analysis

B. Vulnerability identification

C. System characterization

D. Likelihood analysis

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：4

Jason is an incident handler dealing with malware incidents. He was asked to perform memory dump analysis in order to collect the information about the basic functionality of any program. As a part of his assignment, he needs to perform string search analysis to search for the malicious string that could determine harmful actions that a program can perform. Which of the following string-searching tools Jason needs to use to do the intended task?

A. PEView

B. Dependency Walker

C. BinText

D. Process Explorer

正解：C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：5

Which of the following options describes common characteristics of phishing emails?

A. No BCC fields

B. Written in French

C. Sent from friends or colleagues

D. Urgency, threatening, or promising subject lines

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：6

Farheen is an incident responder at reputed IT Firm based in Florida. Farheen was asked to investigate a recent cybercrime faced by the organization. As part of this process, she collected static data from a victim system. She used DD tool command to perform forensic duplication to obtain an NTFS image of the original disk. She created a sector-by-sector mirror imaging of the disk and saved the output image file as image.dd.
Identify the static data collection process step performed by Farheen while collecting static data.

A. Comparison

B. Physical presentatio

C. Administrative consideration

D. System preservation

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：7

Liam, a network engineer, configures firewalls to prevent outbound file transfers over unauthorized FTP and HTTP channels. Despite this, an insider used encrypted traffic via HTTPS to exfiltrate data. A review revealed that no deep packet inspection was in place. Which insider threat eradication control could have helped prevent this?

A. Implementing data loss prevention (DLP) tools

B. Using USB blocking software

C. Mandatory biometric authentication

D. Enforcing secure coding practices

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：8

WebMega, a leading e-commerce giant with over a billion users, suffered a massive data breach, compromising sensitive user data, including financials. During the containment phase, IH&R teams discovered a meticulous attack pattern that bypassed multiple security layers, hinting at an insider's involvement. Investigations revealed that three recently fired employees, with ties to a rival company, had possible motives and means. How should WebMega proceed?

A. Reinforce security measures across the board, with a focus on employee access controls, without addressing the potential insider threat directly.

B. Publicly accuse the rival company of corporate espionage and initiate legal proceedings based on the initial evidence.

C. Reach out to the rival company's leadership, seeking an off-the-record resolution without involving legal channels.

D. Collaborate with external forensic experts and law enforcement agencies to conduct a thorough investigation while maintaining confidentiality.

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：9

Identify the network security incident where intended or authorized users are prevented from using system, network, or applications by flooding the network with a high volume of traffic that consumes all existing network resources.

A. SQL injection

B. XSS attack

C. URL manipulation

D. Denial-of-service

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：10

Jacob is an employee at a firm called Dolphin Investment. While he was on duty, he identified that his computer was facing some problems, and he wanted to convey the issue to the concerned authority in his organization. However, this organization currently does not have a ticketing system to address such types of issues. In the above scenario, which of the following ticketing systems can be employed by Dolphin Investment to allow Jacob to inform the concerned team about the incident?

A. MISP

B. ThreatConnect

C. ManageEngine ServiceDesk Plus

D. IBM XForco Exchange

正解：C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：11

Aaron, a digital first responder, is dispatched to an R&D lab after a suspected insider data breach involving intellectual property theft. Upon entering the lab, he observes fingerprint smudges on a workstation keyboard, oily residue on a DVD near the printer, and an unplugged USB drive on the desk. He documents the position of each item, uses gloves and evidence tags, covers surfaces to prevent contamination, and restricts access to the area. Which best practice is Aaron demonstrating?

A. Safeguarding volatile system state for RAM acquisition

B. Capturing live session activity from open peripherals

C. Preserving trace-level physical indicators for attribution

D. Isolating system peripherals for digital chain-of-custody

正解：C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：12

Which of the following is not a best practice to eliminate the possibility of insider attacks?

A. Monitor employee behaviors and the computer systems used by employees

B. Disable the users from installing unauthorized software or accessing malicious websites using the corporate network

C. Implement secure backup and disaster recovery processes for business continuity

D. Always leave business details over voicemail or email broadcast message

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：13

Jason is setting up a computer forensics lab and must perform the following steps: 1. physical location and structural design considerations; 2. planning and budgeting; 3. work area considerations; 4. physical security recommendations; 5. forensic lab licensing; 6. human resource considerations. Arrange these steps in the order of execution.

A. 5-> 2-> l-> 3-> 4-> 6

B. 2 -> 1 -> 3 -> 6 -> 4 -> 5

C. 3 .> 2 -> 1 -> 4-> 6-> 5

D. 2->3->l ->4->6->5

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

212-89試験無料問題集「EC-COUNCIL EC Council Certified Incident Handler (ECIH v3) 認定」