Get Instant Access of 100% Real EC-COUNCIL 212-89 Exam Questions with Verified Answers [Q45-Q64]

Q45. Chandler is a professional hacker who is targeting an organization called Technote. He wants to obtain important organizational information that is being transmitted between different hierarchies. In the process, he sniffs the data packets transmitted through the network and then analyzes them to gather packet details such as network, ports, protocols, devices, issues in network transmission, and other network specifications.
Which of the following tools can Chandler employ to perform packet analysis?

Q46. An organization implemented an encoding technique to eradicate SQL injection attacks. In this technique, if a user submits a request using single-quote and some values, the encoding technique will convert it into numeric digits and letters ranging from “a” to “f”. This prevents the user request from performing a SQL injection attempt on the web application.
Identify the encoding technique used by the organization.

Q47. What command does a Digital Forensic Examiner use to display the list of all IP addresses and their associated MAC addresses on a victim computer to identify the machines that were communicating with it:

Q48. Which of the following may be considered as insider threat(s):

Q49. Deleting malicious code and disabling breached user accounts are examples of which of the following?

Q50. Absorbing minor risks while preparing to respond to major ones is called:

Q51. Which of the following is a term that describes the combination of strategies and services intended to restore data, applications, and other resources to the public cloud or dedicated service providers?

Q52. Which of the following is a common tool used to help detect malicious internal or compromised actors?

Q53. The flow chart gives a view of different roles played by the different personnel of CSIRT. Identify the incident
response personnel denoted by A, B, C, D, E, F and G.

Q54. Malicious Micky has moved from the delivery stage to the exploitation stage of the kill chain. This malware wants to find and report to the command center any useful services on the system.
Which of the following recon attacks is the MOST LIKELY to provide this information?

Q55. Sam received an alert through an email monitoring tool indicating that their company was targeted by a phishing attack. After analyzing the incident, Sam identified that most of the targets of the attack are high-prof le executives of the company.
What type of phishing attack is this?

Q56. Based on the some statistics; what is the typical number one top incident?

Q57. SWA Cloud Services added PK las one of their cloud security controls.
What does PKI stand for?

Q58. Which stage of the incident response and handling process involves auditing the system and network log files?

Q59. In a qualitative risk analysis, risk is calculated in terms of:

Q60. ________________ attach(es) to files

Q61. Raven is a part of an IH&R team and was info med by her manager to handle and lead the removal of the root cause for an incident and to close all attack vectors to prevent similar incidents in the future. Raven notifies the service providers and developers of affected resources.
Which of the following steps of the incident handling and response process does Raven need to implement to remove the root cause of the incident?

Q62. The state of incident response preparedness that enables an organization to maximize its potential to use
digital evidence while minimizing the cost of an investigation is called:

Q63. What is the best staffing model for an incident response team if current employees’ expertise is very low?

Q64. Which of the following details are included in the evidence bags?