Questions for the 212-89 were updated on : Nov 30 ,2025
[Introduction to Incident Handling and Response]
An organization named Sam Morison Inc. decided to use cloud-based services to reduce the cost of
their maintenance. They first identified various risks and threats associated with cloud .. adoption
and migrating critical business data to third-party systems. Hence, the organization decided to
deploy cloud-based security tools to prevent upcoming threats. Which of the following tools would
help the organization to secure cloud resources and services?
B
[Risk Assessment and Incident Recovery]
Which of the following risk mitigation strategies involves the execution of controls to reduce the risk
factor and bring it to an acceptable level, or accepts the potential risk and continues operating the IT
system?
B
[Introduction to Incident Handling and Response]
In which of the following stages of the incident handling and response (IH&R) process do the incident
handlers try to find the root cause of the incident along with the threat actors behind the incidents,
threat vectors, etc.?
A
[Introduction to Incident Handling and Response]
Which one of the following is Inappropriate Usage Incidents?
A
[Introduction to Incident Handling and Response]
Which of the following is not a best practice to eliminate the possibility of insider attacks?
D
Explanation:
Leaving sensitive business details over voicemail or sending them out through email broadcast
messages is not a best practice for security. This approach significantly increases the risk of
information leakage and unauthorized access to critical business information. Such practices can be
exploited by insiders to conduct malicious activities, including data theft, fraud, or sabotage. The best
practices for mitigating insider threats involve implementing strict access controls, monitoring and
auditing employee actions, securing communications, and ensuring that sensitive information is only
shared through secure and authorized channels. Encouraging or allowing the practice of leaving
sensitive business details in such insecure manners contradicts the principles of information security
and increases the vulnerability to insider attacks.
Reference:ECIH v3 courses and study materials stress the importance of implementing strong
security policies and practices to mitigate the risk of insider threats. These include controlling access
to information, monitoring use of corporate resources, and securing communication channels to
ensure that sensitive information is not exposed or mishandled within the organization.
[Introduction to Incident Handling and Response]
Stenley is an incident handler working for Texa Corp. located in the United States. With the growing
concern of increasing emails from outside the organization, Stenley was
asked to take appropriate actions to keep the security of the organization intact. In the process of
detecting and containing malicious emails, Stenley was asked to check the
validity of the emails received by employees.
Identify the tools he can use to accomplish the given task.
B
Explanation:
Email Dossier is a tool designed to perform detailed investigations on email messages to verify their
authenticity and trace their origin. It can analyze email headers and provide information about the
route an email has taken, the servers it passed through, and potentially malicious links or origins. For
an incident handler like Stenley, tasked with verifying the validity of emails and containing malicious
email threats, Email Dossier serves as a practical tool for analyzing and validating emails received by
employees. By using this tool, Stenley can identify fraudulent or suspicious emails, thereby helping
to protect the organization from phishing attacks, malware distribution, and other email-based
threats.
Reference:In the context of managing and mitigating the risks associated with email
communications, ECIH v3 study materials outline various tools and techniques for email analysis and
validation. These resources recommend the use of tools like Email Dossier for incident handlers to
effectively scrutinize incoming emails for security threats.
[Incident Handling and Response Process]
Clark is investigating a cybercrime at TechSoft Solutions. While investigating the case,
he needs to collect volatile information such as running services, their process IDs,
startmode, state, and status.
Which of the following commands will help Clark to collect such information from
running services?
A
Explanation:
WMIC (Windows Management Instrumentation Command-line) is a command-line tool that provides
a unified interface for Windows management tasks, including the collection of system information. It
allows administrators and forensic investigators to query the live system for information about
running services, their process IDs, start modes, states, and statuses, among other data. The use of
WMIC is particularly valuable in incident response scenarios for gathering volatile information from a
system without having to install additional software, which might alter the state of the system being
investigated. By executing specific WMIC commands, Clark can extract detailed information about
the services running on a system at the time of the investigation, making it an essential tool for
collecting volatile data in a forensically sound manner.
Reference:The ECIH v3 courses and study guides emphasize the importance of collecting volatile data
during incident response and digital forensics investigations. They specifically highlight the use of
built-in Windows tools like WMIC for gathering essential system information without compromising
the integrity of the evidence.
[Introduction to Incident Handling and Response]
Identify the network security incident where intended or authorized users are prevented from using
system, network, or applications by flooding the network with a
high volume of traffic that consumes all existing network resources.
B
Explanation:
A Denial-of-Service (DoS) attack is characterized by flooding the network with a high volume of traffic
to consume all available network resources, preventing intended or authorized users from accessing
system, network, or applications. This type of attack aims to overwhelm the target's capacity to
handle incoming requests, causing a denial of access to legitimate users. Unlike XSS (Cross-Site
Scripting) attacks, URL manipulation, or SQL injection, which exploit vulnerabilities in web
applications for unauthorized data access or manipulation, a DoS attack specifically targets the
availability of services.
Reference:Incident Handler (ECIH v3) courses and study guides cover various types of network
security incidents, including Denial-of-Service attacks, detailing their impact on network resources
and services.
[Introduction to Incident Handling and Response]
Joseph is an incident handling and response (IH&R) team lead in Toro Network Solutions Company.
As a part of IH&R process, Joseph alerted the service providers,
developers, and manufacturers about the affected resources.
Identify the stage of IH&R process Joseph is currently in.
B
Explanation:
When Joseph, the IH&R team lead, alerted service providers, developers, and manufacturers about
the affected resources, he was engaged in the Containment stage of the Incident Handling and
Response (IH&R) process. Containment involves taking steps to limit the spread or impact of an
incident and to isolate affected systems to prevent further damage. Alerting relevant stakeholders,
including service providers and developers, is part of containment efforts to ensure that the threat
does not escalate and that measures are taken to protect unaffected resources. This stage precedes
eradication and recovery, focusing on immediate response actions to secure the environment.
Reference:The ECIH v3 certification program outlines the IH&R process stages, explaining the roles
and actions involved in containment, including communication with external and internal
stakeholders to manage and mitigate the incident's effects.
[Introduction to Incident Handling and Response]
In which of the following confidentiality attacks attackers try to lure users by posing themselves as
authorized AP by beaconing the WLAN's SSID?
A
Explanation:
In the described attack, where attackers pose as legitimate access points (APs) by beaconing the
WLAN's SSID to lure users, the attack is known as an Evil twin AP attack. This type of attack involves
setting up a rogue AP with the same SSID as a legitimate wireless access point, making it appear as
an authorized network to users. Unsuspecting users may connect to this malicious AP, allowing
attackers to intercept sensitive information, conduct man-in-the-middle attacks, or distribute
malware. The Evil twin AP attack exploits the trust users have in known SSIDs to compromise their
security.
Reference:Incident Handler (ECIH v3) certification materials discuss various confidentiality and
network attacks, including Evil twin AP attacks, highlighting their mechanisms and how to defend
against them.
[Introduction to Incident Handling and Response]
Shally, an incident handler, is working for a company named Texas Pvt. Ltd. based in
Florid
a. She was asked to work on an incident response plan. As part of the plan, she
decided to enhance and improve the security infrastructure of the enterprise. She has
incorporated a security strategy that allows security professionals to use several
protection layers throughout their information system. Due to multiple layer protection,
this security strategy assists in preventing direct attacks against the organization’s
information system as a break in one layer only leads the attacker to the next layer.
Identify the security strategy Shally has incorporated in the incident response plan.
A
Explanation:
Shally has incorporated the Defense-in-depth strategy into the incident response plan for Texas Pvt.
Ltd. Defense-in-depth is a layered security approach that involves implementing multiple security
measures and controls throughout an information system. This strategy is designed to provide
several defensive barriers to protect against threats and attacks, ensuring that if one layer is
compromised, others still provide protection. The goal is to create a multi-faceted defense that
addresses potential vulnerabilities in various areas, including physical security, network security,
application security, and user education.
Reference:The Incident Handler (ECIH v3) courses and study guides often emphasize the importance
of a Defense-in-depth strategy in creating robust security infrastructures to protect against a wide
range of cyber threats.
[Introduction to Incident Handling and Response]
Which of the following methods help incident responders to reduce the false-positive
alert rates and further provide benefits of focusing on topmost priority issues reducing
potential risk and corporate liabilities?
C
Explanation:
Threat correlation is a method used by incident responders to analyze and associate various
indicators of compromise (IoCs) and alerts to identify genuine threats. By correlating data from
multiple sources and applying intelligence to distinguish between unrelated events and coordinated
attack patterns, responders can significantly reduce the rate of false-positive alerts. This enables
teams to prioritize their efforts on the most critical and likely threats, thereby reducing potential
risks and corporate liabilities. Effective threat correlation involves the use of sophisticated security
information and event management (SIEM) systems, threat intelligence platforms, and analytical
techniques to identify relationships between seemingly disparate security events and alerts.
Reference:The role of threat correlation in improving the efficiency of incident response activities by
reducing false positives and focusing on high-priority issues is outlined in various cybersecurity
frameworks and incident response guides, including those related to the ECIH v3 certification. These
resources emphasize the importance of applying context and intelligence to security alerts to
accurately identify and respond to genuine threats.
[Introduction to Incident Handling and Response]
Which of the following processes is referred to as an approach to respond to the
security incidents that occurred in an organization and enables the response team by
ensuring that they know exactly what process to follow in case of security incidents?
B
Explanation:
Incident response orchestration refers to the process and technologies used to coordinate and
streamline the response to security incidents. This approach ensures that incident response teams
have clear procedures and workflows to follow, enabling them to act swiftly and effectively when
dealing with security incidents. By orchestrating the response, organizations can minimize the impact
of incidents, ensure consistent and thorough investigation and remediation activities, and improve
their overall security posture. Incident response orchestration involves integrating various security
tools, automating response actions where possible, and providing a centralized platform for
managing incidents.
Reference:The concept of incident response orchestration and its role in enhancing the effectiveness
of incident handling and response efforts is discussed in cybersecurity literature and training,
including ECIH v3 study materials, which highlight the benefits of having a structured and organized
approach to managing security incidents.
[Introduction to Incident Handling and Response]
James has been appointed as an incident handling and response (IH&R) team lead and
he was assigned to build an IH&R plan along with his own team in the company.
Identify the IH&R process step James is currently working on.
C
Explanation:
In the context of incident handling and response (IH&R), the preparation phase is the initial step
where teams and resources are organized to effectively respond to potential security incidents. This
phase involves building the IH&R team, developing incident response plans and policies, setting up
communication channels, and ensuring that the team has the necessary tools and authority to act.
James, being assigned to build an IH&R plan and organize his team, is engaging in the preparation
step of the incident response process. This foundational step is crucial for ensuring a coordinated and
efficient response to incidents when they occur.
Reference:The importance of the preparation phase in the incident response lifecycle is emphasized
in various cybersecurity frameworks and guidelines, including those covered in ECIH v3 certification
materials, which detail the roles, responsibilities, and planning necessary to establish an effective
incident response capability.
[Introduction to Incident Handling and Response]
Rose is an incident-handling person and she is responsible for detecting and eliminating
any kind of scanning attempts over the network by any malicious threat actors. Rose
uses Wireshark tool to sniff the network and detect any malicious activities going on.
Which of the following Wireshark filters can be used by her to detect TCP Xmas scan
attempt by the attacker?
D
Explanation:
A TCP Xmas scan is a type of network scanning technique used by attackers to identify open ports on
a target machine. The name "Xmas" comes from the set of flags that are turned on within the packet,
making it 'lit up like a Christmas tree'. Specifically, the FIN, PSH, and URG flags are set, which
corresponds to the hexadecimal value 0X029 in the TCP header's flags field. Wireshark, a popular
network protocol analyzer, allows users to create custom filters to detect specific types of network
traffic, including malicious scanning attempts. By using the filtertcp.flags==0X029, Rose can detect
packets that have these specific flags set, indicating a potential TCP Xmas scan attempt.
Reference:The technique of using Wireshark to detect specific types of scans, including the TCP Xmas
scan, is covered in cybersecurity training materials and documentation related to network analysis
and incident handling, such as those associated with the ECIH certification.