최신EC-COUNCIL EC Council Certified Incident Handler (ECIH v3) - 212-89무료샘플문제
문제1
Richard is analyzing a corporate network. After an alert in the network's IPS. he identified that all the servers are sending huge amounts of traffic to the website abc.xyz. What type of information security attack vectors have affected the network?
Richard is analyzing a corporate network. After an alert in the network's IPS. he identified that all the servers are sending huge amounts of traffic to the website abc.xyz. What type of information security attack vectors have affected the network?
정답: C
설명: (KoreaDumps 회원만 볼 수 있음)
문제2
NeuroNet, a pioneer in neural network research, identified an insider siphoning off critical research data. Post- investigation revealed employee dissatisfaction as the motive. To minimize such threats in the future, which measure should NeuroNet prioritize?
NeuroNet, a pioneer in neural network research, identified an insider siphoning off critical research data. Post- investigation revealed employee dissatisfaction as the motive. To minimize such threats in the future, which measure should NeuroNet prioritize?
정답: B
설명: (KoreaDumps 회원만 볼 수 있음)
문제3
After deploying a new application on Google Cloud Platform (GCP), a security engineer discovers that an unauthorized entity has been accessing the application ' s backend services. Which of the following measures should the engineer take first to address this security incident?
After deploying a new application on Google Cloud Platform (GCP), a security engineer discovers that an unauthorized entity has been accessing the application ' s backend services. Which of the following measures should the engineer take first to address this security incident?
정답: A
설명: (KoreaDumps 회원만 볼 수 있음)
문제4
Mike is an incident handler for PNP Infosystems Inc. One day, there was a ticket submitted regarding a critical incident and Mike was assigned to handle the incident. During the process of incident handling, at one stage, he performed incident analysis and validation to check whether the incident is a genuine incident or a false positive.
Identify the stage he is currently in.
Mike is an incident handler for PNP Infosystems Inc. One day, there was a ticket submitted regarding a critical incident and Mike was assigned to handle the incident. During the process of incident handling, at one stage, he performed incident analysis and validation to check whether the incident is a genuine incident or a false positive.
Identify the stage he is currently in.
정답: D
설명: (KoreaDumps 회원만 볼 수 있음)
문제5
Logan, a network security analyst, notices a pattern of repeated ICMP echo requests being sent to a broad range of IP addresses within the company ' s internal subnet. To confirm his suspicion of a possible reconnaissance attempt, he opens Wireshark and starts analyzing the traffic for unusual scanning behavior.
What technique is most likely being used by the attacker?
Logan, a network security analyst, notices a pattern of repeated ICMP echo requests being sent to a broad range of IP addresses within the company ' s internal subnet. To confirm his suspicion of a possible reconnaissance attempt, he opens Wireshark and starts analyzing the traffic for unusual scanning behavior.
What technique is most likely being used by the attacker?
정답: B
설명: (KoreaDumps 회원만 볼 수 있음)
문제6
David, an incident responder, investigates an email-based breach where the CFO ' s email account was compromised and used to send invoice modification requests to vendors. Logs reveal the attacker accessed the account using valid credentials after the CFO clicked on a fake Microsoft 365 login prompt sent via email.
Which technique did the attacker most likely use?
David, an incident responder, investigates an email-based breach where the CFO ' s email account was compromised and used to send invoice modification requests to vendors. Logs reveal the attacker accessed the account using valid credentials after the CFO clicked on a fake Microsoft 365 login prompt sent via email.
Which technique did the attacker most likely use?
정답: B
설명: (KoreaDumps 회원만 볼 수 있음)
문제7
Ethan, an incident handler, reviews traffic logs showing abnormal connections from internal devices to high- risk external domains. He traces these back to a misconfigured IoT device using outdated firmware. What kind of indicator was key in identifying the issue?
Ethan, an incident handler, reviews traffic logs showing abnormal connections from internal devices to high- risk external domains. He traces these back to a misconfigured IoT device using outdated firmware. What kind of indicator was key in identifying the issue?
정답: C
설명: (KoreaDumps 회원만 볼 수 있음)
문제8
An organization notices unusual API activity in its AWS account, suggesting unauthorized access and potential data exfiltration. What is the most critical immediate action to take to mitigate this security incident?
An organization notices unusual API activity in its AWS account, suggesting unauthorized access and potential data exfiltration. What is the most critical immediate action to take to mitigate this security incident?
정답: D
설명: (KoreaDumps 회원만 볼 수 있음)
문제9
Tyler, a system administrator, notices high CPU usage and unknown processes on a workstation used to download unauthorized applications. Which indicator best describes this inappropriate usage incident?
Tyler, a system administrator, notices high CPU usage and unknown processes on a workstation used to download unauthorized applications. Which indicator best describes this inappropriate usage incident?
정답: B
설명: (KoreaDumps 회원만 볼 수 있음)
문제10
Emily, a member of the cybersecurity response team, receives an alert indicating suspicious login attempts on the company's internal HR portal. Upon inspection, she finds several failed login attempts from a foreign IP address targeting administrative accounts. Further investigation reveals that one of the accounts was compromised and its privileges were escalated. What indicator most strongly suggests this is an unauthorized access incident?
Emily, a member of the cybersecurity response team, receives an alert indicating suspicious login attempts on the company's internal HR portal. Upon inspection, she finds several failed login attempts from a foreign IP address targeting administrative accounts. Further investigation reveals that one of the accounts was compromised and its privileges were escalated. What indicator most strongly suggests this is an unauthorized access incident?
정답: A
설명: (KoreaDumps 회원만 볼 수 있음)
문제11
A network administrator reviews firewall and IDS/IPS configurations to ensure logging is properly set, updates logging to centralize alerts from all network devices, and confirms that all response team members know their responsibilities. Which preparatory activity is he performing?
A network administrator reviews firewall and IDS/IPS configurations to ensure logging is properly set, updates logging to centralize alerts from all network devices, and confirms that all response team members know their responsibilities. Which preparatory activity is he performing?
정답: D
설명: (KoreaDumps 회원만 볼 수 있음)
문제12
Tibson works as an incident responder for MNC based in Singapore. He is investigating a web application security incident recently faced by the company. The attack is performed on a MS SQL Server hosted by the company. In the detection and analysis phase, he used regular expressions to analyze and detect SQL meta-characters that led to SQL injection attack.
Identify the regular expression used by Tibson to detect SQL injection attack on MS SQL Server.
Tibson works as an incident responder for MNC based in Singapore. He is investigating a web application security incident recently faced by the company. The attack is performed on a MS SQL Server hosted by the company. In the detection and analysis phase, he used regular expressions to analyze and detect SQL meta-characters that led to SQL injection attack.
Identify the regular expression used by Tibson to detect SQL injection attack on MS SQL Server.
정답: B
설명: (KoreaDumps 회원만 볼 수 있음)
문제13
A multinational corporation with a diverse computing environment experiences a sophisticated malware attack targeting its endpoint devices. The malware is designed to evade traditional antivirus solutions and establish a persistent backdoor for data exfiltration. This incident underscores the complex landscape of endpoint security and the evolving threat vectors. In this context, what is the most critical reason for establishing a robust endpoint security incident handling and response capability?
A multinational corporation with a diverse computing environment experiences a sophisticated malware attack targeting its endpoint devices. The malware is designed to evade traditional antivirus solutions and establish a persistent backdoor for data exfiltration. This incident underscores the complex landscape of endpoint security and the evolving threat vectors. In this context, what is the most critical reason for establishing a robust endpoint security incident handling and response capability?
정답: B
설명: (KoreaDumps 회원만 볼 수 있음)