EC-COUNCIL EC-COUNCIL Certifications 212-89 Questions & Answers

• Question 121:

  The data on the affected system must be backed up so that it can be retrieved if it is damaged during incident response. The system backup can also be used for further investigations of the incident. Identify the stage of the incident response and handling process in which complete backup of the infected system is carried out?

  A. Containment

  B. Eradication

  C. Incident recording

  D. Incident investigation

  Correct Answer: A

• Question 122:

  Except for some common roles, the roles in an IRT are distinct for every organization. Which among the following is the role played by the Incident Coordinator of an IRT?

  A. Links the appropriate technology to the incident to ensure that the foundation's offices are returned to normal operations as quickly as possible

  B. Links the groups that are affected by the incidents, such as legal, human resources, different business areas and management

  C. Applies the appropriate technology and tries to eradicate and recover from the incident

  D. Focuses on the incident and handles it from management and technical point of view

  Correct Answer: B

• Question 123:

  Which one of the following is the correct sequence of flow of the stages in an incident response:

  A. Containment - Identification - Preparation - Recovery - Follow-up - Eradication

  B. Preparation - Identification - Containment - Eradication - Recovery - Follow-up

  C. Eradication - Containment - Identification - Preparation - Recovery - Follow-up

  D. Identification - Preparation - Containment - Recovery - Follow-up - Eradication

  Correct Answer: B

• Question 124:

  Organizations or incident response teams need to protect the evidence for any future legal actions that may be taken against perpetrators that intentionally attacked the computer system. EVIDENCE PROTECTION is also required to meet legal compliance issues. Which of the following documents helps in protecting evidence from physical or logical damage:

  A. Network and host log records

  B. Chain-of-Custody

  C. Forensic analysis report

  D. Chain-of-Precedence

  Correct Answer: B

• Question 125:

  The insider risk matrix consists of technical literacy and business process knowledge vectors. Considering the matrix, one can conclude that:

  A. If the insider's technical literacy is low and process knowledge is high, the risk posed by the threat will be insignificant.

  B. If the insider's technical literacy and process knowledge are high, the risk posed by the threat will be insignificant.

  C. If the insider's technical literacy is high and process knowledge is low, the risk posed by the threat will be high.

  D. If the insider's technical literacy and process knowledge are high, the risk posed by the threat will be high.

  Correct Answer: D

• Question 126:

  Which policy recommends controls for securing and tracking organizational resources:

  A. Access control policy

  B. Administrative security policy

  C. Acceptable use policy

  D. Asset control policy

  Correct Answer: D

• Question 127:

  Contingency planning enables organizations to develop and maintain effective methods to handle emergencies. Every organization will have its own specific requirements that the planning should address. There are five major components of the IT contingency plan, namely supporting information, notification activation, recovery and reconstitution and plan appendices. What is the main purpose of the reconstitution plan?

  A. To restore the original site, tests systems to prevent the incident and terminates operations

  B. To define the notification procedures, damage assessments and offers the plan activation

  C. To provide the introduction and detailed concept of the contingency plan

  D. To provide a sequence of recovery activities with the help of recovery procedures

  Correct Answer: A

• Question 128:

  Insider threats can be detected by observing concerning behaviors exhibited by insiders, such as conflicts with supervisors and coworkers, decline in performance, tardiness or unexplained absenteeism. Select the technique that helps in detecting insider threats:

  A. Correlating known patterns of suspicious and malicious behavior

  B. Protecting computer systems by implementing proper controls

  C. Making is compulsory for employees to sign a none disclosure agreement

  D. Categorizing information according to its sensitivity and access rights

  Correct Answer: A

• Question 129:

  Risk management consists of three processes, risk assessment, mitigation and evaluation. Risk assessment determines the extent of the potential threat and the risk associated with an IT system through its SDLC. How many primary steps does NIST's risk assessment methodology involve?

  A. Twelve

  B. Four

  C. Six

  D. Nine

  Correct Answer: C

• Question 130:

  One of the main objectives of incident management is to prevent incidents and attacks by tightening the physical security of the system or infrastructure. According to CERT's incident management process, which stage focuses on implementing infrastructure improvements resulting from postmortem reviews or other process improvement mechanisms?

  A. Protection

  B. Preparation

  C. Detection

  D. Triage

  Correct Answer: A