EC-COUNCIL EC-COUNCIL Certifications 212-89 Questions & Answers

• Question 141:

  A US Federal agency network was the target of a DoS attack that prevented and impaired the normal authorized functionality of the networks. According to agency's reporting timeframe guidelines, this incident should be reported within two

  (2)

  HOURS of discovery/detection if the successful attack is still ongoing and the agency is unable to successfully mitigate the activity. Which incident category of the US Federal Agency does this incident belong to?

  A.

  CAT 5

  B.

  CAT 1

  C.

  CAT 2

  D.

  CAT 6

  Correct Answer: C

• Question 142:

  Computer Forensics is the branch of forensic science in which legal evidence is found in any computer or any digital media device. Of the following, who is responsible for examining the evidence acquired and separating the useful evidence?

  A. Evidence Supervisor

  B. Evidence Documenter

  C. Evidence Manager

  D. Evidence Examiner/ Investigator

  Correct Answer: D

• Question 143:

  Multiple component incidents consist of a combination of two or more attacks in a system. Which of the following is not a multiple component incident?

  A. An insider intentionally deleting files from a workstation

  B. An attacker redirecting user to a malicious website and infects his system with Trojan

  C. An attacker infecting a machine to launch a DDoS attack

  D. An attacker using email with malicious code to infect internal workstation

  Correct Answer: A

• Question 144:

  Computer forensics is methodical series of techniques and procedures for gathering evidence from computing equipment, various storage devices and or digital media that can be presented in a course of law in a coherent and meaningful format. Which one of the following is an appropriate flow of steps in the computer forensics process:

  A. Examination> Analysis > Preparation > Collection > Reporting

  B. Preparation > Analysis > Collection > Examination > Reporting

  C. Analysis > Preparation > Collection > Reporting > Examination

  D. Preparation > Collection > Examination > Analysis > Reporting

  Correct Answer: D

• Question 145:

  An audit trail policy collects all audit trails such as series of records of computer events, about an operating system, application or user activities. Which of the following statements is NOT true for an audit trail policy:

  A. It helps calculating intangible losses to the organization due to incident

  B. It helps tracking individual actions and allows users to be personally accountable for their actions

  C. It helps in compliance to various regulatory laws, rules,and guidelines

  D. It helps in reconstructing the events after a problem has occurred

  Correct Answer: A

• Question 146:

  Risk is defined as the probability of the occurrence of an incident. Risk formulation generally begins with the likeliness of an event's occurrence, the harm it may cause and is usually denoted as Risk = (events)X (Probability of occurrence)X?

  A. Magnitude

  B. Probability

  C. Consequences

  D. Significance

  Correct Answer: C

• Question 147:

  An incident recovery plan is a statement of actions that should be taken before, during or after an incident. Identify which of the following is NOT an objective of the incident recovery plan?

  A. Creating new business processes to maintain profitability after incident

  B. Providing a standard for testing the recovery plan

  C. Avoiding the legal liabilities arising due to incident

  D. Providing assurance that systems are reliable

  Correct Answer: A

• Question 148:

  Quantitative risk is the numerical determination of the probability of an adverse event and the extent of the losses due to the event. Quantitative risk is calculated as:

  A. (Probability of Loss) X (Loss)

  B. (Loss) / (Probability of Loss)

  C. (Probability of Loss) / (Loss)

  D. Significant Risks X Probability of Loss X Loss

  Correct Answer: A

• Question 149:

  Identify the malicious program that is masked as a genuine harmless program and gives the attacker unrestricted access to the user's information and system. These programs may unleash dangerous programs that may erase the unsuspecting user's disk and send the victim's credit card numbers and passwords to a stranger.

  A. Cookie tracker

  B. Worm

  C. Trojan

  D. Virus

  Correct Answer: C

• Question 150:

  Incident handling and response steps help you to detect, identify, respond and manage an incident. Which of the following steps focus on limiting the scope and extent of an incident?

  A. Eradication

  B. Containment

  C. Identification

  D. Data collection

  Correct Answer: B