Get 100% Real 212-89 Exam Questions, Accurate & Verified Answers As Seen in the Real Exam!
212-89 Premium Files Updated Jun-2026 Practice Valid Exam Dumps Question
EC-Council, the organization behind the ECIH v2 certification program, is a leading provider of information security training and certification programs. The organization has trained and certified over 200,000 professionals in more than 145 countries worldwide. EC-Council's mission is to build a safer and more secure cyber world by providing top-quality educational programs and certifications that help organizations protect their critical information assets from cyber threats. The ECIH v2 certification program is one of the many certification programs offered by EC-Council to help IT professionals enhance their skills and knowledge in the field of cybersecurity.
The ECIH certification exam is a 2-hour, computer-based exam that consists of 100 multiple-choice questions. 212-89 exam is designed to test an individual's knowledge and skills in incident handling and response. 212-89 exam covers various topics such as incident handling process, incident handling procedures, communication and documentation, and various types of incidents. To pass the ECIH certification exam, an individual must score at least 70% on the exam.
NEW QUESTION # 67
Your manager hands you several items of digital evidence and asks you to investigate them in the order of volatility. Which of the following is the MOST volatile?
- A. Temp files
- B. Cache
- C. Emails
- D. Disk
Answer: B
Explanation:
In the context of digital evidence investigation, volatility refers to how quickly data can change or be lost when power is removed or systems are altered. Among the options provided, cache is the most volatile because it is temporary storage that is designed to speed up access to data and is frequently overwritten. Cache data resides in RAM and includes things like memory buffers, system and network information, and process execution data, which are lost upon reboot or power loss. This contrasts with disks, emails, and temp files, which are considered less volatile because they are stored on permanent or semi-permanent media and are less likely to be immediately lost or overwritten.References:The Incident Handler (ECIH v3) curriculum includes principles of digital evidence handling, which emphasizes the importance of collecting evidence in descending order of volatility to ensure that the most ephemeral data is preserved before it's lost.
NEW QUESTION # 68
Shiela is working at night as an incident handler. During a shift, servers were affected by a massive cyberattack. After she classified and prioritized the incident, she must report the incident, obtain necessary permissions, and perform other incident response functions. What list should she check to notify other responsible personnel?
- A. Phone number list
- B. HR log book
- C. Point of contact
- D. Email list
Answer: C
Explanation:
In the context of incident handling, the "point of contact" list is essential for ensuring that Sheila, the incident handler working at night, can quickly notify the responsible personnel within the organization about the cyberattack. This list typically includes the contact information of key stakeholders and decision-makers who need to be informed about security incidents, allowing for timely communication, decision-making, and response coordination.
References:Incident Handler (ECIH v3) courses and study guides stress the importance of having a well-maintained point of contact list as part of an organization's incident response plan to facilitate efficient and effective communication during and after cybersecurity incidents.
NEW QUESTION # 69
ZYX company experienced a DoS/DDoS attack on their network. Upon investigating the incident, they concluded that the attack is an application-layer attack.
Which of the following attacks did the attacker use?
- A. Ping of death
- B. SYN flood attack
- C. SIowloris attack
- D. UDP flood attack
Answer: C
NEW QUESTION # 70
Drake is an incident handler at Dark Cloud Inc. Heist asked with performing log analysis in order to detect traces of malicious activities within the network infrastructure.
Which of the following tools should Drake employ in order to view logs in real time and identify malware propagation within the network?
- A. HULK
- B. LOIC
- C. Splunk
- D. Hydra
Answer: C
NEW QUESTION # 71
Jason is an incident handler dealing with malware incidents. He was asked to perform memory dump analysis in order to collect the information about the basic functionality of any program. As a part of his assignment, he needs to perform string search analysis to search for the malicious stringthat could determine harmful actions that a program can perform. Which of the following string-searching tools Jason needs to use to do the intended task?
- A. PEView
- B. Process Explorer
- C. Dependency Walker
- D. BinText
Answer: D
Explanation:
BinText is a lightweight text extraction tool that can be used to perform string search analysis within binary files. This functionality is crucial for incident handlers like Jason, who are tasked with analyzing memory dumps for malicious activity or indicators of compromise. By searching for specific strings or patterns that are known to be associated with malware, BinText helps in identifying potentially harmful actions that a program could perform, thus aiding in the investigation of malware incidents.
References:Memory dump analysis and string search techniques are important skills covered in the ECIH v3 curriculum, emphasizing the use of tools like BinText to aid in the forensic analysis of malware-infected systems.
NEW QUESTION # 72
Stanley is an incident handler working for TexaCorp., a United States based organization. With the growing concern of increasing emails from outside the organization, Stanley was asked to take appropriate actions to keep the security of the organization intact. In the process of detecting and containing malicious emails, Stanley was asked to check the validity of the emails received by employees. Identify the tool Stanley can use to accomplish this task.
- A. Event Log Analyzer
- B. Email Dossier
- C. Polite Mail
- D. Point of Mail
Answer: D
NEW QUESTION # 73
Which of the following tools helps incident handlers to view the file system, retrieve deleted data, perform timeline analysis, web artifacts, etc., during an incident response process?
- A. Autopsy
- B. netstat
- C. Process Explorer
- D. nblslal
Answer: A
NEW QUESTION # 74
Insiders understand corporate business functions. What is the correct sequence of activities performed by
Insiders to damage company assets:
- A. Activate malware, gain privileged access then install malware
- B. Gain privileged access, activate and install malware
- C. Gain privileged access, install malware then activate
- D. Install malware, gain privileged access, then activate
Answer: C
NEW QUESTION # 75
Which of the following port scanning techniques involves resetting the TCP connection between client and server abruptly before completion of the three-way handshake signals, making the connection half-open?
- A. Xmas scan
- B. Full connects can
- C. Null scan
- D. Stealth scan
Answer: A
NEW QUESTION # 76
ADAM, an employee from a multinational company, uses his company's accounts to send e-mails to a third
party with their spoofed mail address. How can you categorize this type of account?
- A. Inappropriate usage incident
- B. Network intrusion incident
- C. Unauthorized access incident
- D. Denial of Service incident
Answer: A
NEW QUESTION # 77
Which of the following is NOT one of the techniques used to respond to insider threats:
- A. Placing malicious users in quarantine network, so that attack cannot be spread
- B. Blocking malicious user accounts
- C. Disabling the computer systems from network connection
- D. Preventing malicious users from accessing unclassified information
Answer: D
NEW QUESTION # 78
During an internal audit following a surge in unauthorized financial transactions, a multinational investment firm's IR team uncovers evidence of an orchestrated campaign targeting senior staff. The attackers had pieced together fragments of sensitive data by mining executive digital footprints, reviewing online publications, and analyzing company-related mentions on external platforms. Later, they engaged directly with employees under fabricated personas, conducting scripted interviews to extract missing identifiers. With the assembled profile data, the adversaries submitted diversion requests for financial correspondence and used these to impersonate executives and execute fraudulent transfers. Forensic analysis revealed no signs of malware infection or system-level compromise. Which technique best aligns with the adversary's method of obtaining the initial sensitive information?
- A. Phishing through spoofed emails embedded with malicious macros targeting employee laptops
- B. Skimming magnetic card data through modified payment devices in the company cafeteria
- C. Pharming attack that redirected login traffic from internal systems to malicious replicas
- D. Social engineering using open-source intelligence followed by pretexting
Answer: D
Explanation:
The EC-Council Incident Handler (ECIH) curriculum classifies social engineering as a human-based attack technique that manipulates individuals into disclosing confidential information without exploiting technical vulnerabilities. In this scenario, the attackers first gathered publicly available information-also known as Open-Source Intelligence (OSINT)-by mining executive digital footprints, analyzing online publications, and reviewing external mentions. This reconnaissance phase aligns directly with OSINT-based profiling.
The adversaries then conducted scripted interviews under fabricated personas to extract additional identifiers.
This behavior is characteristic of pretexting, a specific social engineering technique where attackers create a false scenario to persuade victims to provide sensitive information. ECIH explains that pretexting often involves impersonation and carefully constructed narratives to build credibility and trust.
The absence of malware infection or system-level compromise further confirms that this was not a technical exploit such as phishing with malicious macros (Option A) or pharming (Option C). Additionally, skimming (Option D) is a physical data theft technique unrelated to executive impersonation or digital profiling.
ECIH emphasizes that insider threat and financial fraud investigations frequently reveal social engineering campaigns leveraging OSINT, impersonation, and psychological manipulation rather than malware.
Preventive controls include executive awareness training, strict identity verification for financial change requests, multi-factor authentication, and callback verification procedures.
Therefore, the technique that best aligns with the adversary's method is social engineering using open-source intelligence followed by pretexting.
NEW QUESTION # 79
Computer forensics is methodical series of techniques and procedures for gathering evidence from computing
equipment, various storage devices and or digital media that can be presented in a course of law in a coherent
and meaningful format. Which one of the following is an appropriate flow of steps in the computer forensics
process:
- A. Analysis > Preparation > Collection > Reporting > Examination
- B. Preparation > Collection > Examination > Analysis > Reporting
- C. Preparation > Analysis > Collection > Examination > Reporting
- D. Examination> Analysis > Preparation > Collection > Reporting
Answer: B
NEW QUESTION # 80
Contingency planning enables organizations to develop and maintain effective methods to handle emergencies. Every organization will have its own specific requirements that the planning should address. There are five major components of the IT contingency plan, namely supporting information, notification activation, recovery and reconstitution and plan appendices. What is the main purpose of the reconstitution plan?
- A. To provide a sequence of recovery activities with the help of recovery procedures
- B. To restore the original site, tests systems to prevent the incident and terminates operations
- C. To define the notification procedures, damage assessments and offers the plan activation
- D. To provide the introduction and detailed concept of the contingency plan
Answer: B
NEW QUESTION # 81
You area systems administrator for a company. You are accessing your fileserver remotely for maintenance.
Suddenly, you are unable to access the server. After contacting others in your department, you find out that they cannot access the file server either.
You can ping the file server but not connect to it via RD. You check the Active Directory Server, and all is well.
You check the email server and find that emails are sent and received normally.
What is the most likely issue?
- A. The fileserver has shutdown
- B. An email service issue
- C. A denial-of-service issue
- D. An admin account issue
Answer: C
NEW QUESTION # 82
During the vulnerability assessment phase, the incident responders perform various steps as below:
1. Run vulnerability scans using tools
2. Identify and prioritize vulnerabilities
3. Examine and evaluate physical security
4. Perform OSINT information gathering to validate the vulnerabilities
5. Apply business and technology context to scanner results
6. Check for misconfigurations and human errors
7. Create a vulnerability scan report
Identify the correct sequence of vulnerability assessment steps performed by the incident responders.
- A. 4-->1-->2-->3-->6-->5-->7
- B. 3-->6-->1-->2-->5-->4-->7
- C. 2-->1-->4-->7-->5-->6-->3
- D. 1-->3-->2-->4-->5-->6-->7
Answer: A
NEW QUESTION # 83
An audit trail policy collects all audit trails such as series of records of computer events, about an operating
system, application or user activities. Which of the following statements is NOT true for an audit trail policy:
- A. It helps in compliance to various regulatory laws, rules,and guidelines
- B. It helps calculating intangible losses to the organization due to incident
- C. It helps tracking individual actions and allows users to be personally accountable for their actions
- D. It helps in reconstructing the events after a problem has occurred
Answer: B
NEW QUESTION # 84
Which of the following risk mitigation strategies involves the execution of controls to reduce the risk factor and bring it to an acceptable level, or accepts the potential risk and continues operating the IT system?
- A. Risk avoidance
- B. Risk transference
- C. Risk planning
- D. Risk assumption
Answer: D
NEW QUESTION # 85
Business continuity is defined as the ability of an organization to continue to function even after a disastrous event, accomplished through the deployment of redundant hardware and software, the use of fault tolerant systems, as well as a solid backup and recovery strategy. Identify the plan which is mandatory part of a business continuity plan?
- A. Sales and Marketing plan
- B. Business Recovery Plan
- C. Forensics Procedure Plan
- D. New business strategy plan
Answer: B
NEW QUESTION # 86
During the process of detecting and containing malicious emails, incident responders should examine the originating IP address of the emails.
The steps to examine the originating IP address are as follow:
1. Search for the IP in the WHOIS database
2. Open the email to trace and find its header
3. Collect the IP address of the sender from the header of the received mail
4. Look for the geographic address of the sender in the WHOIS database
Identify the correct sequence of steps to be performed by the incident responders to examine originating IP address of the emails.
- A. 4-->1-->2-->3
- B. 1-->3-->2-->4
- C. 2-->1-->4-->3
- D. 2-->3-->1-->4
Answer: D
NEW QUESTION # 87
Adam is an attacker who along with his team launched multiple attacks on target organization for financial benefits. Worried about getting caught, he decided to forge his identity. To do so, he created a new identity by obtaining information from different victims.
Identify the type of identity theft Adam has performed.
- A. Tax identity theft
- B. Synthetic identity theft
- C. Social identity theft
- D. Medical identity theft
Answer: B
NEW QUESTION # 88
......
REAL 212-89 Exam Questions With 100% Refund Guarantee : https://www.prep4surereview.com/212-89-latest-braindumps.html
Practice with 212-89 Dumps for ECIH Certification Certified Exam Questions & Answer: https://drive.google.com/open?id=14cUpWcHQ78l7ef6FG4AprEckufOJuAYL
