Important Eccouncil 212-89 Exam Questions

Answer: B

Explanation:

The EC-Council Incident Handler (ECIH) curriculum clearly defines the Preparation Phase as the foundation of an effective Incident Handling and Response (IH&R) program. This phase focuses on establishing readiness before incidents occur. Activities include defining roles and responsibilities, forming and training the incident response team, conducting simulation and tabletop exercises, auditing assets, reviewing response tools, and developing formal policies and playbooks.

The scenario explicitly describes forward-looking corrective and preventive measures such as simulation exercises, stakeholder training, asset auditing, and policy development. These are hallmark activities of the Preparation phase. ECIH emphasizes that organizations lacking structured preparation often experience delayed response, unclear accountability, and increased operational impact during cyber incidents.

Option A (Recovery) focuses on restoring systems after containment and eradication. Option C (Eradication) involves removing threats after containment. Option D (Triage) falls under detection and analysis. None of these address proactive readiness and organizational resilience.

Therefore, initiating the Preparation phase is the correct approach to strengthen long-term cybersecurity resilience in alignment with ECIH standards.

Answer: C

Explanation:

Cross-site request forgery (CSRF or XSRF) is an attack that tricks the victim's browser into executing unauthorized actions on a website where they are currently authenticated. In this scenario, the attacker exploits the trust that a site has in the user's browser, effectively forcing the browser to perform actions without the user's knowledge or consent. For example, if the user is logged into their bank's website, an attacker could craft a malicious request to transfer funds without the user's direct interaction. CSRF attacks rely on authenticated sessions and typically target state-changing requests to compromise user or application data.

Answer: C

Explanation:

The EC-Council Incident Handler (ECIH) curriculum highlights the importance of accurate triage and incident categorization during the detection and analysis phase. Misclassification of security events as routine IT issues delays escalation and increases risk exposure.

In this case, phishing reports were incorrectly logged as service requests due to poor triage decision-making by frontline staff. The corrective measures---refining workflows, embedding clearer triage rules, and providing refresher training---directly target improving the accuracy of initial threat identification and proper escalation to the IH&R team.

ECIH stresses that effective incident response depends on well-defined classification procedures, escalation criteria, and trained personnel capable of recognizing subtle security indicators. Early detection and proper routing significantly reduce dwell time and potential impact.

Option A concerns asset tracking, not incident triage. Option B relates to containment, not categorization. Option D addresses alert fatigue, which is not the root issue described.

Therefore, the corrective action addresses improving accuracy in initial threat categorization and escalation.

Answer: A

Explanation:

According to the EC-Council Incident Handler (ECIH) curriculum, proper handling of digital evidence is a critical responsibility of first responders. This includes photographing the scene, labeling devices, packaging them in anti-static or static-resistant bags, and documenting detailed information such as time, location, and device identifiers.

These steps are part of evidence preservation and packaging procedures designed to prevent contamination, electrostatic damage, or loss of evidentiary integrity. ECIH emphasizes maintaining a clear chain of custody and ensuring that all digital evidence is properly documented before transportation to a forensic laboratory.

Option B relates to policy review, not field evidence handling. Option C involves technical log analysis performed later during investigation. Option D concerns witness interviews, which are separate from physical evidence handling.

Rachel's actions clearly describe the packaging and transporting of electronic evidence while maintaining forensic standards and documentation integrity.

Answer: B

Explanation:

The most effective eradication and prevention control in this scenario is the implementation of the Principle of Least Privilege (PoLP) through strict access controls. According to the EC-Council Incident Handler (ECIH) curriculum under Insider Threat Management and Incident Prevention, organizations must ensure that users are granted only the minimum level of access required to perform their job functions. Excessive privileges significantly increase the risk of intentional or accidental misuse of critical systems and data.

In this case, employees were granted administrative access to sensitive systems without a business justification. Administrative privileges typically allow access to restricted financial data and the ability to modify audit logs. ECIH emphasizes that improper privilege management is a primary enabling factor in insider threats. If role-based access control (RBAC) aligned with PoLP had been properly enforced, these employees would not have had the capability to access restricted financial records or alter audit logs.

While User and Entity Behavior Analytics (UEBA) can detect anomalous behavior, it is primarily a detective control rather than a preventive eradication measure. Enhanced password policies strengthen authentication but do not address excessive authorization rights. Network segmentation limits lateral movement but does not directly prevent misuse of over-privileged accounts within authorized segments.

ECIH guidelines strongly recommend periodic access reviews, separation of duties, privilege auditing, and strict RBAC enforcement as part of insider threat mitigation and eradication strategies. By implementing PoLP and continuously reviewing administrative privileges, organizations can significantly reduce the attack surface and prevent privilege abuse before an insider can exploit sensitive systems.