[Q91-Q112] Pass Your 212-89 Exam Easily With 100% Exam Passing Guarantee [2026]

Posted On April 12, 2026

Pass Your 212-89 Exam Easily With 100% Exam Passing Guarantee [2026]

212-89 Dumps are Available for Instant Access from Exams4sures

The EC-Council Certified Incident Handler (ECIH) v2 exam is a certification program that validates an individual’s knowledge and skills in incident handling and response. The ECIH certification is designed to provide IT professionals with the necessary knowledge and skills to detect, respond, and resolve computer security incidents in a timely and efficient manner. The ECIH certification program is based on a comprehensive set of knowledge and skills that are required to effectively manage and respond to security incidents.

Q91. An organization faced an information security incident where a disgruntled employee passed sensitive access
control information to a competitor. The organization’s incident response manager, upon investigation, found
that the incident must be handled within a few hours on the same day to maintain business continuity and
market competitiveness. How would you categorize such information security incident?

High level incident

Middle level incident

Ultra-High level incident

Low level incident

Q92. Which of the following might be an insider threat?

All of these

Disgruntled system administrators

Business partners

Current employee

Q93. Adam is an incident handler who intends to use DBCC LOG command to analyze a database and retrieve the active transaction log files for the specified database. The syntax of DBCC LOG command is DBCC LOG(, ), where the output parameter specifies the level of information an incident handler wants to retrieve. If Adam wants to retrieve the full information on each operation along with the hex dump of a current transaction row, which of the following output parameters should Adam use?

Q94. Which one of the following is the correct flow of the stages in an incident handling and response (IH&R) process?

Preparation -> Incident recording -> Incident triage -> Containment -> Eradication -> Recovery -> Post-incident activities

Containment -> Incident recording -> Incident triage -> Preparation -> Recovery -> Eradication -> Post-incident activities

Incident recording -> Preparation -> Containment -> Incident triage -> Recovery -> Eradication -> Post-incident activities

Incident triage -> Eradication -> Containment -> Incident recording -> Preparation -> Recovery -> Post-incident activities

The correct flow of stages in an Incident Handling and Response (IH&R) process as outlined in the Incident Handler (ECIH v3) by EC-Council begins with Preparation. This phase involves getting ready for potential incidents by developing plans, policies, and procedures, and ensuring that tools and team training are up to date. Incident Recording is the next stage, where incidents are documented and reported. Incident Triage follows, prioritizing incidents based on their impact and urgency. Containment is next, aiming to limit the damage of the incident and prevent further spread. Eradication comes after containment, where the root cause of the incident is removed. Recovery is the stage where affected systems are restored to their operational status. Post-Incident Activities conclude the process, reviewing and learning from the incident to improve future response efforts.
References:This structured approach is foundational in the ECIH v3 program, ensuring that incident handlers are prepared to systematically address and manage cybersecurity incidents efficiently.

Q95. An information security incident is

Any real or suspected adverse event in relation to the security of computer systems or networks

Any event that disrupts normal today’s business functions

Any event that breaches the availability of information assets

All of the above

Q96. Which among the following CERTs is an Internet provider to higher education institutions and various other research institutions in the Netherlands and deals with all cases related to computer security incidents in which a customer is involved either as a victim or as a suspect?

NET-CERT

DFN-CERT

Funet CERT

SURFnet-CERT

Q97. Which of the following is a term that describes the combination of strategies and services intended to restore data, applications, and other resources to the public cloud or dedicated service providers?

Mitigation

Analysis

Eradication

Cloud recovery

The term that describes the combination of strategies and services intended to restore data, applications, and other resources to the public cloud or dedicated service providers is “Cloud recovery.” This term encompasses disaster recovery efforts focused on ensuring that an organization’s digital assets can be quickly and effectively restored or moved to cloud environments in the event of data loss, system failure, or a disaster. Cloud recovery strategies are part of a broader disaster recovery and business continuity planning, ensuring minimal downtime and data loss by leveraging cloud computing’s scalability and flexibility. Mitigation, analysis, and eradication are terms associated with other aspects of incident response and risk management, not specifically with the restoration of resources to cloud environments.References:The Incident Handler (ECIH v3) curriculum includes discussions on disaster recovery and business continuity planning, highlighting cloud recovery as a vital component of ensuring organizational resilience against disruptions.

Q98. A threat source does not present a risk if NO vulnerability that can be exercised for a particular threat source.
Identify the step in which different threat sources are defined:

Identification Vulnerabilities

Control analysis

Threat identification

System characterization

Q99. Which of the following is not called volatile data?

Open sockets er open ports

The dale a no Lime of the system

Creation dates of files

State of the network interface

Volatile data refers to information that is stored temporarily and is lost when a computer is turned off or restarted, such as RAM contents, including open sockets and open ports, the date and time of the system, and the state of the network interface. The creation dates of files, however, are considered non-volatile data because they are preserved on the hard drive and remain available after the system is restarted or turned off.
Non-volatile data is stored on persistent storage mediums like hard drives, SSDs, and magnetic tapes, where it remains until it is deleted or overwritten.
References:The Incident Handler (ECIH v3) certification emphasizes the distinction between volatile and non- volatile data in the context of digital forensics and incident response, highlighting the importance of understanding what data may be lost upon system shutdown and what data persists.

Q100. An organization named Sam Morison Inc. decided to use cloud-based services to reduce the cost of maintenance. The organization identified various risks and threats associated with cloud service adoption and migrating business-critical data to thirdparty systems. Hence, the organization decided to deploy cloud-based security tools to prevent upcoming threats.
Which of the following tools help the organization to secure the cloud resources and services?

Nmap

Burp Suite

Wireshark

Alert Logic

Alert Logic is a cloud-based security tool that provides Security-as-a-Service solutions including threat management, vulnerability assessment, and improved security outcomes. It is designed specifically to secure cloud resources and services, making it an ideal choice for organizations like Sam Morison Inc. that are moving their operations to the cloud and are concerned about the security of their data. Tools like Nmap, Burp Suite, and Wireshark, while valuable in certain contexts, do not offer the same cloud-focused security capabilitiesas Alert Logic.

Q101. Which of the following is an Inappropriate usage incident?

Access-control attack

Reconnaissance attack

Insider threat

Denial-of-service attack

An Inappropriate Usage incident refers to instances where computing resources are misused or abused, often violating organizational policies or laws. While access-control attacks, reconnaissance attacks, and denial-of-service (DoS) attacks represent different types of external threats or methods of attack, an Insider Threat is an example of inappropriate usage. Insider threats come from individuals within the organization, such as employees or contractors, who misuse their access to harm the organization’s interests. This can include stealing confidential information, intentionally disrupting systems, or other malicious activities that leverage their legitimate access to the organization’s resources.References:EC-Council’s Incident Handler (ECIH v3) materials often discuss various typesof security incidents, including inappropriate usage, and emphasize the importance of recognizing and preparing for insider threats as a critical component of an organization’s incident response strategy.

Q102. Tibs on works as an incident responder for MNC based in Singapore. He is investigating a web application security incident recently faced by the company. The attack is performed on a MSSQL Server hosted by the company. In the detection and analysis phase, he used regular expressions to analyze and detect SQL meta-characters that led to SQL injection attack. Identify the regular expression used by Tibs on to detect SQL injection attack on MSSQL Server.

((.1%2E).1%2E)(V%2FN|%5C))

((A.W)(.A.V))

((%3C) <) (%2F) /) *(script) (%3E) >)

/exec(s|+) +(s|x) pw+/ix

Q103. Installing a password cracking tool, downloading pornography material, sending emails to colleagues which irritates them and hosting unauthorized websites on the company’s computer are considered:

Network based attacks

Unauthorized access attacks

Malware attacks

Inappropriate usage incidents

Q104. MegaHealth, a global healthcare provider, experienced a sudden malfunction in its MRI machines.
Investigations revealed malware that tweaked MRI results and communicated with an external command-and- control server. With tools like an advanced endpoint protection system and a network monitor, what should be the first step?

Inform the patients about a potential compromise of their data.

Use the network monitor to identify and block the C&C server communication.

Update the MRI machines’ firmware and software.

Deploy the endpoint protection on MRI machines to detect and halt the malware.

Comprehensive and Detailed Explanation (ECIH-aligned):
This incident involves malware actively impacting medical devices, posing patient safety risks. According to ECIH malware incident handling principles, the first priority is containment and eradication at the endpoint level.
Option D is correct because deploying endpoint protection directly detects and halts malware execution on the MRI machines, stopping both manipulation of results and further malicious activity. Endpoint containment is essential before network-level or recovery actions.
Option B addresses communication but does not stop local manipulation. Option C alters system state without containment. Option A is a regulatory step that follows validation.
ECIH emphasizes that in critical infrastructure and healthcare environments, immediate endpoint containment is essential to protect safety and data integrity.

Q105. EnviroTech, a global environmental research institute, faced anomalies in six months of satellite weather data.
Unauthorized data modification entries were found in logs, occurring in microbursts with minimal traces.
While the intent was unclear, the implications were significant. What’s the optimal response?

Immediately release a public statement urging data crosschecks.

Approach international cybersecurity agencies speculating nation-state involvement.

Isolate the affected systems, initiate a thorough forensic examination, and revert to the most recent unaltered backup.

Collaborate with global institutes to identify discrepancies without revealing a breach.

This scenario requires decisive action across containment, analysis, and recovery, as defined in the ECIH incident handling lifecycle.
Option C is correct because isolating affected systems prevents further manipulation, forensic examination identifies scope and method, and restoring from a verified clean backup ensures data integrity. ECIH emphasizes verified restoration only after investigation begins.
Options A, B, and D are premature or speculative and risk misinformation.

Q106. Clark is investigating a cybercrime at TechSoft Solutions. While investigating the case, he needs to collect volatile information such as running services, their process IDs, start mode, state, and status.
Which of the following commands will help Clark to collect such information from running services?

netstat-ab

net file

Open files

W mic

Q107. Eve is an incident handler in ABC organization. One day, she got a complaint about an email hacking incident from one of the employees of the organization. As a part of incident handling and response process, she must follow a number of recovery steps in order to recover from the incident impact and maintain business continuity.
What is the first step that she must do to secure the employee’s account?

Disabling automatic filesharing between the systems

Restore the email services and change the password

Enable scanning of links and attachments in all the emails

Enable two-factor authentication

Q108. Jason is setting up a computer forensics lab and must perform the following steps:
1. physical location and structural design considerations;
2. planning and budgeting;
3. work area considerations;
4. physical security recommendations;
5. forensic lab licensing;
6. human resource considerations.
Arrange these steps in the order of execution.

2->1->3->6->4->5

5->2->1->3->4->6

2->3->1->4->6->5

3->2->1->4->6->5

Q109. Eric is an incident responder working on developing incident-handling plans and procedures. As part of this process, he is analyzing the organizational network to generate a report and develop policies based on the acquired results.
Which of the following tools will help him in analyzing his network and the related traffic?

FaceNiff

Whois

Burp Suite

Wireshark

Q110. In the cloud environment, an authorized security professional executes approved sanitation procedures using approved utilities to permanently remove data spilled from contaminated information systems and applications in the cloud.
This is an example of which of the following?

Cloud auditor

Cloud eradication

Cloud broker

Cloud computing

Q111. Which of the following is not a countermeasure to eradicate cloud security incidents?

Patch the database vulnerabilities and improve the isolation mechanism

Remove the malware files and traces from the affected components

Check for data protection at both design and runtime

Disable security options such as two factor authentication and CAPTCHA

Q112. Khai was tasked with examining the logs from a Linux email server. The server uses Sendmail to execute the command to send emailsand Syslog to maintain logs. To validate the data within email headers, which of the following directories should Khai check for information such as source and destination IP addresses, dates, and timestamps?

/Var/log/mailog

/ar/log/sendmail

/va r/log/mai11og

/va r/log/sendmail/mailog

In a Linux environment, email servers such as Sendmail log events, including details about sent and received emails, in a specific log file. The correct directory and file for examining email logs, particularly for Sendmail and using Syslog for logging, is /Var/log/maillog. Thisfile contains vital information for forensic and incident response purposes, including source and destination IP addresses, email addresses, timestamps, and other data relevant to the email traffic handled by the server. By analyzing this log, incident responders can gather evidence related to email-based incidents, trace the source of malicious emails, and understand the scope of an incident. It’s crucial for individuals like Khai, who are tasked with examining logs, to know the correct log file locations and their contents to effectively validate and analyze email header information and other relevant data.
References:Incident Handler (ECIH v3) study materials often cover the logging mechanisms of common services and applications on Linux systems, including email servers like Sendmail, and the importance of log files like /var/log/maillog in incident investigation and response activities.

Loading …

The ECIH v2 certification is highly valued in the cybersecurity industry and is a good choice for professionals who want to enhance their career in the field of incident handling and response. EC Council Certified Incident Handler (ECIH v3) certification program is designed to provide professionals with the necessary skills and knowledge to handle and respond to various types of security incidents, which is a critical requirement for any organization. The ECIH v2 certification is recognized globally and is considered as one of the top certifications in the field of incident handling and response.

Study resources for the Valid 212-89 Braindumps: https://www.exams4sures.com/EC-COUNCIL/212-89-practice-exam-dumps.html