212-89 Exam Dumps - ECCouncil ECIH Questions and Answers

The regular expression/exec(\s|\+)+(s|x)p\w+/ixis designed to match patterns that resemble SQL injection attempts, specifically targeting MS SQL Server. This expression looks for the use of theexeccommand followed by one or more spaces or plus signs, and then patterns that start withsporxp, which are prefixes commonly used in SQL Server stored procedures and extended stored procedures. These are often targeted in SQL injection attacks to execute malicious SQL statements. The regular expression provided is a tool used by incident responders like Tibson to identify and analyze potential SQL injection attempts by looking for suspicious patterns in SQL queries.

Evidence assessment is a critical step in the investigation phase of the computer forensics process. This step involves evaluating the evidence collected to determine its relevance and significance to the case at hand. It includes analyzing the secured data to identify what information can be used as evidence, its integrity, and how it can be related to the security incident. This phase is pivotal as it helps in building a coherent understanding of the incident and in establishing facts that can be presented in management reports or legal proceedings.

This scenario reflects inappropriate resource usage, a category of network and system misuse defined in the ECIH Network Security Incident module. Excessive outbound traffic during non-business hours combined with high CPU and memory utilization indicates unauthorized or improper use of system resources.

Option A is correct because the behavior suggests activities such as cryptomining, data exfiltration, or unauthorized processing. These activities strain system resources and often occur outside normal working hours to avoid detection.

Option B would not necessarily cause sustained resource strain. Option C focuses on physical changes. Option D relates to permission enforcement, not usage behavior.

ECIH categorizes inappropriate usage as a security incident when system resources are misused in ways that violate policy or threaten availability, making Option A correct.

When malware moves from the delivery stage to the exploitation stage in the cyber kill chain, its objective often shifts to identifying exploitable vulnerabilities within the targeted system. A port scan is a technique used to discover services that are listening on ports within a system. By scanning the system ' s ports, the malware can identify open ports and the services running on them, providing valuable information about potential entry points for further exploitation. This type of reconnaissance attack is aimed at gathering intelligence on the target system ' s network services, which can then be reported back to a command and control center for further malicious activity planning.

Port scanning is more relevant than IP range sweeps, packet sniffing, or session hijacking for identifying useful services on a system because it directly targets the discovery of accessible network services and their corresponding ports. While the other methods can also be part of the reconnaissance phase, they serve different purposes: IP range sweeps aim to identify active IP addresses, packet sniffing intercepts data packets to gather information, and session hijacking involves taking over a valid user session. In contrast, port scanning is specifically designed to enumerate services that could be exploited.

The vulnerability exploited by Clark through tampering with form and parameter values to gain unauthorized access to information assets is indicative of Broken Access Control. Broken Access Control vulnerabilities occur when a web application does not properly enforce restrictions on what authenticated users are allowed to do. Attackers can exploit these vulnerabilities to access unauthorized functionality or data, such as accessing other users ' accounts, viewing sensitive files, and modifying other users’ data.

The ECIH Incident Handling lifecycle prioritizes containment during first response when active compromise threatens data integrity and operational continuity. In this scenario, the risk extends beyond data theft to potential manipulation of examination materials.

Option C is correct because isolating the affected academic systems immediately prevents further unauthorized access and preserves the integrity of examination content. Containment ensures that attackers cannot alter or leak sensitive academic materials while investigations proceed.

Option A supports investigation but does not stop ongoing risk. Option B is a contingency plan, not a response action. Option D is premature and does not address system compromise.

According to ECIH, first responders must act decisively to prevent further damage before moving into analysis and recovery, making Option C correct.

A high-interaction honeypot is a deception and intelligence-gathering mechanism designed to attract attackers and provide a realistic environment in which their behavior can be observed. ECIH uses honeypots as part of proactive detection and threat-intelligence activities because they can reveal reconnaissance techniques, exploit attempts, credential attacks, payload delivery, and post-compromise behavior. Zoe is intentionally exposing controlled services, recording activity, and analyzing patterns to understand attacker tactics, techniques, and procedures. This intelligence can later improve IDS rules, signatures, segmentation, and incident-response playbooks. Sandboxing is primarily used to execute suspicious files safely and analyze malware behavior. ACLs are traffic-control mechanisms for filtering connections, while backup testing concerns recovery preparedness. Therefore, the principal purpose of Zoe ' s high-interaction honeypot is to deceive attackers and study their behavior.

================

James ' s activities, including creating anonymous access to cloud services to carry out attacks such as password and key cracking, hosting malicious data, and conducting DDoS attacks, exemplify the abuse and nefarious use of cloud services. This threat involves exploiting cloud computing resources to conduct malicious activities, which can impact the cloud service provider as well as other users of the cloud services. This abuse ranges from using the cloud platform ' s resources for computationally intensive tasks like cracking passwords or encryption keys to conducting DDoS attacks that can disrupt services for legitimate users.

The ECIH Network Security Incident Handling module emphasizes maintaining availability while mitigating denial-of-service attacks. The objective is not simply to stop traffic, but to distinguish malicious traffic from legitimate user requests.

Option D is correct because rate limiting and challenge-response mechanisms (such as CAPTCHA or SYN cookies) allow legitimate traffic to continue while throttling or blocking malicious requests. This approach minimizes service disruption while effectively containing the attack.

Option A may increase costs and still fail against large-scale DDoS attacks. Option B can unintentionally block legitimate users. Option C contradicts ECIH guidance by unnecessarily impacting availability.

ECIH stresses proportional and intelligent mitigation strategies that preserve business continuity. Therefore, implementing rate limiting and challenge-response mechanisms is the preferred strategy.

In incident response protocols, incidents are categorized based on their severity, impact, and the urgency of the response required. The categorization helps in prioritizing incident response activities and allocating resources accordingly. A CAT 1 (Category 1) incident is typically considered the highest priority, involving significant threats that require immediate response. Given the scenario where a malware incident in one of the largest social network companies must be reported within 1 hour of discovery/detection, this indicates a high-priority incident due to the potential widespread impact and the need for a rapid response to contain and mitigate the malware ' s spread. The urgency of the reporting timeframe suggests that the incident is considered critical, aligning with the characteristics of a CAT 1 incident, which necessitates immediate action to prevent significant damage or disruption to the company ' s operations and services.