Try and practice the latest EC-COUNCIL : 212-89 real questions & answers

Which of the following is NOT part of the static data collection process?

• A. System preservation
• B. Evidence oxa mi nation
• C. Evidence acquisition
• D. Password protection

During a routine security assessment at SoftTech, a major software development company, a series of suspicious email transmissions were flagged from a senior executive's account to an external domain. Preliminary investigations suggest that the emails contained critical IP details.
To identify the cause and extent of this compromise, what should be the primary action?

• A. Coordinate with the external domain to retrieve the sent emails.
• B. Enforce immediate password resets for all senior executive accounts.
• C. Conduct a forensic examination of the affected email account's recent activities.
• D. Send an alert to all staff members about potential phishing threats.

Jack, a senior incident responder at a major financial institution, was urgently assigned to investigate a web application incident that had impacted several customers. The incident was first detected through customer complaints reporting redirection to suspicious external websites after logging in or interacting with the web platform.
As Jack dug into the server logs and update routines, he identified an alarming discovery: the application's auto-update mechanism had silently downloaded and integrated a malicious update package from an unverified and untrusted third-party source. This update had been unintentionally trusted and applied without proper signature validation or integrity checks.
Post-compromise, the malicious update began injecting redirect scripts into various web pages, causing legitimate users to be redirected to unknown or phishing websites. This exposed both user data and institutional reputation to significant risk. Upon further inspection, Jack confirmed that the update process lacked secure code verification methods such as digital signature validation or secure update channels, which allowed the attacker to tamper with the software delivery pipeline. Identify the type of web application security throat discovered by Jack in the above scenario.

• A. Software and data integrity failure
• B. Security logging and monitoring failure
• C. Identification and authentication failure
• D. Security misconfiguration

A cloud service provider detected anomalous activities pointing to a potential compromise of their infrastructure. The IH&R team is confronted with vast amounts of data from various cloud-native logging mechanisms. To ensure swift and effective incident triage, what should be their primary course of action?

• A. Send a notification to all clients, advising them to back up their data and prepare for potential service disruptions.
• B. Implement an Incident Response Automation and Orchestration (IRAO) tool specifically designed for cloud environments to correlate logs and prioritize alerts.
• C. Exclusively focus on cloud-native logging mechanisms, ignoring any third-party logging tools that might be integrated.
• D. Immediately isolate all affected cloud instances, regardless of the impact on customer operations.

You are a systems administrator for a company. You are accessing your file server remotely for maintenance. Suddenly, you are unable to access the server. After contacting others in your department, you find out that they cannot access the file server either. You can ping the file server but not connect to it via RDP. You check the Active Directory Server, and all is well. You check the email server and find that emails are sent and received normally. What is the most likely issue?

• A. An admin account issue
• B. A denial-of-service issue
• C. An e-mail service issue
• D. The file server has shut down