Home
EC-Council
212-89: EC-Council Certified Incident Handler ECIH v3 Dumps

Free EC-Council 212-89 ECIH v3 Exam Dumps November 2026

Here you can find all the free questions related with EC-Council Certified Incident Handler (212-89) exam. You can also find on this page links to recently updated premium files with which you can practice for actual EC-Council Certified Incident Handler Exam. These premium versions are provided as 212-89 exam practice tests, both as desktop software and browser based application, you can use whatever suits your style. Feel free to try the EC-Council Certified Incident Handler Exam premium files for free, Good luck with your EC-Council Certified Incident Handler Exam.

Question No: 1

Eric is an incident responder and is working on developing incident-handling plans and procedures. As part of this process, he is performing an analysis on the organizational network to generate a report and develop policies based on the acquired results. Which of the following tools will help him in analyzing his network and the related traffic?

AWhois

BBurp Suite

CFaceNiff

DWireshark

Show Answer

Suggested Answer: D Explanation:

Wireshark is a widely used network protocol analyzer that helps in capturing and interactively browsing the traffic on a network. It is an essential tool for incident responders like Eric who are developing incident-handling plans and procedures. By analyzing network traffic, Wireshark allows users to see what is happening on their network at a microscopic level, making it invaluable for troubleshooting network problems, analyzing security incidents, and understanding network behavior. Whois is used for querying databases that store registered users or assignees of an Internet resource. Burp Suite is a tool for testing web application security, and FaceNiff is used for session hijacking within a WiFi network, which makes Wireshark the best choice for analyzing network traffic.

Question No: 2

MultipleChoice

During routine checks, EduSoft, an educational software provider, identified malware within their digital examination tools. This malware not only provided answers to students but mined personal data. With a digital forensic tool and an encryption protocol tool, what's the ideal primary action?

Options

ADisable the examination tool until further notice.

BAlert educational institutions about the compromised software.

CUse the forensic tool to ascertain the malware's source and method of operation.

DDeploy the encryption tool to safeguard students' data.
Comprehensive and Detailed Explanation (ECIH-aligned):
Once malware is identified, ECIH guidance requires responders to analyze before eradication to understand scope, infection vectors, persistence mechanisms, and data impact. This ensures effective removal and prevents reinfection.
Option C is correct because forensic analysis allows investigators to determine how the malware entered the system, what data was accessed, and whether additional components are compromised. Without this understanding, containment and recovery efforts may be incomplete or ineffective.
Option A is a containment step but does not address root cause. Option B is a notification step that must be supported by verified facts. Option D protects future data but does not address the active malware.
Therefore, forensic analysis is the ideal primary action following detection, as emphasized in the ECIH malware handling process.

Answer
C

Question No: 3

MultipleChoice

Otis is an incident handler working in an organization called Delmont. Recently, the organization faced several setbacks in business, whereby its revenues are decreasing. Otis was asked to take charge and look into the matter. While auditing the enterprise security, he found traces of an attack through which proprietary information was stolen from the enterprise network and passed onto their competitors. Which of the following information security incidents did Delmont face?

Options

ANetwork and resource abuses

BEspionage

CEmail-based abuse

DUnauthorized access
Espionage, in the context of information security incidents, refers to the unauthorized access and theft of proprietary information for competitive advantage. In the scenario described, where proprietary information was stolen from Delmont's enterprise network and passed onto their competitors, this directly aligns with the definition of espionage. The incident involves deliberate targeting and extraction of sensitive business information, which is then used by competitors to gain a market advantage. Such actions not only compromise the confidentiality of business-critical information but can also significantly impact the financial stability and competitive positioning of the victim organization.

Answer
B

Question No: 4

MultipleChoice

Allan performed a reconnaissance attack on his corporate network as part of a red-team activity. He scanned the IP range to find live host IP addresses. What type of technique did he use to exploit the network?

Options

ADNS foot printing

BSocial engineering

CPort scanning

DPing sweeping
Ping sweeping is a technique used in network reconnaissance to identify which IP addresses in a range are active or live. By sending ICMP echo requests ('ping') to multiple hosts and observing which ones respond, an attacker or, in this case, a red team member like Allan, can determine which systems are up and potentially vulnerable to further exploration or attack. This method is foundational for mapping the network before deploying more targeted exploits or scans.

Answer
D

Question No: 5

MultipleChoice

An organization suffers a financial loss after an executive responds to a fraudulent email crafted as part of a spear phishing attack. After isolating affected systems and notifying internal stakeholders, the incident response team prepares a detailed report outlining the attack timeline, suspicious IP addresses, email metadata, phone scam details, and the amount lost. This report is forwarded to a government agency specializing in cybercrime to aid further investigation and potential restitution. Which aspect of the recovery process is the organization addressing?

Options

ALegal escalation and investigation support

BData redundancy planning

CEndpoint protection deployment

DInternal server reconfiguration
Comprehensive and Detailed Explanation (ECIH-aligned):
This scenario reflects the post-incident recovery and reporting phase outlined in the ECIH curriculum. After containment and eradication, organizations must address legal, regulatory, and investigative requirements, especially when financial fraud and executive compromise are involved.
Option A is correct because forwarding detailed incident reports to a government cybercrime agency constitutes legal escalation and investigation support. ECIH stresses the importance of cooperation with law enforcement in cases involving fraud, financial loss, or cross-border criminal activity. Proper documentation supports potential prosecution, restitution efforts, and regulatory compliance.
Options B, C, and D are technical recovery actions unrelated to legal follow-up.
By engaging authorities with verified evidence, the organization fulfills its recovery obligations beyond technical remediation, aligning with ECIH best practices.

Answer
A

Question No: 6

MultipleChoice

Shally, an incident handler, is working for a company named Texas Pvt. Ltd. based in

Florida. She was asked to work on an incident response plan. As part of the plan, she

decided to enhance and improve the security infrastructure of the enterprise. She has

incorporated a security strategy that allows security professionals to use several

protection layers throughout their information system. Due to multiple layer protection,

this security strategy assists in preventing direct attacks against the organization's

information system as a break in one layer only leads the attacker to the next layer.

Identify the security strategy Shally has incorporated in the incident response plan.

Options

ADefense-in-depth

BThree-way handshake

CCovert channels

DExponential backoff algorithm
Shally has incorporated the Defense-in-depth strategy into the incident response plan for Texas Pvt. Ltd. Defense-in-depth is a layered security approach that involves implementing multiple security measures and controls throughout an information system. This strategy is designed to provide several defensive barriers to protect against threats and attacks, ensuring that if one layer is compromised, others still provide protection. The goal is to create a multi-faceted defense that addresses potential vulnerabilities in various areas, including physical security, network security, application security, and user education.

Answer
A

Question No: 7

MultipleChoice

Who is mainly responsible for providing proper network services and handling network-related incidents in all the cloud service models?

Options

ACloud consumer

BCloud auditor

CCloud brokers

DCloud service provide
In cloud computing environments, the responsibility for providing and managing network services, as well as handling incidents related to these services, primarily falls on the cloud service provider. This includes Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) models. The cloud service provider is tasked with ensuring the availability, integrity, and security of the network services they offer. This responsibility includes managing and responding to incidents that may affect these services, ranging from security breaches to performance issues. The cloud service provider employs a variety of tools and techniques to monitor the network, identify potential threats, and implement corrective actions to mitigate any impact on the services and their users.

Answer
D

Question No: 8

MultipleChoice

In which of the following phases of the incident handling and response (IH&R) process is the identified security incidents analyzed, validated, categorized, and prioritized?

Options

AIncident triage

BIncident recording and assignment

CContainment

DNotification
Incident triage is the phase in the Incident Handling and Response (IH&R) process where identified security incidents are analyzed, validated, categorized, and prioritized. This step is crucial for determining the severity of incidents and deciding on the order in which they should be addressed. During triage, incident handlers assess the impact, urgency, and potential harm of an incident to prioritize their response efforts effectively. This ensures that resources are allocated efficiently, and the most critical incidents are handled first. Incident recording and assignment involve logging incidents and assigning them to handlers, containment focuses on limiting the extent of damage, and notification involves informing stakeholders about the incident.

Answer
A

Question No: 9

MultipleChoice

Joseph is an incident handling and response (IH&R) team lead in Toro Network Solutions Company. As a part of IH&R process, Joseph alerted the service providers,

developers, and manufacturers about the affected resources.

Identify the stage of IH&R process Joseph is currently in.

Options

AEradication

BContainment

CIncident triage

DRecovery

Answer
BExplanation

When Joseph, the IH&R team lead, alerted service providers, developers, and manufacturers about the affected resources, he was engaged in the Containment stage of the Incident Handling and Response (IH&R) process. Containment involves taking steps to limit the spread or impact of an incident and to isolate affected systems to prevent further damage. Alerting relevant stakeholders, including service providers and developers, is part of containment efforts to ensure that the threat does not escalate and that measures are taken to protect unaffected resources. This stage precedes eradication and recovery, focusing on immediate response actions to secure the environment. Reference: The ECIH v3 certification program outlines the IH&R process stages, explaining the roles and actions involved in containment, including communication with external and internal stakeholders to manage and mitigate the incident's effects.

Question No: 10

MultipleChoice

Identify the network security incident where intended or authorized users are prevented from using system, network, or applications by flooding the network with a

high volume of traffic that consumes all existing network resources.

Options

AXSS attack

BDenial-of-service

CURL manipulation

DSQL injection

Answer
BExplanation

A Denial-of-Service (DoS) attack is characterized by flooding the network with a high volume of traffic to consume all available network resources, preventing intended or authorized users from accessing system, network, or applications. This type of attack aims to overwhelm the target's capacity to handle incoming requests, causing a denial of access to legitimate users. Unlike XSS (Cross-Site Scripting) attacks, URL manipulation, or SQL injection, which exploit vulnerabilities in web applications for unauthorized data access or manipulation, a DoS attack specifically targets the availability of services. Reference: Incident Handler (ECIH v3) courses and study guides cover various types of network security incidents, including Denial-of-Service attacks, detailing their impact on network resources and services.

Question No: 11

MultipleChoice

Clark is investigating a cybercrime at TechSoft Solutions. While investigating the case,

he needs to collect volatile information such as running services, their process IDs,

startmode, state, and status.

Which of the following commands will help Clark to collect such information from

running services?

Options

AOpenfiles

Bnetstat --ab

Cwmic

Dnet file

Answer
CExplanation

WMIC (Windows Management Instrumentation Command-line) is a command-line tool that provides a unified interface for Windows management tasks, including the collection of system information. It allows administrators and forensic investigators to query the live system for information about running services, their process IDs, start modes, states, and statuses, among other data. The use of WMIC is particularly valuable in incident response scenarios for gathering volatile information from a system without having to install additional software, which might alter the state of the system being investigated. By executing specific WMIC commands, Clark can extract detailed information about the services running on a system at the time of the investigation, making it an essential tool for collecting volatile data in a forensically sound manner.

Question No: 12

MultipleChoice

Stenley is an incident handler working for Texa Corp. located in the United States. With the growing concern of increasing emails from outside the organization, Stenley was

asked to take appropriate actions to keep the security of the organization intact. In the process of detecting and containing malicious emails, Stenley was asked to check the

validity of the emails received by employees.

Identify the tools he can use to accomplish the given task.

Options

APointofMail

BEmail Dossier

CPoliteMail

DEventLog Analyzer

Answer
BExplanation

Email Dossier is a tool designed to perform detailed investigations on email messages to verify their authenticity and trace their origin. It can analyze email headers and provide information about the route an email has taken, the servers it passed through, and potentially malicious links or origins. For an incident handler like Stenley, tasked with verifying the validity of emails and containing malicious email threats, Email Dossier serves as a practical tool for analyzing and validating emails received by employees. By using this tool, Stenley can identify fraudulent or suspicious emails, thereby helping to protect the organization from phishing attacks, malware distribution, and other email-based threats.

Question No: 13

MultipleChoice

Which of the following is not a best practice to eliminate the possibility of insider attacks?

Options

ADisable the users from installing unauthorized software or accessing malicious websites using the corporate network

BMonitor employee behaviors and the computer systems used by employees

CImplement secure backup and disaster recovery processes for business continuity

DAlways leave business details over voicemail or email broadcast message

Answer
DExplanation

Leaving sensitive business details over voicemail or sending them out through email broadcast messages is not a best practice for security. This approach significantly increases the risk of information leakage and unauthorized access to critical business information. Such practices can be exploited by insiders to conduct malicious activities, including data theft, fraud, or sabotage. The best practices for mitigating insider threats involve implementing strict access controls, monitoring and auditing employee actions, securing communications, and ensuring that sensitive information is only shared through secure and authorized channels. Encouraging or allowing the practice of leaving sensitive business details in such insecure manners contradicts the principles of information security and increases the vulnerability to insider attacks.

Question No: 14

MultipleChoice

Computer forensics is methodical series of techniques and procedures for gathering evidence from computing equipment, various storage devices and or digital media that can be presented in a course of law in a coherent and meaningful format. Which one of the following is an appropriate flow of steps in the computer forensics process:

Options

AExamination> Analysis > Preparation > Collection > Reporting

BPreparation > Analysis > Collection > Examination > Reporting

CAnalysis > Preparation > Collection > Reporting > Examination

DPreparation > Collection > Examination > Analysis > Reporting

Answer
D

Question No: 15

MultipleChoice

Risk is defined as the probability of the occurrence of an incident. Risk formulation generally begins with the likeliness of an event's occurrence, the harm it may cause and is usually denoted as Risk = (events)X(Probability of occurrence)X?

Options

AMagnitude

BProbability

CConsequences

DSignificance

Answer
A

Question No: 16

MultipleChoice

Incident handling and response steps help you to detect, identify, respond and manage an incident. Which of the following steps focus on limiting the scope and extent of an incident?

Options

AEradication

BContainment

CIdentification

DData collection

Answer
B

Question No: 17

MultipleChoice

Which of the following is an appropriate flow of the incident recovery steps?

Options

ASystem Operation-System Restoration-System Validation-System Monitoring

BSystem Validation-System Operation-System Restoration-System Monitoring

CSystem Restoration-System Monitoring-System Validation-System Operations

DSystem Restoration-System Validation-System Operations-System Monitoring

Answer
D

Question No: 18

MultipleChoice

A computer Risk Policy is a set of ideas to be implemented to overcome the risk associated with computer security incidents. Identify the procedure that is NOT part of the computer risk policy?

Options

AProcedure to identify security funds to hedge risk

BProcedure to monitor the efficiency of security controls

CProcedure for the ongoing training of employees authorized to access the system

DProvisions for continuing support if there is an interruption in the system or if the system crashes

Answer
C

Question No: 19

MultipleChoice

The flow chart gives a view of different roles played by the different personnel of CSIRT. Identify the incident response personnel denoted by A, B, C, D, E, F and G.

Options

AA-Incident Analyst, B- Incident Coordinator, C- Public Relations, D-Administrator, E- Human Resource, F-Constituency, G-Incident Manager

BA- Incident Coordinator, B-Incident Analyst, C- Public Relations, D-Administrator, E- Human Resource, F-Constituency, G-Incident Manager

CA- Incident Coordinator, B- Constituency, C-Administrator, D-Incident Manager, E- Human Resource, F-Incident Analyst, G-Public relations

DA- Incident Manager, B-Incident Analyst, C- Public Relations, D-Administrator, E- Human Resource, F-Constituency, G-Incident Coordinator

Answer
C

Question No: 20

MultipleChoice

Business continuity is defined as the ability of an organization to continue to function even after a disastrous event, accomplished through the deployment of redundant hardware and software, the use of fault tolerant systems, as well as a solid backup and recovery strategy. Identify the plan which is mandatory part of a business continuity plan?

Options

AForensics Procedure Plan

BBusiness Recovery Plan

CSales and Marketing plan

DNew business strategy plan

Answer
B

Limited Time Offer

25%

Off

Get Premium 212-89 Questions as Interactive Web-Based Practice Test or PDF