Eccouncil 212-89 Exam - Topic 3 Question 76 Discussion

Actual exam question for Eccouncil's 212-89 exam

Question #: 76
Topic #: 3

[All 212-89 Questions]

Robert is an incident handler working for Xsecurity Inc. One day, his organization

faced a massive cyberattack and all the websites related to the organization went

offline. Robert was on duty during the incident and he was responsible to handle the

incident and maintain business continuity. He immediately restored the web application

service with the help of the existing backups.

According to the scenario, which of the following stages of incident handling and

response (IH&R) process does Robert performed?

AEvidence gathering and forensics analysis

BEradication

CNotification

DRecovery

Show Suggested Answer

Suggested Answer: C

Threat correlation is a method used by incident responders to analyze and associate various indicators of compromise (IoCs) and alerts to identify genuine threats. By correlating data from multiple sources and applying intelligence to distinguish between unrelated events and coordinated attack patterns, responders can significantly reduce the rate of false-positive alerts. This enables teams to prioritize their efforts on the most critical and likely threats, thereby reducing potential risks and corporate liabilities. Effective threat correlation involves the use of sophisticated security information and event management (SIEM) systems, threat intelligence platforms, and analytical techniques to identify relationships between seemingly disparate security events and alerts.

by Paris at Feb 07, 2025, 12:33 AM

Limited Time Offer

25%

Off

Get Premium 212-89 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Lavera

9 months ago

Not sure if that's enough to call it Recovery. Seems rushed.

upvoted 0 times

...

Blondell

9 months ago

Wait, he just restored backups? What about the root cause?

upvoted 0 times

...

Tori

10 months ago

Agreed, Recovery makes sense here. Good job, Robert!

upvoted 0 times

...

Coral

10 months ago

I think he should've done more forensics first.

upvoted 0 times

...

Joseph

10 months ago

Definitely the Recovery stage! Restoring service is key.

upvoted 0 times

...

Quentin

10 months ago

I’m a bit confused; could it also be considered Notification since he might need to inform others about the incident?

upvoted 0 times

...

Micah

11 months ago

This reminds me of a practice question where we discussed the importance of Recovery after an incident. I feel like that's definitely what he did.

upvoted 0 times

...

Susana

11 months ago

I'm not entirely sure, but I remember something about Eradication being about removing threats, which doesn't seem to fit here.

upvoted 0 times

...

Jessenia

11 months ago

I think Robert's actions relate to the Recovery stage since he restored the web application service using backups.

upvoted 0 times

...

Carey

11 months ago

Based on the details provided, I think the correct answer is D. Recovery. The scenario states that Robert restored the web application service, which aligns with the recovery stage of the incident handling process.

upvoted 0 times

...

Sarah

11 months ago

I'm a bit confused here. The scenario talks about Robert handling the incident, but it doesn't explicitly mention all the stages of the incident handling process. I'll have to re-read the question and options carefully to make sure I don't miss anything.

upvoted 0 times

...

Portia

11 months ago

Okay, let's see. The question says Robert immediately restored the web application service, so that sounds like the recovery stage to me. I'm going to go with option D.

upvoted 0 times

...

Cletus

11 months ago

Hmm, I'm a bit unsure about this one. The scenario mentions restoring the web application, but I'm not sure if that falls under the "recovery" stage or some other stage. I'll have to think this through carefully.

upvoted 0 times

...

Alisha

11 months ago

This seems like a straightforward question about the incident handling process. I'm pretty confident I can identify the correct stage based on the details provided.

upvoted 0 times

...

Luis

1 year ago

Recovery, eh? I bet Robert was doing the happy dance when he got those websites back up and running. Maybe he even high-fived a few servers along the way.

upvoted 0 times