Free ECCouncil 212-89 Practice Exam with Questions & Answers | Set: 5

Restoring web application services with the help of existing backups, as performed by Robert, falls under the Recovery stage of the Incident Handling and Response (IH&R) process. The Recovery stage involves actions taken to return the organization to normal operations after an incident, which includes restoring systems to their operational state using backups, patching vulnerabilities, and ensuring that all systems are clean and secure before being brought back online. This step is crucial for resuming business operations and mitigating the impact of the incident.

URL encoding, also known as percent-encoding, is a mechanism for encoding information in a Uniform Resource Identifier (URI) under certain circumstances. This technique involves replacing unsafe ASCII characters with a "%" followed by two hexadecimal digits that represent the character's ASCII code. This is necessary for embedding characters that are not allowed in URLs directly, such as spaces and symbols, or characters that have special meanings within URLs, ensuring that the URL is correctly interpreted by web browsers and servers.

Employee monitoring tools are primarily used by employers to detect and prevent malicious insider threats. These tools can track activities such as data access, data exfiltration attempts, unauthorized actions, and other behaviors that could indicate malicious intent or pose a risk to the organization's security. While such tools may also incidentally uncover issues like lost registry keys, conspiracies, or stolen credentials, their main purpose is to safeguard against insiders who might misuse their access to harm the organization, steal data, sabotage systems, or engage in espionage.

This scenario directly reflects crime scene documentation and physical reconstruction, a core principle in the Forensic Readiness and First Response module of the ECIH curriculum. First responders must assume that every physical detail may later become relevant in court proceedings or advanced forensic reconstruction.

Option A is correct because Tara’s actions—photographing cable connections, labeling ports, documenting power states, and noting spatial orientation—are explicitly designed to allow investigators to recreate the original physical environment. ECIH emphasizes that improper documentation of physical layout can invalidate conclusions about device usage, peripheral connections, or data paths.

Option B is incorrect because uptime continuity is not her objective. Option C refers to live system analysis, which she is not performing. Option D applies to digital evidence integrity after acquisition, not scene documentation.

ECIH stresses that physical reconstruction references are especially important in insider threat investigations, where proving who had access, which devices were connected, and how data could have been transferred is critical. Tara’s approach ensures forensic soundness, minimizes contamination risk, and preserves contextual evidence.

This scenario is a clear example of a deceptive phishing attack, which is extensively covered in the ECIH Email Security Incident module. Deceptive phishing involves impersonating a trusted internal entity—such as HR—to trick recipients into disclosing sensitive information like credentials or personal data.

Option D is correct because the email impersonates HR, uses social engineering, and directs users to a visually identical but fraudulent login page hosted on an unfamiliar domain. These characteristics are classic indicators of deceptive phishing.

Option A refers to DNS manipulation and is not evidenced here. Option B involves overwhelming email volume rather than deception. Option C refers to unsolicited bulk email without impersonation.

Elena’s actions align with ECIH best practices: preserving headers for forensic validation, capturing screenshots to document fraudulent infrastructure, and blocking malicious domains to prevent further exposure. Correctly categorizing the incident as deceptive phishing ensures appropriate eradication, awareness, and reporting measures.

This scenario requires decisive action across containment, analysis, and recovery, as defined in the ECIH incident handling lifecycle.

Option C is correct because isolating affected systems prevents further manipulation, forensic examination identifies scope and method, and restoring from a verified clean backup ensures data integrity. ECIH emphasizes verified restoration only after investigation begins.

Options A, B, and D are premature or speculative and risk misinformation.

Eradication is the step in the incident handling and response process where the root cause of an incident is removed, and measures are taken to close all attack vectors to prevent similar incidents in the future. After an incident has been properly contained to stop it from spreading or causing further damage, the eradication phase focuses on eliminating the source of the incident. This could involve removing malware, closing vulnerabilities, or implementing stronger security measures to address the exploitation paths used by the attacker.

In the scenario with Raven, notifying service providers and developers of affected resources is part of the actions taken to address the root cause of the incident. This ensures that any vulnerabilities or issues that contributed to the incident are fixed. By working to remove the root cause and secure the system against similar attacks, Raven is effectively implementing the eradication step of the incident handling process.

User Behavior Analytics (UBA) is a cybersecurity process or tool that utilizes machine learning, algorithms, and statistical analyses to detect potentially harmful activities within an organization's network by comparing them against established patterns of users' behavior. It is particularly effective in identifying malicious internal actors or compromised users who may be conducting activities that deviate from their normal behavior patterns, such as accessing unauthorized data or systems, excessive file downloads, or unusual login times. UBA tools can flag these activities for further investigation, often before traditional security tools detect a breach. In contrast, SOC2 compliance reports, log forwarding, and syslog configuration are important for maintaining and auditing security standards and for infrastructure monitoring, but they are not primarily focused on detecting malicious behavior based on deviations from established user behavior patterns.

Email Dossier is a tool designed to perform detailed investigations on email messages to verify their authenticity and trace their origin. It can analyze email headers and provide information about the route an email has taken, the servers it passed through, and potentially malicious links or origins. For an incident handler like Stenley, tasked with verifying the validity of emails and containing malicious email threats, Email Dossier serves as a practical tool for analyzing and validating emails received by employees. By using this tool, Stenley can identify fraudulent or suspicious emails, thereby helping to protect the organization from phishing attacks, malware distribution, and other email-based threats.

This incident involves malware actively impacting medical devices, posing patient safety risks. According to ECIH malware incident handling principles, the first priority is containment and eradication at the endpoint level.

Option D is correct because deploying endpoint protection directly detects and halts malware execution on the MRI machines, stopping both manipulation of results and further malicious activity. Endpoint containment is essential before network-level or recovery actions.

Option B addresses communication but does not stop local manipulation. Option C alters system state without containment. Option A is a regulatory step that follows validation.

ECIH emphasizes that in critical infrastructure and healthcare environments, immediate endpoint containment is essential to protect safety and data integrity.