Free ECCouncil 212-89 Practice Exam with Questions & Answers | Set: 6

According to the ECIH Risk Assessment and Recovery module, neutralizing the vulnerability is the top priority during active exploitation, even in nation-state scenarios.

Option C is correct because immediately patching and deploying updates removes the attacker’s access vector and prevents further compromise. ECIH discourages counter-hacking and premature disclosure without containment.

Options A and B may follow after stabilization. Option D is illegal and prohibited.

Therefore, rapid patching is the correct primary action.

This scenario describes an evil twin attack, a well-documented wireless network threat covered in the ECIH Network Security Incidents module. An evil twin attack occurs when an attacker sets up a rogue wireless access point that mimics the SSID of a legitimate network. Unsuspecting users connect to the stronger or more accessible signal, allowing attackers to intercept credentials, inject malware, or perform man-in-the-middle attacks.

Option A is correct because the presence of an unauthorized access point broadcasting the same SSID and causing authentication failures is a defining indicator of an evil twin attack. Users may unknowingly connect to the malicious access point, leading to repeated disconnections from the legitimate network.

Option B would not involve a rogue access point. Option C focuses on identity spoofing at the MAC layer but does not explain SSID duplication. Option D involves IP address assignment issues, not SSID impersonation.

ECIH emphasizes that identifying rogue wireless infrastructure quickly is critical to containment. Detecting evil twin attacks allows responders to isolate the rogue device, protect credentials, and restore secure wireless operations.

Explanation (aligned to threat intelligence & detection):

A high-interaction honeypot is designed to attract and engage adversaries, providing realistic services so defenders can observe tactics, techniques, and procedures (TTPs) with higher fidelity than a low-interaction decoy. The goal is not to “stop” attacks directly, but to detect and learn: identify scanning patterns, credential stuffing attempts, exploit chains, payload delivery methods, and post-exploitation behaviors such as enumeration and lateral movement. That intelligence is then used to improve controls—signatures, detections, segmentation, and hardening priorities.

Sandboxing (B) is typically about detonating suspicious files/URLs to observe behavior in a controlled environment; it’s not what a DMZ honeypot primarily does. ACL rules and DDoS blocking (C) are traffic filtering measures, not deception telemetry. Backup/recovery testing (D) is resilience planning, unrelated to studying attacker behavior in real-time.

In incident handling terms, honeypots support the “preparation” and “detection” posture—expanding visibility, generating early warning, and enriching threat intelligence. They can also reduce risk by luring opportunistic attackers away from production assets, but their primary value is behavioral observation and evidence collection.

Not enabling default administrative accounts is crucial to ensuring accountability and minimizing the risk of insider attacks by privileged users. By disabling or renaming default accounts, organizations can better track the actions performed by individual administrators, reducing the risk of unauthorized or malicious activities going unnoticed. This practice is part of a broader approach to privilege management that includes limiting permissions to the minimum necessary and monitoring the use of administrative privileges.

Explanation (aligned to IH & R lifecycle):

This question is about triage/validation—determining whether what you see is truly an incident and establishing priority. The most appropriate first move is to use endpoint telemetry and behavioral analytics (A) to validate maliciousness (e.g., suspicious parent/child process chains, token manipulation, credential dumping patterns, anomalous privilege escalation, and data transfer behaviors). This supports fast, evidence-based classification and reduces unnecessary disruption. Option (C) is containment and may be required after validation or for clearly high-confidence cases, but immediately disconnecting multiple endpoints can destroy volatile evidence, break business operations, and reduce your ability to trace lateral movement patterns across hosts. Option (B) is a broad preventive change that can create outage risk and is not a validation method. Option (D) can be helpful, but it is slower and not the primary “detect and validate” action for an internal team facing active anomalies.

A disciplined approach is: validate via behavioral tooling + logs, scope affected endpoints, determine severity, then execute containment proportional to confirmed risk. That sequencing mirrors standard incident handling flow (identify → validate/triage → contain → eradicate → recover → lessons learned). When time matters, the highest-value action is the one that converts ambiguous signals into confident incident classification quickly—behavioral validation does that best.

An Inappropriate Usage incident refers to instances where computing resources are misused or abused, often violating organizational policies or laws. While access-control attacks, reconnaissance attacks, and denial-of-service (DoS) attacks represent different types of external threats or methods of attack, an Insider Threat is an example of inappropriate usage. Insider threats come from individuals within the organization, such as employees or contractors, who misuse their access to harm the organization ' s interests. This can include stealing confidential information, intentionally disrupting systems, or other malicious activities that leverage their legitimate access to the organization ' s resources.

Synthetic identity theft is a type of fraud where the perpetrator combines real (often stolen) and fake information to create a new identity. This can include combining a real social security number with a fictitious name, or other variations that result in an identity that is not entirely real but has elements that can pass through verification processes. In the scenario described, Adam is creating a new identity using information from different victims, which is characteristic of synthetic identity theft. This type of fraud is particularly challenging to detect and counter because it does not directly impersonate a single real individual but creates a plausible new identity that can be used to open accounts, obtain credit, and conduct transactions that can be financially beneficial to the attacker.

This scenario requires decisive action across containment, analysis, and recovery, as defined in the ECIH incident handling lifecycle.

Option C is correct because isolating affected systems prevents further manipulation, forensic examination identifies scope and method, and restoring from a verified clean backup ensures data integrity. ECIH emphasizes verified restoration only after investigation begins.

Options A, B, and D are premature or speculative and risk misinformation.

Once malware is identified, ECIH guidance requires responders to analyze before eradication to understand scope, infection vectors, persistence mechanisms, and data impact. This ensures effective removal and prevents reinfection.

Option C is correct because forensic analysis allows investigators to determine how the malware entered the system, what data was accessed, and whether additional components are compromised. Without this understanding, containment and recovery efforts may be incomplete or ineffective.

Option A is a containment step but does not address root cause. Option B is a notification step that must be supported by verified facts. Option D protects future data but does not address the active malware.

Therefore, forensic analysis is the ideal primary action following detection, as emphasized in the ECIH malware handling process.

In the static data collection process, which is part of digital forensics and incident handling, the focus is on acquiring and examining digital evidence without altering the system or the data itself. This process includes evidence examination, where the data is analyzed; system preservation, where the current state of a system or data is maintained to ensure no alteration occurs; and evidence acquisition, which involves creating an exact binary copy of the digital evidence. Password protection, however, is not a part of the static data collection process. Instead, it relates to securing access to data or systems but does not directly involve the collection or preservation of static data for forensic purposes.