Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 212-89 (EC-Council Certified Incident Handler) Practice Test 1

Question 1

The organization needs to repair the response procedure after: An organization has a CSF 2.0 profile but incorrectly claims it is a forensic evidence acquisition standard. The audit requires an explicit connection between CSF 2.0 strategic outcomes and the separate technical procedures used to acquire forensic evidence. Which corrective mapping is most complete?

  1. Update the plan's references and map its workflow to CSF 2.0 functions
  2. Examine the profile's Govern, Identify, Protect, Detect, Respond and Recover functions
  3. Map incident response capabilities to CSF functions and forensic SOPs
  4. Maintain clear mappings between strategic frameworks and tactical procedures
  5. Use a separate validated forensic procedure for evidence handling

Explanation

Correct Answer

C:

Complementary guidance avoids treating a framework as a detailed tool runbook; the correction restores accountability or sequence for what CSF 2.0 actually organizes before case sign-off.

Incorrect Answers

A:

Revision 3 is a CSF 2.0 community profile rather than a mere renumbering of the old phase list; the relevant condition for that step is whether cited incident-response guidance is current, which is not shown for what CSF 2.0 actually organizes.

B:

These risk-management outcomes do not prescribe bit-for-bit disk imaging procedures; the requirement concerns what CSF 2.0 actually organizes, so verification is not the corrective step.

D:

Document clarity prevents responders from expecting nonexistent implementation instructions; future hardening is not current-state recovery in the decision about what CSF 2.0 actually organizes.

E:

Specific acquisition methods are still needed alongside strategic cybersecurity outcomes; the case needs procedural correction addressing what CSF 2.0 actually organizes; temporary protection does not complete correction.

Question 2

Before revising the playbook, the incident manager checks the following: Incident owners repeatedly close cases without documenting root cause or detection gaps. Which audit, correlation or test best verifies the reported governance weakness?

  1. Track detection and control fixes to evidence-backed completion
  2. Examine service configuration, scheduled starts and account-use records
  3. Review closed case records for corrective actions and unresolved causal factors
  4. Reopen the improvement review and assign corrective-action owners
  5. Make a blameless post-incident review a required high-severity milestone

Explanation

Correct Answer

C:

A complete lessons-learned record should identify why controls failed or succeeded; this provides an auditable basis for the disputed finding: what post-incident learning is missing.

Incorrect Answers

A:

Measured remediation converts the review into preventive change; when judging what post-incident learning is missing, recovery is not factual verification; this is instead procedural correction.

B:

Persistence and stolen credentials can sustain access after one file is deleted; that method could help with whether eradication removed the attack's persistence; the process validation decision here involves what post-incident learning is missing.

D:

A documented follow-up prevents recurring problems from being buried at closure; the goal is process validation for what post-incident learning is missing. Immediate protection does not substantiate findings.

E:

Structured learning improves response without punishing accurate reporting; prevention is not incident verification in the decision about what post-incident learning is missing.

Question 3

The response coordinator tests a weakness described in these records: An alert involving payment-card data was categorized low because only one host was affected. What case-specific check would establish how this response procedure failed?

  1. Map both case records against a common impact-and-urgency matrix
  2. Review affected data classification together with host criticality and exposure
  3. Include data sensitivity and regulatory triggers in triage scoring
  4. Escalate under the high-impact data-exposure criteria

Explanation

Correct Answer

B:

Business sensitivity can outweigh the number of visibly impacted machines; that check tests whether incident priority reflects business impact without assuming that a policy citation alone proves operational compliance.

Incorrect Answers

A:

Shared criteria permit consistent escalation despite different local terminology; it is meant to address how to normalize severity across organizational units, not process validation for whether incident priority reflects business impact.

C:

Impact criteria prevent host-count-only severity mistakes; the goal is process validation for whether incident priority reflects business impact. Prevention is not incident verification.

D:

Severity-based routing brings in the correct legal and technical decision makers early; immediate protection does not substantiate findings in the decision about whether incident priority reflects business impact.

Question 4

A documented handling problem requires corrective follow-through: Law enforcement requests original disk evidence while the business intends to overwrite the device for restoration. What documented correction must be verified before the procedural case closes?

  1. Preserve a verified forensic image and secure the original under chain of custody
  2. Define legal-hold and release procedures in incident playbooks
  3. Log recipient, purpose, content and secure deletion or retention terms
  4. Restore business operations only from an authorized clean replacement

Explanation

Correct Answer

D:

Separating working systems from retained evidence avoids destroying potentially material data; procedural closure should resolve how to reconcile evidence preservation with operational recovery in the incident record, not just remove a visible symptom.

Incorrect Answers

A:

Maintaining evidentiary integrity permits separate operational restoration decisions; the requirement concerns how to reconcile evidence preservation with operational recovery, so temporary protection does not complete correction.

B:

Clear handoffs reduce conflict between investigation and service recovery; the goal is procedural correction for how to reconcile evidence preservation with operational recovery. Future hardening is not current-state recovery.

C:

A complete disclosure record supports accountability after the incident; this serves what authorization governs external evidence sharing, whereas the requested result is procedural correction involving how to reconcile evidence preservation with operational recovery.

Question 5

An incident-process audit asks for a defensible finding about this case: Before a breach, the organization has no access to offline recovery credentials or responder contact numbers. Which assessment task resolves the central procedural uncertainty?

  1. Run a tabletop test using only resources available during network isolation
  2. Compare contract clauses, contact trees and tested vendor response procedures
  3. Exercise loss-of-domain and loss-of-email scenarios on a schedule
  4. Establish a secure out-of-band contact and emergency access procedure

Explanation

Correct Answer

A:

The exercise exposes dependencies on systems likely to be unavailable during an attack; the review establishes whether preparation includes out-of-band access so that responsibility and next decisions rest on a recorded result.

Incorrect Answers

B:

Missing duties can delay notification, collection and containment across boundaries; that method could help with whether third-party handoffs are executable; the process validation decision here involves whether preparation includes out-of-band access.

C:

Practical drills expose hidden dependencies earlier than a paper review; for whether preparation includes out-of-band access, prevention is not incident verification; process validation remains necessary.

D:

Separating response communications from affected infrastructure sustains coordination; the requirement concerns whether preparation includes out-of-band access, so immediate protection does not substantiate findings.

Question 6

An improvement plan must address recurrence after this case: A SIEM identifies a phishing indicator but responders copy it manually between five security products. What should the owner add to the normal control review to reduce recurrence?

  1. Monitor action completion receipts rather than workflow invocation alone
  2. Use tested SOAR integrations with access-scoped service identities
  3. Measure alert-to-block latency across the ticket and tool audit trails
  4. Verify each downstream control acknowledged and applied the block

Explanation

Correct Answer

B:

Controlled integrations reduce transcription errors without granting unnecessary privileges; it makes the lesson about where manual coordination delays indicator response part of normal operations.

Incorrect Answers

A:

End-to-end confirmation catches silent integration and acknowledgement failures; the other incident centers on why orchestration status differs from control state, not this readiness improvement question about where manual coordination delays indicator response.

C:

Timestamped actions reveal which manual transfer created the largest exposure window; the goal is readiness improvement for where manual coordination delays indicator response. An investigation is not recurrence prevention.

D:

Execution evidence distinguishes a submitted workflow from actual protection; case recovery is not future-risk control in the decision about where manual coordination delays indicator response.

Question 7

A post-incident audit examines the following failure mode: Two analysts independently investigate the same suspicious endpoint and each issues conflicting containment instructions. What recurring check or restriction would best address the weakness?

  1. Reconcile both timelines and publish one approved response plan
  2. Mandate a minimum handoff checklist and acknowledged ownership transfer
  3. Audit ticket ownership changes and responder action timestamps
  4. Require a named owner and change log for every high-severity incident

Explanation

Correct Answer

D:

Formal accountability prevents duplicated actions and untraceable decisions; this turns the weakness behind how incident ownership and assignments broke down into a measurable prevention requirement.

Incorrect Answers

A:

A consolidated record restores situational awareness and defines next responsibilities; case recovery is not future-risk control in the decision about how incident ownership and assignments broke down.

B:

Standardized continuity reduces delays during overnight escalation; that method could help with the missing continuity of incident response; the readiness improvement decision here involves how incident ownership and assignments broke down.

C:

The case history reveals parallel work and the absence of an authoritative incident owner; when judging how incident ownership and assignments broke down, an investigation is not recurrence prevention; this is instead process validation.

Question 8

A documented handling problem requires corrective follow-through: An alert on a production database has high confidence but the scope is unknown and the assigned analyst wants to close it. What corrective record or operational change resolves this process weakness?

  1. Record the final validated scope, disposition and decision rationale
  2. Escalate the case for scoped investigation under the critical-asset rule
  3. Use severity criteria combining confidence, criticality and potential data impact
  4. Record shared responsibilities and preserve both parties' case artifacts

Explanation

Correct Answer

A:

Closure requires corroborating evidence and documented review; the affected handling process should be validated against what triage must establish before closure after the change.

Incorrect Answers

B:

Preserving an active investigation prevents premature closure of a high-impact event; for what triage must establish before closure, temporary protection does not complete correction; procedural correction remains necessary.

C:

Balanced triage avoids dismissing important uncertain alerts; the requirement concerns what triage must establish before closure, so future hardening is not current-state recovery.

D:

A unified timeline supports investigation despite separate infrastructures; it is meant to address whether third-party handoffs are executable, not procedural correction for what triage must establish before closure.

Question 9

During lessons learned, the security owner reviews this completed incident: A ransomware alert has no assigned communication owner, and public relations releases contradictory information. Which repeatable safeguard best prevents this failure mode in the future?

  1. Issue a corrected, fact-checked situation report with known uncertainties
  2. Preassign spokespersons, approval gates and communication templates
  3. Compare incident command approvals with each outbound statement
  4. Predefine emergency network-change authorities and rollback criteria

Explanation

Correct Answer

B:

A rehearsal-tested plan makes crisis messages consistent; it closes a repeatable gap revealed by what made external incident messaging inconsistent without removing useful monitoring.

Incorrect Answers

A:

Controlled updates restore reliable communication without asserting unverified facts; the requirement concerns what made external incident messaging inconsistent, so case recovery is not future-risk control.

C:

Missing authorization reveals why accounts of the event diverged; an investigation is not recurrence prevention in the decision about what made external incident messaging inconsistent.

D:

A tested authorization path prevents uncontrolled containment disruption; the activity targets the control approval missing from the change; readiness improvement here concerns what made external incident messaging inconsistent.

Question 10

Before revising the playbook, the incident manager checks the following: An intrusion drill finds that the isolation runbook references network ports moved during last quarter's redesign. Which targeted review or exercise would most directly validate this process gap?

  1. Confirm the correct enforcement point before pushing emergency blocks
  2. Treat infrastructure changes as triggers for playbook maintenance
  3. Run a tabletop test using only resources available during network isolation
  4. Compare the runbook network map with live segmentation and routing inventory

Explanation

Correct Answer

D:

Outdated topology can make otherwise sound containment instructions ineffective; the review establishes whether playbooks match current architecture so that responsibility and next decisions rest on a recorded result.

Incorrect Answers

A:

Targeted network action avoids isolating unrelated services; the requirement concerns whether playbooks match current architecture, so immediate protection does not substantiate findings.

B:

Change-driven review prevents stale emergency instructions; the goal is process validation for whether playbooks match current architecture. Prevention is not incident verification.

C:

The exercise exposes dependencies on systems likely to be unavailable during an attack; it is meant to address whether preparation includes out-of-band access, not process validation for whether playbooks match current architecture.

EC-Council Certified Incident Handler (212-89) Practice Tests