Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 212-89 (EC-Council Certified Incident Handler) Practice Test 72

Question 710

Responders are preparing to reinstate operations after this situation: A reverse proxy trusts an unverified X-Forwarded-For header and attackers bypass source-IP access rules. What should be corrected before technical closure of the incident?

  1. Configure explicit trusted proxies and review affected privileged requests
  2. Stop trusting unapproved forwarded headers and restrict sensitive routes
  3. Recalculate price and discount server-side and reconcile impacted orders
  4. Test reverse-proxy trust boundaries in configuration reviews

Explanation

Correct Answer

A:

Correct parsing requires known proxy topology and header stripping; the change should be tested before unrestricted operations resume for the event involving whether client IP spoofing defeats application access control.

Incorrect Answers

B:

Containment restores actual network identity as the access basis; the requirement concerns whether client IP spoofing defeats application access control, so temporary protection does not complete correction.

C:

Authoritative server checks repair transactional integrity; the other incident centers on whether business logic trusts client-calculated pricing, not this trusted restoration question about whether client IP spoofing defeats application access control.

D:

Header provenance matters to access-control decisions; future hardening is not current-state recovery in the decision about whether client IP spoofing defeats application access control.

Question 711

While full remediation remains pending, the commander receives this incident report: A server renders a user-supplied template and leaks environment values when special template expressions are submitted. Which first protective measure directly limits the situation without assuming cleanup is finished?

  1. Use sandboxed or data-only templates and review leaked configuration
  2. Disable user-controlled template execution and rotate potentially exposed secrets
  3. Compare submitted template syntax with rendered output and application exceptions
  4. Restrict the vulnerable feature and isolate compromised application hosts

Explanation

Correct Answer

B:

Stopping evaluation limits additional disclosure and downstream abuse; the scope of this restriction follows whether server-side template injection exposes secrets rather than indiscriminately changing unrelated assets.

Incorrect Answers

A:

Recovery must treat environment secrets as possibly compromised; the case needs initial containment or preservation addressing whether server-side template injection exposes secrets; corrective follow-through follows initial protection.

C:

Unexpected evaluation of expressions indicates an unsafe template engine context; for whether server-side template injection exposes secrets, investigation alone does not control current conditions; initial containment or preservation remains necessary.

D:

A web process that launches attacker commands requires host-level containment; that method could help with whether OS command injection is occurring; the initial containment or preservation decision here involves whether server-side template injection exposes secrets.

Question 712

Post-containment analysis identified this issue for correction: A login API allows unlimited rapid password attempts against one username with no delay or lockout monitoring. Which remediation is supported by the observed root-cause conditions?

  1. Review successful logins and reset compromised passwords if identified
  2. Make reset flow responses uniform and review possible credential-stuffing follow-up
  3. Use adaptive throttling, MFA and account-abuse analytics
  4. Apply risk-based rate limiting and protective account challenges

Explanation

Correct Answer

A:

Prevention of future attempts does not undo a successful takeover; the resulting state needs verification against the original concern: whether online credential guessing is constrained.

Incorrect Answers

B:

Defensive design closes the disclosure channel; that method could help with whether account enumeration is exposed; the trusted restoration decision here involves whether online credential guessing is constrained.

C:

Layered defenses make bulk guessing more expensive; the goal is trusted restoration for whether online credential guessing is constrained. Future hardening is not current-state recovery.

D:

Throttling reduces guessing without permanent denial to legitimate users; temporary protection does not complete correction in the decision about whether online credential guessing is constrained.

Question 713

After technical restoration, responders document the weakness exposed by: A password-reset endpoint reveals whether an email address has an account by returning different messages and timings. Which long-term control would reduce exposure to this specific pattern?

  1. Compare response bodies, status codes and timing for known and unknown accounts
  2. Use adaptive throttling, MFA and account-abuse analytics
  3. Make reset flow responses uniform and review possible credential-stuffing follow-up
  4. Test authentication workflows for user enumeration and rate abuse
  5. Rate-limit repeated reset attempts and normalize observable responses

Explanation

Correct Answer

D:

Preventive testing addresses privacy and brute-force risks; the control owner can test whether this reduces repeat conditions affecting whether account enumeration is exposed.

Incorrect Answers

A:

Consistent differences allow attackers to validate account existence; for whether account enumeration is exposed, an investigation is not recurrence prevention; recurrence prevention remains necessary.

B:

Layered defenses make bulk guessing more expensive; the activity targets whether online credential guessing is constrained; recurrence prevention here concerns whether account enumeration is exposed.

C:

Defensive design closes the disclosure channel; the goal is recurrence prevention for whether account enumeration is exposed. Case recovery is not future-risk control.

E:

Containment restricts automated enumeration without blocking legitimate resets; the case needs recurrence prevention addressing whether account enumeration is exposed; one-time protection is not durable prevention.

Question 714

Active first response is underway for the following condition: A compromised web service account has permission to modify unrelated databases in the same cluster. What is the most appropriate short-term restriction or first-response decision?

  1. Reissue a scoped credential and review unauthorized changes across accessible schemas
  2. Revoke unnecessary grants and rotate the exposed application secret
  3. Block the shell URL and isolate the compromised application instance
  4. Audit effective database grants and service account query history

Explanation

Correct Answer

B:

Least-privilege containment limits additional queries; it protects the affected workflow while investigators continue resolving whether excessive backend privilege expands attack impact.

Incorrect Answers

A:

Remediation needs both entitlement correction and breach scoping; the requirement concerns whether excessive backend privilege expands attack impact, so corrective follow-through follows initial protection.

C:

Removing the remote execution path limits follow-on commands; the other incident centers on whether uploaded code provided persistent remote access, not this initial containment or preservation question about whether excessive backend privilege expands attack impact.

D:

Cross-database privileges let a web compromise move beyond its own data; the case needs initial containment or preservation addressing whether excessive backend privilege expands attack impact; investigation alone does not control current conditions.

Question 715

A long-term control assessment uses this recent event: A web shell is found in an upload directory and appears to have been used to execute system commands. Which change provides measurable prevention rather than an emergency workaround?

  1. Inspect web access logs, shell file timestamps and process ancestry
  2. Inventory third-party components and apply risk-based update management
  3. Rebuild the application host and remediate the upload weakness
  4. Disable execution in upload storage and monitor new executable files

Explanation

Correct Answer

D:

Architecture should separate untrusted files from executable code; the assurance measure is designed around whether uploaded code provided persistent remote access, rather than hiding the reported activity.

Incorrect Answers

A:

Web requests connected to spawned commands support active shell usage; the goal is recurrence prevention for whether uploaded code provided persistent remote access. An investigation is not recurrence prevention.

B:

Maintained dependencies reduce known plug-in exploitation; the activity targets whether restart removed the exploitable component; recurrence prevention here concerns whether uploaded code provided persistent remote access.

C:

Deleting only the shell may leave other attacker changes; the case needs recurrence prevention addressing whether uploaded code provided persistent remote access; case recovery is not future-risk control.

Question 716

The team needs temporary protection and must retain evidence. The observed event is: An application accepts any HTTP method on its administrative routes even though only GET and POST are needed. What narrowly scoped action would best control the immediate risk?

  1. Test allowed verbs and handler behavior against the route specification
  2. Reject unapproved methods at the application or gateway
  3. Update router configuration and verify authorized methods still work
  4. Restore protective defaults and permit only reviewed widget origins

Explanation

Correct Answer

B:

Method constraints reduce exposed operations immediately; the immediate response addresses whether excess methods expose unintended functionality while the team preserves relevant case records.

Incorrect Answers

A:

Unexpected methods can reach unreviewed code paths or change server behavior; investigation alone does not control current conditions in the decision about whether excess methods expose unintended functionality.

C:

Recovery should align implementation with intended API contract; when judging whether excess methods expose unintended functionality, corrective follow-through follows initial protection; this is instead trusted restoration.

D:

A scoped rule limits unintended execution and framing; it is meant to address whether broad browser-policy relaxation created exposure, not initial containment or preservation for whether excess methods expose unintended functionality.

Question 717

A responder is tasked with limiting immediate impact after this report: A shopping-cart request changes the quantity after price calculation and the server trusts the client-supplied total. Which immediate safeguard protects the case while later remediation is planned?

  1. Stop trusting unapproved forwarded headers and restrict sensitive routes
  2. Compare backend order totals with server-side catalog price computations
  3. Suspend affected checkout paths and reject inconsistent totals
  4. Recalculate price and discount server-side and reconcile impacted orders

Explanation

Correct Answer

C:

Immediate validation prevents fraudulent transactions; this reduces current exposure associated with whether business logic trusts client-calculated pricing and permits later corrective work.

Incorrect Answers

A:

Containment restores actual network identity as the access basis; the other incident centers on whether client IP spoofing defeats application access control, not this initial containment or preservation question about whether business logic trusts client-calculated pricing.

B:

Manipulated client fields can bypass intended purchase validation; investigation alone does not control current conditions in the decision about whether business logic trusts client-calculated pricing.

D:

Authoritative server checks repair transactional integrity; when judging whether business logic trusts client-calculated pricing, corrective follow-through follows initial protection; this is instead trusted restoration.

Question 718

Before granting routine access again, the team reviews this case: A customer support portal submits state-changing requests without an anti-CSRF control and browsers attach valid session cookies. Which THREE case-specific measures form the verification, initial safeguard and corrective recovery stages, in that order of purpose? (Choose THREE.)

  1. Test horizontal privilege boundaries in API security reviews
  2. Use anti-CSRF middleware and secure cookie settings as complementary defenses
  3. Inspect request origin validation, CSRF tokens and cookie SameSite attributes
  4. Implement server-verified CSRF tokens and review unauthorized changes
  5. Temporarily restrict high-risk state changes while adding origin checks
  6. Use secure templating and CSP as defense in depth

Explanation

Correct Answers

C:

Cross-origin requests can exploit ambient authenticated browser state; within the combined response for whether cross-site request forgery is possible, this supplies evidence validation: it makes the determination of whether cross-site request forgery is possible defensible and reviewable by the incident owner.

D:

Protection must be checked on the server for each sensitive action; within the combined response for whether cross-site request forgery is possible, this supplies trusted restoration: the recovery decision is tied to whether cross-site request forgery is possible, not merely to reduced alert volume.

E:

Focused mitigation limits unintended requests during remediation; within the combined response for whether cross-site request forgery is possible, this supplies initial containment or preservation: this is a first-response safeguard for whether cross-site request forgery is possible, not a substitute for full root-cause analysis.

Incorrect Answers

A:

Authorization must be checked for each requested object; it is meant to address whether broken object-level authorization permits cross-account access, not trusted restoration for whether cross-site request forgery is possible.

B:

Standardized controls reduce browser-driven request forgery; the goal is trusted restoration for whether cross-site request forgery is possible. Future hardening is not current-state recovery.

F:

Code-level output controls are primary; browser policy provides additional limits; that method could help with whether stored cross-site scripting occurs; the trusted restoration decision here involves whether cross-site request forgery is possible.

Question 719

The team has retained the initial evidence and is assessing recovery from: A support portal lets users modify the role field in their own profile update request and become administrators. What restoration task closes the identified integrity or control gap?

  1. Use an allowlist of editable fields and restore legitimate roles
  2. Disable role mutation on the vulnerable endpoint and review newly elevated accounts
  3. Test model binding and privilege changes in API reviews
  4. Implement server-side object authorization and assess accessed invoices

Explanation

Correct Answer

A:

Server-owned privilege attributes need independent authorization; the resulting state needs verification against the original concern: whether mass assignment permits privilege escalation.

Incorrect Answers

B:

Containment removes the direct privilege escalation path; temporary protection does not complete correction in the decision about whether mass assignment permits privilege escalation.

C:

Mass-assignment checks catch hidden role manipulation; the case needs trusted restoration addressing whether mass assignment permits privilege escalation; future hardening is not current-state recovery.

D:

Recovery involves both code correction and exposure review; it is meant to address whether broken object-level authorization permits cross-account access, not trusted restoration for whether mass assignment permits privilege escalation.

Question 720

To avoid broad unnecessary disruption, responders consider this finding: A search page accepts a shell metacharacter in an input and a server-side process unexpectedly launches. The current decision requires two different outcomes: evidence-based verification AND initial protection, without treating cleanup as complete. Which TWO measures provide those outcomes? (Choose TWO.)

  1. Prohibit untrusted command interpolation and test process-spawning endpoints
  2. Restrict the vulnerable feature and isolate compromised application hosts
  3. Remove shell construction, use safe APIs and rebuild compromised instances
  4. Correlate crafted requests with application child-process creation and command logs
  5. Use parameterized queries and retest the vulnerable endpoint

Explanation

Correct Answers

B:

A web process that launches attacker commands requires host-level containment; within the combined response for whether OS command injection is occurring, this supplies initial containment or preservation: the protective decision should be recorded and its effect tested against whether OS command injection is occurring.

D:

A web parameter causing shell execution supports command injection; within the combined response for whether OS command injection is occurring, this supplies evidence validation: that evidence directly tests the concern about whether OS command injection is occurring, rather than relying on a single unverified indicator.

Incorrect Answers

A:

Secure design removes the attack primitive; prevention cannot replace immediate action in the decision about whether OS command injection is occurring.

C:

Escaping alone is weaker than avoiding shell interpretation; when judging whether OS command injection is occurring, corrective follow-through follows initial protection; this is instead trusted restoration.

E:

Bound parameters prevent user input from altering SQL command structure; the other incident centers on whether SQL injection reached an unsafe query path, not this initial containment or preservation question about whether OS command injection is occurring.

EC-Council Certified Incident Handler (212-89) Practice Tests