Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 212-89 (EC-Council Certified Incident Handler) Practice Test 86

Question 850

Cleanup is not considered complete. The case record describes: An Amazon EC2 instance makes unusual outbound connections and might be running an attacker-controlled process. Which remediation task is necessary rather than merely suppressing the visible symptom?

  1. Maintain preapproved isolation groups and forensic snapshot procedures
  2. Apply a restrictive security group or approved isolation mechanism to the instance
  3. Review subsequent actions by the role and restore approved IAM permissions
  4. Snapshot relevant EBS volumes and redeploy from a trusted image

Explanation

Correct Answer

D:

Disk capture and clean replacement address evidence and persistence separately; the recovery decision is tied to how to isolate suspected AWS compute without destroying evidence, not merely to reduced alert volume.

Incorrect Answers

A:

Prepared tooling avoids ad hoc instance termination; the case needs trusted restoration addressing how to isolate suspected AWS compute without destroying evidence; future hardening is not current-state recovery.

B:

Network quarantine limits egress while preserving disks for collection; when judging how to isolate suspected AWS compute without destroying evidence, temporary protection does not complete correction; this is instead initial containment or preservation.

C:

Rollback requires assessing what the expanded privileges enabled; that method could help with which AWS audit events explain privilege escalation; the trusted restoration decision here involves how to isolate suspected AWS compute without destroying evidence.

Question 851

The incident is not yet closed. Response staff report: An Azure VM is implicated in data theft, but its disk is scheduled for replacement during routine deployment. The incident owner wants a corroborating check and a protective action before recovery begins. Which TWO choices fit these separate tasks? (Choose TWO.)

  1. Enforce immutable tags, image signatures and least-privilege registry permissions
  2. Suspend destructive redeployment and isolate the VM with approved network controls
  3. Predefine Azure snapshot and network isolation playbooks
  4. Create authorized disk snapshots and investigate copies before clean rebuild
  5. Review managed disk, VM and relevant activity metadata before reprovisioning
  6. Apply Azure Policy and reviewed infrastructure-as-code for NSG controls

Explanation

Correct Answers

B:

Controlled access keeps the system from continuing external traffic; within the combined response for how to retain Azure compute evidence, this supplies initial containment or preservation: the immediate response addresses how to retain Azure compute evidence while the team preserves relevant case records.

E:

A replacement operation could remove the disks needed for examination; within the combined response for how to retain Azure compute evidence, this supplies evidence validation: the objective is to establish how to retain Azure compute evidence; the result can then guide the later protective decision.

Incorrect Answers

A:

Artifact integrity controls reduce malicious replacement; the relevant condition for that step is whether mutable image tags conceal a supply-chain compromise, which is not shown for how to retain Azure compute evidence.

C:

Cloud-native evidence collection should be rehearsed; when judging how to retain Azure compute evidence, prevention cannot replace immediate action; this is instead recurrence prevention.

D:

Disk snapshots preserve storage state but do not automatically capture all RAM; for how to retain Azure compute evidence, corrective follow-through follows initial protection; initial containment or preservation remains necessary.

F:

Guardrails detect or prevent excessive ingress; this serves which Azure record identifies the configuration change, whereas the requested result is initial containment or preservation involving how to retain Azure compute evidence.

Question 852

While full remediation remains pending, the commander receives this incident report: A Google Kubernetes Engine workload reads secrets outside its namespace because the pod holds an overprivileged identity. The current decision requires two different outcomes: evidence-based verification AND initial protection, without treating cleanup as complete. Which TWO measures provide those outcomes? (Choose TWO.)

  1. Reduce the pod's permissions and isolate the affected workload
  2. Correlate Kubernetes audit records with service-account and Google IAM bindings
  3. Limit service-account key creation and prefer short-lived impersonation
  4. Rotate exposed secrets and replace the workload under reviewed bindings
  5. Use least-privilege workload identities and admission checks
  6. Enable appropriate flow logging and endpoint telemetry on sensitive workloads

Explanation

Correct Answers

A:

Scoped identity containment limits further secret access; within the combined response for whether workload identity and authorization allowed the read, this supplies initial containment or preservation: this reduces current exposure associated with whether workload identity and authorization allowed the read and permits later corrective work.

B:

Both cluster RBAC and cloud identity may affect reachable secrets; within the combined response for whether workload identity and authorization allowed the read, this supplies evidence validation: for this investigation, the relevant uncertainty is whether workload identity and authorization allowed the read, so independent confirmation matters.

Incorrect Answers

C:

Reducing downloadable keys narrows persistence options; the activity targets which identity event explains potential long-lived access; initial containment or preservation here concerns whether workload identity and authorization allowed the read.

D:

Rebuilds without permission repair can repeat the exposure; when judging whether workload identity and authorization allowed the read, corrective follow-through follows initial protection; this is instead trusted restoration.

E:

Deployment guardrails reduce overprivileged containers; for whether workload identity and authorization allowed the read, prevention cannot replace immediate action; initial containment or preservation remains necessary.

F:

Layered visibility improves attribution and scope; this serves where to find network and workload evidence, whereas the requested result is initial containment or preservation involving whether workload identity and authorization allowed the read.

Question 853

The affected workflow needs an integrity and access check following this event: A cloud team stores incident logs in the same account that compromised tenant administrators can delete. What case-specific cleanup or recovery step establishes a trusted state?

  1. Build a provenance-linked cross-cloud activity chronology
  2. Review log repository permissions and independent audit-sink access
  3. Validate immutable retention and repository integrity checks
  4. Use dedicated cross-account log archives with restricted deletion rights
  5. Replicate available logs to a protected security-owned account

Explanation

Correct Answer

C:

Trusted evidence should survive customer-workload credential theft; this goes beyond temporary protection and addresses the failure identified through whether evidence storage is isolated from suspect administrators.

Incorrect Answers

A:

Entity mapping and timestamp context are essential to credible attribution; that method could help with whether event timestamps form a reliable unified timeline; the trusted restoration decision here involves whether evidence storage is isolated from suspect administrators.

B:

Attacker-controlled accounts can undermine retention and chain of custody; for whether evidence storage is isolated from suspect administrators, verification is not the corrective step; trusted restoration remains necessary.

D:

Isolation makes forensic records more resilient; the goal is trusted restoration for whether evidence storage is isolated from suspect administrators. Future hardening is not current-state recovery.

E:

Administrative separation helps preserve evidence during ongoing compromise; temporary protection does not complete correction in the decision about whether evidence storage is isolated from suspect administrators.

Question 854

During lessons learned, the security owner reviews this completed incident: An unknown user invokes Google Cloud API operations that create new service-account keys. Which repeatable safeguard best prevents this failure mode in the future?

  1. Use IAM Recommender and policy reviews with security monitoring
  2. Delete unauthorized keys after evidence capture and review their subsequent usage
  3. Limit service-account key creation and prefer short-lived impersonation
  4. Inspect Cloud Audit Logs for service-account key creation and caller identity

Explanation

Correct Answer

C:

Reducing downloadable keys narrows persistence options; the assurance measure is designed around which identity event explains potential long-lived access, rather than hiding the reported activity.

Incorrect Answers

A:

Governance reduces excessive role grants; the relevant condition for that step is which Google Cloud events show entitlement changes, which is not shown for which identity event explains potential long-lived access.

B:

A key may have been copied to an external operator; the goal is recurrence prevention for which identity event explains potential long-lived access. Case recovery is not future-risk control.

D:

A newly minted key may allow access beyond the initial session; the case needs recurrence prevention addressing which identity event explains potential long-lived access; an investigation is not recurrence prevention.

Question 855

The team has retained the initial evidence and is assessing recovery from: An attacker modifies cloud object retention settings immediately before mass deletion of backup files. What restoration task closes the identified integrity or control gap?

  1. Restore copies from independent protected repositories and reapply retention controls
  2. Use immutable backup design with independent administrative controls
  3. Reconstruct actions from available provider and downstream service logs
  4. Restrict identities authorized to modify retention and stop deletion operations

Explanation

Correct Answer

A:

Recovery requires trusted data beyond the compromised policy scope; the owner can validate the correction against the evidence bearing on whether backup immutability was weakened before destructive changes.

Incorrect Answers

B:

Protection should withstand compromise of ordinary workload identities; for whether backup immutability was weakened before destructive changes, future hardening is not current-state recovery; trusted restoration remains necessary.

C:

Investigators must mark periods where coverage is incomplete; the relevant condition for that step is whether log tampering obscured follow-on actions, which is not shown for whether backup immutability was weakened before destructive changes.

D:

Separating backup control from workload administration limits damage; the goal is trusted restoration for whether backup immutability was weakened before destructive changes. Temporary protection does not complete correction.

Question 856

While full remediation remains pending, the commander receives this incident report: A Google Cloud project receives an unexpected role binding that grants broad storage access to a service account. The current decision requires two different outcomes: evidence-based verification AND initial protection, without treating cleanup as complete. Which TWO measures provide those outcomes? (Choose TWO.)

  1. Revoke the unapproved role binding and constrain the service account
  2. Review actions performed under the expanded grant and restore reviewed IAM policy
  3. Inspect Cloud Audit Logs for IAM policy modifications and affected principals
  4. Delete unauthorized keys after evidence capture and review their subsequent usage
  5. Use IAM Recommender and policy reviews with security monitoring

Explanation

Correct Answers

A:

Identity containment limits additional resource access; within the combined response for which Google Cloud events show entitlement changes, this supplies initial containment or preservation: this reduces current exposure associated with which Google Cloud events show entitlement changes and permits later corrective work.

C:

Administrative audit records can identify who changed the binding; within the combined response for which Google Cloud events show entitlement changes, this supplies evidence validation: for this investigation, the relevant uncertainty is which Google Cloud events show entitlement changes, so independent confirmation matters.

Incorrect Answers

B:

Recovery requires both least-privilege restoration and scoping; corrective follow-through follows initial protection in the decision about which Google Cloud events show entitlement changes.

D:

A key may have been copied to an external operator; the relevant condition for that step is which identity event explains potential long-lived access, which is not shown for which Google Cloud events show entitlement changes.

E:

Governance reduces excessive role grants; for which Google Cloud events show entitlement changes, prevention cannot replace immediate action; initial containment or preservation remains necessary.

Question 857

Before making any disruptive change, an investigator is handed these observations: An AWS account's central CloudTrail trail is stopped just before new IAM users appear. Which source best supports the incident finding before responders modify the environment?

  1. Use separate log archive accounts and alert on trail changes
  2. Check whether CloudTrail S3 data events were enabled for the bucket
  3. Correlate StopLogging events with IAM user-creation activity and downstream archives
  4. Search CloudTrail management events for AttachRolePolicy and related identity operations
  5. Restore logging and restrict actors with trail-configuration permissions
  6. Remove unauthorized IAM identities and reconstruct actions during the gap

Explanation

Correct Answer

C:

Independent logging may preserve evidence of the attempt to suppress telemetry; it connects the question of whether audit tampering preceded unauthorized identities to an observable record and a reproducible check.

Incorrect Answers

A:

Administrative separation makes audit tampering harder; the requirement concerns whether audit tampering preceded unauthorized identities, so prevention is not incident verification.

B:

Object-level API activity generally requires configured data event collection; the other incident centers on why the audit record lacks individual object reads, not this evidence validation question about whether audit tampering preceded unauthorized identities.

D:

IAM configuration changes are control-plane actions recorded by CloudTrail; that method could help with which AWS audit events explain privilege escalation; the evidence validation decision here involves whether audit tampering preceded unauthorized identities.

E:

Protection of the audit plane helps contain further concealment; when judging whether audit tampering preceded unauthorized identities, immediate protection does not substantiate findings; this is instead initial containment or preservation.

F:

Investigators should not assume the missing interval was benign; for whether audit tampering preceded unauthorized identities, recovery is not factual verification; evidence validation remains necessary.

Question 858

The initial scene or threat protection decision concerns the following: A multicloud response requires correlating Azure, AWS and Google events with clocks recorded in different zones. The first response plan must document the reported condition AND limit near-term harm. Select TWO case-specific steps. (Choose TWO.)

  1. Standardize time synchronization and log schemas across cloud tenants
  2. Build a provenance-linked cross-cloud activity chronology
  3. Capture disks and metadata then redeploy clean instances with approved controls
  4. Normalize event times to UTC while preserving source timestamps and clock offsets
  5. Protect exports from all three providers before analysts merge records

Explanation

Correct Answers

D:

Comparable timing supports sequence analysis without altering raw evidence; within the combined response for whether event timestamps form a reliable unified timeline, this supplies evidence validation: it connects the question of whether event timestamps form a reliable unified timeline to an observable record and a reproducible check.

E:

Keeping originals prevents later enrichment from overwriting source data; within the combined response for whether event timestamps form a reliable unified timeline, this supplies initial containment or preservation: the scope of this restriction follows whether event timestamps form a reliable unified timeline rather than indiscriminately changing unrelated assets.

Incorrect Answers

A:

Consistent telemetry accelerates future cross-platform investigations; the case needs initial containment or preservation addressing whether event timestamps form a reliable unified timeline; prevention cannot replace immediate action.

B:

Entity mapping and timestamp context are essential to credible attribution; when judging whether event timestamps form a reliable unified timeline, corrective follow-through follows initial protection; this is instead trusted restoration.

C:

A sequenced workflow balances forensics and service recovery; that method could help with whether remediation destroys evidence before acquisition; the initial containment or preservation decision here involves whether event timestamps form a reliable unified timeline.

Question 859

The responder must establish the timeline from this observation: A public Cloud Storage object is discovered in a bucket intended for internal engineering data. Which analysis step best addresses the missing confirmation?

  1. Revoke public grants and apply approved public-access restrictions
  2. Inspect bucket IAM, public access prevention and object request evidence
  3. Determine affected objects and validate intended internal access
  4. Correlate Kubernetes audit records with service-account and Google IAM bindings
  5. Use organization policy restrictions and recurring storage exposure checks
  6. Correlate available VPC Flow Logs with guest telemetry and audit activity

Explanation

Correct Answer

B:

Public exposure is governed by effective policy and object-access settings; for this investigation, the relevant uncertainty is whether an access policy exposed cloud objects, so independent confirmation matters.

Incorrect Answers

A:

Immediate access changes stop new anonymous retrieval; the requirement concerns whether an access policy exposed cloud objects, so immediate protection does not substantiate findings.

C:

Recovery must handle data disclosure as well as policy correction; recovery is not factual verification in the decision about whether an access policy exposed cloud objects.

D:

Both cluster RBAC and cloud identity may affect reachable secrets; the relevant condition for that step is whether workload identity and authorization allowed the read, which is not shown for whether an access policy exposed cloud objects.

E:

Preventive controls reduce accidental public data publication; when judging whether an access policy exposed cloud objects, prevention is not incident verification; this is instead recurrence prevention.

F:

Network flows provide metadata and may need configuration before sufficient history exists; that method could help with where to find network and workload evidence; the evidence validation decision here involves whether an access policy exposed cloud objects.

Question 860

The coordinator needs corrective action rather than another alert. The event was: An attacker disables centralized audit export from a tenant shortly before modifying access policies. Which follow-through step verifies the weakness was removed?

  1. Reconstruct actions from available provider and downstream service logs
  2. Restore protected logging and restrict identities able to alter audit sinks
  3. Inspect audit-export configuration changes and independent sink receipt records
  4. Restore copies from independent protected repositories and reapply retention controls
  5. Use separate security accounts and tamper-resistant log storage

Explanation

Correct Answer

A:

Investigators must mark periods where coverage is incomplete; the affected workflow should not be considered trusted until the issue of whether log tampering obscured follow-on actions is resolved.

Incorrect Answers

B:

Containment protects remaining records and future visibility; temporary protection does not complete correction in the decision about whether log tampering obscured follow-on actions.

C:

Control-plane disablement may create evidence gaps after the change; the case needs trusted restoration addressing whether log tampering obscured follow-on actions; verification is not the corrective step.

D:

Recovery requires trusted data beyond the compromised policy scope; the relevant condition for that step is whether backup immutability was weakened before destructive changes, which is not shown for whether log tampering obscured follow-on actions.

E:

Administrative separation reduces attacker ability to hide traces; for whether log tampering obscured follow-on actions, future hardening is not current-state recovery; trusted restoration remains necessary.

EC-Council Certified Incident Handler (212-89) Practice Tests