Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 212-89 (EC-Council Certified Incident Handler) Practice Test 91

Question 900

A triage analyst needs to test a report involving these details: An Azure storage account was unintentionally configured for anonymous blob reads during a migration. Which evidence collection or correlation is most relevant to this claim?

  1. Correlate Entra sign-in logs with directory audit events for credential additions
  2. Assess exposed objects and restore intended private access policies
  3. Enforce policies that disallow unnecessary public blob access
  4. Review effective container access settings and anonymous request evidence
  5. Disable unintended anonymous access while retaining request and configuration logs

Explanation

Correct Answer

D:

Storage exposure depends on both account and container configurations; it connects the question of whether object exposure resulted from public access settings to an observable record and a reproducible check.

Incorrect Answers

A:

Identity logs distinguish login activity from application object modifications; that method could help with where to investigate identity and application changes; the evidence validation decision here involves whether object exposure resulted from public access settings.

B:

Recovery includes data-sensitivity review and partner migration checks; for whether object exposure resulted from public access settings, recovery is not factual verification; evidence validation remains necessary.

C:

Preventive governance catches exposure before release; the requirement concerns whether object exposure resulted from public access settings, so prevention is not incident verification.

E:

Public retrieval should cease without erasing exposure evidence; immediate protection does not substantiate findings in the decision about whether object exposure resulted from public access settings.

Question 901

The owner must verify the return to a trusted state for the following: A cloud administrator revokes one user's console access but leaves active service tokens for an automation identity exposed. What corrective work is needed before routine operations resume?

  1. Revoke exposed service tokens and restrict their effective roles
  2. Snapshot relevant disks and preserve instance metadata before trusted replacement
  3. Reissue scoped workload identities and validate downstream integrations
  4. Enumerate API keys, service principals and session use in audit history
  5. Inventory machine identities and enforce secret rotation and least privilege

Explanation

Correct Answer

C:

Recovery should restore automation without returning excessive privilege; technical closure should demonstrate that the control gap behind which identities still allow malicious API actions is actually corrected.

Incorrect Answers

A:

Credential-specific containment stops unattended API calls; the case needs trusted restoration addressing which identities still allow malicious API actions; temporary protection does not complete correction.

B:

Investigation can continue from copies without retaining compromised production machines indefinitely; the activity targets whether termination will erase useful host evidence; trusted restoration here concerns which identities still allow malicious API actions.

D:

Interactive console access is only one possible authorization route; the requirement concerns which identities still allow malicious API actions, so verification is not the corrective step.

E:

Workload credentials need lifecycle controls like human accounts; the goal is trusted restoration for which identities still allow malicious API actions. Future hardening is not current-state recovery.

Question 902

The recovery owner is reviewing the underlying failure in this report: A multicloud response requires correlating Azure, AWS and Google events with clocks recorded in different zones. What action most directly repairs the affected access, evidence or system state?

  1. Validate immutable retention and repository integrity checks
  2. Protect exports from all three providers before analysts merge records
  3. Build a provenance-linked cross-cloud activity chronology
  4. Standardize time synchronization and log schemas across cloud tenants

Explanation

Correct Answer

C:

Entity mapping and timestamp context are essential to credible attribution; the owner can validate the correction against the evidence bearing on whether event timestamps form a reliable unified timeline.

Incorrect Answers

A:

Trusted evidence should survive customer-workload credential theft; this serves whether evidence storage is isolated from suspect administrators, whereas the requested result is trusted restoration involving whether event timestamps form a reliable unified timeline.

B:

Keeping originals prevents later enrichment from overwriting source data; the goal is trusted restoration for whether event timestamps form a reliable unified timeline. Temporary protection does not complete correction.

D:

Consistent telemetry accelerates future cross-platform investigations; the case needs trusted restoration addressing whether event timestamps form a reliable unified timeline; future hardening is not current-state recovery.

Question 903

The incident owner requests a defensible factual determination after hearing: An unknown user invokes Google Cloud API operations that create new service-account keys. What fact-checking activity tests the observed failure most directly?

  1. Inspect Cloud Audit Logs for IAM policy modifications and affected principals
  2. Limit service-account key creation and prefer short-lived impersonation
  3. Inspect Cloud Audit Logs for service-account key creation and caller identity
  4. Disable suspicious keys and restrict the creating principal's access

Explanation

Correct Answer

C:

A newly minted key may allow access beyond the initial session; it makes the determination of which identity event explains potential long-lived access defensible and reviewable by the incident owner.

Incorrect Answers

A:

Administrative audit records can identify who changed the binding; that method could help with which Google Cloud events show entitlement changes; the evidence validation decision here involves which identity event explains potential long-lived access.

B:

Reducing downloadable keys narrows persistence options; the requirement concerns which identity event explains potential long-lived access, so prevention is not incident verification.

D:

Both the credential and source identity need containment; immediate protection does not substantiate findings in the decision about which identity event explains potential long-lived access.

Question 904

Responders are preparing to reinstate operations after this situation: An Azure VM is implicated in data theft, but its disk is scheduled for replacement during routine deployment. What should be corrected before technical closure of the incident?

  1. Redeploy a signed verified image and inspect workloads that pulled the malicious digest
  2. Predefine Azure snapshot and network isolation playbooks
  3. Create authorized disk snapshots and investigate copies before clean rebuild
  4. Suspend destructive redeployment and isolate the VM with approved network controls

Explanation

Correct Answer

C:

Disk snapshots preserve storage state but do not automatically capture all RAM; this goes beyond temporary protection and addresses the failure identified through how to retain Azure compute evidence.

Incorrect Answers

A:

Recovery must account for prior deployment as well as repository state; the relevant condition for that step is whether mutable image tags conceal a supply-chain compromise, which is not shown for how to retain Azure compute evidence.

B:

Cloud-native evidence collection should be rehearsed; the case needs trusted restoration addressing how to retain Azure compute evidence; future hardening is not current-state recovery.

D:

Controlled access keeps the system from continuing external traffic; for how to retain Azure compute evidence, temporary protection does not complete correction; trusted restoration remains necessary.

Question 905

To prevent the next similar event, analysts review this case: A cloud team stores incident logs in the same account that compromised tenant administrators can delete. Which preventive change targets the exact pathway that failed?

  1. Use dedicated cross-account log archives with restricted deletion rights
  2. Review log repository permissions and independent audit-sink access
  3. Validate immutable retention and repository integrity checks
  4. Replicate available logs to a protected security-owned account
  5. Standardize time synchronization and log schemas across cloud tenants

Explanation

Correct Answer

A:

Isolation makes forensic records more resilient; the assurance measure is designed around whether evidence storage is isolated from suspect administrators, rather than hiding the reported activity.

Incorrect Answers

B:

Attacker-controlled accounts can undermine retention and chain of custody; the goal is recurrence prevention for whether evidence storage is isolated from suspect administrators. An investigation is not recurrence prevention.

C:

Trusted evidence should survive customer-workload credential theft; case recovery is not future-risk control in the decision about whether evidence storage is isolated from suspect administrators.

D:

Administrative separation helps preserve evidence during ongoing compromise; the case needs recurrence prevention addressing whether evidence storage is isolated from suspect administrators; one-time protection is not durable prevention.

E:

Consistent telemetry accelerates future cross-platform investigations; that method could help with whether event timestamps form a reliable unified timeline; the recurrence prevention decision here involves whether evidence storage is isolated from suspect administrators.

Question 906

The team wants a measurable hardening change following this situation: An attacker disables centralized audit export from a tenant shortly before modifying access policies. What improvement best addresses the root weakness in a future incident?

  1. Use separate security accounts and tamper-resistant log storage
  2. Restore protected logging and restrict identities able to alter audit sinks
  3. Inspect audit-export configuration changes and independent sink receipt records
  4. Reconstruct actions from available provider and downstream service logs
  5. Inventory machine identities and enforce secret rotation and least privilege

Explanation

Correct Answer

A:

Administrative separation reduces attacker ability to hide traces; its effectiveness can be exercised against the warning conditions associated with whether log tampering obscured follow-on actions.

Incorrect Answers

B:

Containment protects remaining records and future visibility; when judging whether log tampering obscured follow-on actions, one-time protection is not durable prevention; this is instead initial containment or preservation.

C:

Control-plane disablement may create evidence gaps after the change; for whether log tampering obscured follow-on actions, an investigation is not recurrence prevention; recurrence prevention remains necessary.

D:

Investigators must mark periods where coverage is incomplete; the requirement concerns whether log tampering obscured follow-on actions, so case recovery is not future-risk control.

E:

Workload credentials need lifecycle controls like human accounts; the relevant condition for that step is which identities still allow malicious API actions, which is not shown for whether log tampering obscured follow-on actions.

Question 907

Before making any disruptive change, an investigator is handed these observations: An Amazon EC2 instance makes unusual outbound connections and might be running an attacker-controlled process. Which source best supports the incident finding before responders modify the environment?

  1. Search CloudTrail management events for AttachRolePolicy and related identity operations
  2. Correlate VPC Flow Logs, host telemetry and instance identity
  3. Apply a restrictive security group or approved isolation mechanism to the instance
  4. Maintain preapproved isolation groups and forensic snapshot procedures

Explanation

Correct Answer

B:

Flow records show connection metadata but not necessarily process-level causation; the review should retain source and timing information relevant to how to isolate suspected AWS compute without destroying evidence.

Incorrect Answers

A:

IAM configuration changes are control-plane actions recorded by CloudTrail; the relevant condition for that step is which AWS audit events explain privilege escalation, which is not shown for how to isolate suspected AWS compute without destroying evidence.

C:

Network quarantine limits egress while preserving disks for collection; immediate protection does not substantiate findings in the decision about how to isolate suspected AWS compute without destroying evidence.

D:

Prepared tooling avoids ad hoc instance termination; the case needs evidence validation addressing how to isolate suspected AWS compute without destroying evidence; prevention is not incident verification.

Question 908

A tabletop exercise is being updated using the following real-world failure: A Google Kubernetes Engine workload reads secrets outside its namespace because the pod holds an overprivileged identity. Which improvement should be tracked through the next control-assurance cycle?

  1. Use organization policy restrictions and recurring storage exposure checks
  2. Use least-privilege workload identities and admission checks
  3. Rotate exposed secrets and replace the workload under reviewed bindings
  4. Correlate Kubernetes audit records with service-account and Google IAM bindings

Explanation

Correct Answer

B:

Deployment guardrails reduce overprivileged containers; this turns the weakness behind whether workload identity and authorization allowed the read into a measurable prevention requirement.

Incorrect Answers

A:

Preventive controls reduce accidental public data publication; the activity targets whether an access policy exposed cloud objects; recurrence prevention here concerns whether workload identity and authorization allowed the read.

C:

Rebuilds without permission repair can repeat the exposure; the requirement concerns whether workload identity and authorization allowed the read, so case recovery is not future-risk control.

D:

Both cluster RBAC and cloud identity may affect reachable secrets; the goal is recurrence prevention for whether workload identity and authorization allowed the read. An investigation is not recurrence prevention.

Question 909

An improvement plan must address recurrence after this case: A multicloud response requires correlating Azure, AWS and Google events with clocks recorded in different zones. What should the owner add to the normal control review to reduce recurrence?

  1. Normalize event times to UTC while preserving source timestamps and clock offsets
  2. Standardize time synchronization and log schemas across cloud tenants
  3. Use dedicated cross-account log archives with restricted deletion rights
  4. Build a provenance-linked cross-cloud activity chronology

Explanation

Correct Answer

B:

Consistent telemetry accelerates future cross-platform investigations; its effectiveness can be exercised against the warning conditions associated with whether event timestamps form a reliable unified timeline.

Incorrect Answers

A:

Comparable timing supports sequence analysis without altering raw evidence; for whether event timestamps form a reliable unified timeline, an investigation is not recurrence prevention; recurrence prevention remains necessary.

C:

Isolation makes forensic records more resilient; the other incident centers on whether evidence storage is isolated from suspect administrators, not this recurrence prevention question about whether event timestamps form a reliable unified timeline.

D:

Entity mapping and timestamp context are essential to credible attribution; case recovery is not future-risk control in the decision about whether event timestamps form a reliable unified timeline.

Question 910

A technical closure review begins after this incident: An AWS incident begins with unexpected IAM policy attachment to an automation role. After the immediate situation is stabilized, what addresses the enabling failure?

  1. Alert on sensitive IAM policy attachments and enforce least privilege
  2. Assess alternative evidence and restore properly scoped data-event logging
  3. Review subsequent actions by the role and restore approved IAM permissions
  4. Remove the unauthorized policy and restrict the compromised principal

Explanation

Correct Answer

C:

Rollback requires assessing what the expanded privileges enabled; it is the corrective action needed for which AWS audit events explain privilege escalation after the immediate hazard is controlled.

Incorrect Answers

A:

High-impact entitlement changes should be monitored; for which AWS audit events explain privilege escalation, future hardening is not current-state recovery; trusted restoration remains necessary.

B:

Investigation should distinguish missing logs from proof of no reads; the activity targets why the audit record lacks individual object reads; trusted restoration here concerns which AWS audit events explain privilege escalation.

D:

Privilege containment reduces potential follow-on API access; temporary protection does not complete correction in the decision about which AWS audit events explain privilege escalation.

EC-Council Certified Incident Handler (212-89) Practice Tests