Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 212-89 (EC-Council Certified Incident Handler) Practice Test 99

Question 980

A post-incident audit examines the following failure mode: A departing database administrator left a hidden scheduled account that can still connect after all personal accounts were disabled. What recurring check or restriction would best address the weakness?

  1. Rebuild approved automation identities and rotate any shared secrets
  2. Include service identities and task owners in privileged offboarding
  3. Use baseline ACL monitoring and approval gates for bulk changes
  4. Audit service accounts, scheduler jobs and login timestamps tied to the administrator

Explanation

Correct Answer

B:

Lifecycle coverage prevents retained backdoors; it closes a repeatable gap revealed by whether non-person identity persistence remains without removing useful monitoring.

Incorrect Answers

A:

Recovery restores legitimate operation without hidden privileges; case recovery is not future-risk control in the decision about whether non-person identity persistence remains.

C:

Configuration drift detection exposes stealthy permission modification; the activity targets whether permission integrity can be restored from a baseline; recurrence prevention here concerns whether non-person identity persistence remains.

D:

Hidden access can survive ordinary employee account termination; for whether non-person identity persistence remains, an investigation is not recurrence prevention; recurrence prevention remains necessary.

Question 981

The team needs temporary protection and must retain evidence. The observed event is: A user creates several access tokens with long expiration times the day before a role transfer. Investigators need both a defensible factual finding and a limited immediate safeguard. Which TWO actions jointly satisfy those requirements? (Choose TWO.)

  1. Recalculate legitimate access for the new role and audit token use
  2. Revoke unauthorized tokens and prevent new issuance under outdated privileges
  3. Review token issue logs, scope and subsequent API calls
  4. Limit token lifetime and tie service permissions to identity lifecycle
  5. Reissue scoped credentials to current service owners and assess accessed records

Explanation

Correct Answers

B:

Token-specific containment closes the persistence avenue; within the combined response for whether credential staging creates persistent access, this supplies initial containment or preservation: it protects the affected workflow while investigators continue resolving whether credential staging creates persistent access.

C:

Long-lived tokens may bypass expected access changes after the role shift; within the combined response for whether credential staging creates persistent access, this supplies evidence validation: this permits a traceable finding about whether credential staging creates persistent access before the team makes a disruptive change.

Incorrect Answers

A:

Recovery separates needed capabilities from pre-transfer entitlements; the requirement concerns whether credential staging creates persistent access, so corrective follow-through follows initial protection.

D:

Access should change when employment duties change; the case needs initial containment or preservation addressing whether credential staging creates persistent access; prevention cannot replace immediate action.

E:

Recovery replaces a shared secret without breaking legitimate integrations; that method could help with whether a service identity provides residual insider access; the initial containment or preservation decision here involves whether credential staging creates persistent access.

Question 982

During lessons learned, the security owner reviews this completed incident: An employee sends a file through an encrypted web service that is not in the approved transfer list. Which repeatable safeguard best prevents this failure mode in the future?

  1. Use classification-aware DLP and sanctioned secure sharing services
  2. Assess whether restricted content left and remediate sharing permissions
  3. Use sensitivity labels and controlled external sharing approvals
  4. Correlate DLP classification, proxy upload metadata and device file access

Explanation

Correct Answer

A:

Employees need approved alternatives to personal transfer tools; the assurance measure is designed around whether an unsanctioned channel moved restricted data, rather than hiding the reported activity.

Incorrect Answers

B:

Investigation determines data scope and retention obligations; the goal is recurrence prevention for whether an unsanctioned channel moved restricted data. Case recovery is not future-risk control.

C:

Policies can restrict high-risk transfers without blanket mail blocking; that method could help with whether a trusted mailbox was used for intentional disclosure; the recurrence prevention decision here involves whether an unsanctioned channel moved restricted data.

D:

Encrypted transport alone does not establish misuse; content and policy context matter; the case needs recurrence prevention addressing whether an unsanctioned channel moved restricted data; an investigation is not recurrence prevention.

Question 983

A containment decision is required for this incident: An administrator covertly configures an automated nightly job to copy audit archives to personal cloud storage. The incident owner wants a corroborating check and a protective action before recovery begins. Which TWO choices fit these separate tasks? (Choose TWO.)

  1. Revoke credentials used by the job and assess historical archive exposure
  2. Disable the unauthorized job and block its external storage destination
  3. Validate repository history and revoke any covert automation tokens
  4. Inspect scheduler configuration, identity grants and cloud upload records
  5. Monitor new data-export jobs and restrict destinations for archive storage

Explanation

Correct Answers

B:

Containment stops the unattended transfer path; within the combined response for whether scheduled automation is an insider persistence route, this supplies initial containment or preservation: it restricts the path implicated in whether scheduled automation is an insider persistence route; later eradication and restoration remain separate decisions.

D:

A recurring job can continue exfiltration without interactive logins; within the combined response for whether scheduled automation is an insider persistence route, this supplies evidence validation: this evidence is scoped to whether scheduled automation is an insider persistence route, not a generic system-health reading.

Incorrect Answers

A:

Eradication must remove both automation and its access method; the requirement concerns whether scheduled automation is an insider persistence route, so corrective follow-through follows initial protection.

C:

Repair includes visibility and access channels; this serves whether monitoring suppression preceded data movement, whereas the requested result is initial containment or preservation involving whether scheduled automation is an insider persistence route.

E:

Job governance reduces stealthy recurring copies; when judging whether scheduled automation is an insider persistence route, prevention cannot replace immediate action; this is instead recurrence prevention.

Question 984

To prevent the next similar event, analysts review this case: The insider-threat program collects browsing history on every employee with no defined purpose or legal review. Which preventive change targets the exact pathway that failed?

  1. Adopt purpose limitation, access controls and monitored collection approvals
  2. Limit collection to documented security purposes with controlled retention
  3. Examine the program charter, local law, employee notice and collected fields
  4. Rehearse HR, legal and security escalation roles in insider response exercises

Explanation

Correct Answer

A:

Governed insider monitoring avoids becoming a new data exposure; it closes a repeatable gap revealed by whether monitoring scope is proportionate and authorized without removing useful monitoring.

Incorrect Answers

B:

Operational recovery includes appropriate handling of already gathered records; the goal is recurrence prevention for whether monitoring scope is proportionate and authorized. Case recovery is not future-risk control.

C:

Broad surveillance can create privacy risk without improving detection; an investigation is not recurrence prevention in the decision about whether monitoring scope is proportionate and authorized.

D:

Preparation reduces conflict during sensitive incidents; the relevant condition for that step is whether insider investigations have accountable authority, which is not shown for whether monitoring scope is proportionate and authorized.

Question 985

The response team seeks the relevant control point for this problem: A contractor onboarding process grants full database export privileges even though the project requires only read access to five tables. Investigators need both a defensible factual finding and a limited immediate safeguard. Which TWO actions jointly satisfy those requirements? (Choose TWO.)

  1. Review prior exports and issue a corrected scoped account
  2. Compare granted roles with contract scope and approved data requirements
  3. Migrate shared access to per-person privileged identities and review historical changes
  4. Reduce access to approved objects and remove bulk-export rights
  5. Use time-limited vendor entitlements and approval-based data exports

Explanation

Correct Answers

B:

Excess permission increases potential damage from misuse or compromise; within the combined response for whether third-party access exceeds business need, this supplies evidence validation: it makes the determination of whether third-party access exceeds business need defensible and reviewable by the incident owner.

D:

Least-privilege containment narrows the contractor's reachable data; within the combined response for whether third-party access exceeds business need, this supplies initial containment or preservation: this is a first-response safeguard for whether third-party access exceeds business need, not a substitute for full root-cause analysis.

Incorrect Answers

A:

Remediation should assess any use of the unnecessary capability; when judging whether third-party access exceeds business need, corrective follow-through follows initial protection; this is instead post-containment assessment.

C:

Recovery fixes attribution and narrows privilege distribution; the other incident centers on whether insider action attribution is possible, not this initial containment or preservation question about whether third-party access exceeds business need.

E:

Granular access reduces insider opportunity; prevention cannot replace immediate action in the decision about whether third-party access exceeds business need.

Question 986

A tabletop exercise is being updated using the following real-world failure: Employees routinely share passwords to cover vacation absences because no approved delegation workflow exists. Which improvement should be tracked through the next control-assurance cycle?

  1. Rotate exposed passwords and implement documented delegated access
  2. Review analytics for bias, relevance and false-positive rates
  3. Review sign-in locations, password-sharing reports and task handoff needs
  4. Provide safe time-bound delegation rather than shared identities

Explanation

Correct Answer

D:

Usable access workflows reduce incentives to bypass policy; this turns the weakness behind whether account sharing undermines attribution into a measurable prevention requirement.

Incorrect Answers

A:

Recovery preserves coverage without ambiguous logins; when judging whether account sharing undermines attribution, case recovery is not future-risk control; this is instead trusted restoration.

B:

Responsible detection limits harm and operator fatigue; that method could help with whether behavior analytics has an appropriate baseline; the recurrence prevention decision here involves whether account sharing undermines attribution.

C:

Shared credentials make actions difficult to attribute reliably; the requirement concerns whether account sharing undermines attribution, so an investigation is not recurrence prevention.

Question 987

The recurrence-prevention decision is based on this report: A data scientist accesses far more records than peers by running scripted exports at night from an approved workstation. What measure strengthens readiness against the observed event?

  1. Detect access to sensitive profiles without matching business transactions
  2. Apply behavior analytics with peer-role context and approved workload baselines
  3. Correlate query volume, time, business tasks and destination transfer records
  4. Assess transferred data and adjust entitlements if misuse is confirmed

Explanation

Correct Answer

B:

Context is necessary to detect abuse without constant false alarms; its effectiveness can be exercised against the warning conditions associated with whether unusual legitimate tooling masks insider exfiltration.

Incorrect Answers

A:

Behavioral baselines reveal suspicious but authenticated activity; this serves whether database access patterns show insider snooping, whereas the requested result is recurrence prevention involving whether unusual legitimate tooling masks insider exfiltration.

C:

Large night exports can be suspicious when outside normal assigned work; for whether unusual legitimate tooling masks insider exfiltration, an investigation is not recurrence prevention; recurrence prevention remains necessary.

D:

Proportionate response follows verified purpose and impact; the requirement concerns whether unusual legitimate tooling masks insider exfiltration, so case recovery is not future-risk control.

Question 988

A case is escalated for independent verification after this finding: Following insider data theft, a business team declares success once the suspect user is suspended despite active shared credentials. What collection or comparison would validate the reported condition?

  1. Minimize shared secrets and use attributable identities with revocation hooks
  2. Inventory related shared tokens, sessions and delegated resources
  3. Inventory public and guest links created by the departed account
  4. Revoke exposed shared credentials and review delegated grants

Explanation

Correct Answer

B:

One disabled login may leave alternate authorized routes functional; it makes the determination of whether access containment is complete defensible and reviewable by the incident owner.

Incorrect Answers

A:

Individual authorization improves incident control; for whether access containment is complete, prevention is not incident verification; evidence validation remains necessary.

C:

Object permissions may outlive the originating identity; the activity targets whether resource-level sharing survives identity disablement; evidence validation here concerns whether access containment is complete.

D:

Comprehensive identity containment reduces further data retrieval; immediate protection does not substantiate findings in the decision about whether access containment is complete.

Question 989

The team wants a measurable hardening change following this situation: A disgruntled operator modifies production application settings to break authentication for all customers. What improvement best addresses the root weakness in a future incident?

  1. Validate restored login functionality and investigate related changes
  2. Separate retention administration from business record ownership
  3. Use two-person approval and immutable configuration history for critical settings
  4. Compare configuration diff, operator session and authentication error timing

Explanation

Correct Answer

C:

Change controls reduce single-person sabotage capacity; it makes the lesson about whether a trusted configuration change caused availability impact part of normal operations.

Incorrect Answers

A:

Recovery should confirm no hidden settings remain altered; the case needs recurrence prevention addressing whether a trusted configuration change caused availability impact; case recovery is not future-risk control.

B:

Independent oversight reduces insider manipulation; this serves whether a trusted operator is tampering with evidence, whereas the requested result is recurrence prevention involving whether a trusted configuration change caused availability impact.

D:

The change sequence may link an authorized identity to unauthorized sabotage; the requirement concerns whether a trusted configuration change caused availability impact, so an investigation is not recurrence prevention.

Question 990

After technical restoration, responders document the weakness exposed by: Privileged shared administrator accounts are common, making it impossible to tie database changes to one person. Which long-term control would reduce exposure to this specific pattern?

  1. Automate identity revocation from verified HR lifecycle events
  2. Migrate shared access to per-person privileged identities and review historical changes
  3. Compare shared-login use with individual session and bastion audit records
  4. Use privileged access management with session recording and just-in-time grants

Explanation

Correct Answer

D:

Traceability supports insider investigation and prevention; this turns the weakness behind whether insider action attribution is possible into a measurable prevention requirement.

Incorrect Answers

A:

Event-driven offboarding reduces exposure windows; that method could help with whether offboarding revokes privileges promptly; the recurrence prevention decision here involves whether insider action attribution is possible.

B:

Recovery fixes attribution and narrows privilege distribution; the case needs recurrence prevention addressing whether insider action attribution is possible; case recovery is not future-risk control.

C:

An unshared account identity is needed for reliable person-level attribution; when judging whether insider action attribution is possible, an investigation is not recurrence prevention; this is instead evidence validation.

EC-Council Certified Incident Handler (212-89) Practice Tests