Free EC-COUNCIL 212-89 Exam Dumps Questions & Answers

Jake, a senior incident responder in a financial institution's SOC, receives a high-severity alert from the intrusion detection system (IDS). The alert indicates a flood of SYN packets targeting the internal web server, which has now become sluggish and unresponsive to legitimate client requests. The sudden surge in half-open connections is causing resource exhaustion on the server. Suspecting a SYN flood attack-a type of denial-of- service (DoS) attack-Jake needs to verify the source and nature of the traffic to determine the appropriate containment and mitigation strategy while preserving system integrity and uptime. What step should Jake take first in response to this suspected DoS incident?

• A.Reboot the affected server to restore availability
• B.Notify HR to instruct employees on mandatory password resets
• C.Disconnect all users from the network to isolate the server
• D.Inspect network traffic to confirm the attack pattern and verify source behavior

Alice is a disgruntled employee. She decided to acquire critical information from her organization for financial benefit. To acccomplish this, Alice started running a virtual machine on the same physical host as her victim's virtual machine and took advantage of shared physical resources (processor cache) to steal data (cryptographic key/plain text secrets) from the victim machine. Identify the type of attack Alice is performing in the above scenario.

• A.SQL injection attack
• B.Man-in-the-cloud attack
• C.Service hijacking
• D.Side channel attack

Which of the following risk mitigation strategies involves the execution of controls to reduce the risk factor and bring it to an acceptable level, or accepts the potential risk and continues operating the IT system?

• A.Risk avoidance
• B.Risk planning
• C.Risk transference
• D.Risk assumption

NovoMed discovers encrypted data transfers of drug research and participant data to an unknown location and receives an extortion-like message implying the formula may be released. What is the most prudent course of action?

• A.Negotiate with the attackers discreetly to buy time and retrieve data.
• B.Immediately recall the drug from the market.
• C.Engage local law enforcement and international cybercrime agencies to trace the transfer's origins.
• D.Publicly announce the breach warning competitors and authorities.

Eric who is an incident responder is working on developing incident-handling plans and procedures. As part of this process, he is performing analysis on the organizational network to generate a report and to develop policies based on the acquired results.
Which of the following tools will help him in analyzing network and its related traffic?

• A.Whois
• B.Wireshark
• C.FaceNiff
• D.Burp Suite