EC-COUNCIL EC Council Certified Incident Handler (ECIH v3) - 212-89 FREE EXAM DUMPS QUESTIONS & ANSWERS

David, a certified digital first responder, arrives at the scene of a reported security breach in the HR department of a corporate office. The breach involves multiple digital endpoints, including desktop systems and mobile devices. Upon entering the scene, David observes that one desktop computer is still powered ON and logged in, showing a sensitive financial dashboard on the screen. Realizing the importance of preserving this evidence, David refrains from interacting directly with the keyboard or running applications. Instead, he takes high-resolution photographs of the screen to capture the current session details, including open applications and time-sensitive data. To avoid altering the system state, David gently moves the mouse without clicking, just enough to dismiss a screen saver without triggering any on-screen changes. He records the system's behavior, notes any visible alerts or programs running, and tags all connected cables and peripheral ports for proper documentation. What step in the evidence handling process is David demonstrating?

Which of the following is the BEST method to prevent email incidents?

SafePay, an online payment portal, recently introduced an advanced search feature. A week later, users reported unauthorized transactions. Investigation showed attackers exploited advanced search strings and a previously unidentified vulnerability. What is SafePay ' s best immediate action?

QualTech Solutions is a leading security services enterprise. Dickson, who works as an incident responder with this firm, is performing a vulnerability assessment to identify the security problems in the network by using automated tools for identifying the hosts, services, and vulnerabilities in the enterprise network. In the above scenario, which of the following types of vulnerability assessment is Dickson performing?

Which of the following is defined as the identification of the boundaries of an IT system along with the resources and information that constitute the system?

Noah, a physical security officer, reviewed entry logs after a breach was reported in the data center.
Surveillance showed a contract worker accessing restricted areas using another employee ' s badge. The access control system lacked biometric verification. Which physical security control could have best prevented this incident?

BetaCorp, a multinational corporation, has a diverse workforce spread across multiple countries. It recently identified an employee who was selling company secrets to competitors. BetaCorp is keen on ensuring no such incidents occur in the future. Which action will be most effective?

Which of the following risk mitigation strategies involves the execution of controls to reduce the risk factor and bring it to an acceptable level, or accepts the potential risk and continues operating the IT system?

Zoe, a security analyst, deploys a high-interaction honeypot in the DMZ that mimics critical systems and monitors logs for scans, exploit attempts, and lateral movement techniques. What is the main purpose of Zoe' s activity?

DeltaDynamics, a large-scale data analytics firm, found that one of its data scientists was sharing proprietary algorithms with external parties. The firm wishes to monitor its employees more closely without breaching privacy laws. What is the most effective measure it should consider?

Which of the following does NOT reduce the success rate of SQL injection?

After noticing unusual behavior in certain employee inboxes, such as unexplained message redirection to unfamiliar external services, the IR team suspected account compromise. Despite resetting credentials and terminating active sessions, the unauthorized transfers persisted through embedded configuration anomalies.
Analysts moved to eliminate lingering traces and neutralize the exploitation pathway using precision remediation techniques. Which of the following best supports the eradication effort?