EC-Council Certified Incident Handler (ECIH) Practice Test

These questions are part of the practice quiz. Start practicing

• What is the process of accurately storing the details of occurrence of an incident called?
• What is the role of a cloud broker in the cloud service model?
• What action is NOT a guideline to prevent spam?
• Which of the following is classified as a technical threat?
• Which type of security misconfiguration vulnerability supports weak algorithms and uses expired or invalid certificates, exposing users' data to untrusted third parties?
• Is there a need to write a detailed report after an incident?
• In an insider threat investigation, what should be prioritized?
• What are two crucial activities in the incident response process that are often challenging?
• Which level classifies incidents like a lost personal password or unsuccessful network scans?
• What function does a UBA (User Behavior Analytics) tool typically provide?
• Which of the following Wireshark filters is used to locate duplicate IP address traffic?
• During a DoS attack, attackers often flood the victim system with which type of requests?
• Which of the following is the most important aspect that allows you to respond to an incident before it occurs?
• How can organizations enhance their incident response capabilities?
• What measure should an incident handler take to address insecure deserialization attacks?
• What type of cloud service model provides the most control over the computing environment?
• Port monitoring, process monitoring, and registry monitoring are all considered what type of malware analysis technique?
• What best practices should forensic investigators follow in terms of evidence collection?
• Terry is managing a web server that runs a PHP-based web service and discovered a large number of php-cgi processes consuming significant CPU. What can Terry infer from this observation?
• What is a crucial security measure for computer networks to prevent insider threats?
• When addressing email incidents, what is the primary focus of the recovery step?
• What characteristic is typical for a Denial of Service (DoS) attack?
• Which type of malware pretends to be a useful program but collects user information for a remote attacker?
• If there are suspicious tools and unpredicted open ports, what does it indicate?
• What is the technique called when an attacker creates a fake email to resemble a legitimate source?
• Which factor is crucial in determining the effectiveness of an incident response plan?
• Which of the following technologies is NOT generally included under cloud security controls?
• Netcraft and PhishTank are tools for detecting which types of attacks?
• Denial-of-Service attacks and the presence of harmful software are incidents classified at which level?
• What is a crucial step after identifying an insider threat?
• Which method is commonly used for ensuring data redundancy in cloud architectures?
• What structure is best for quickly responding to incidents in a small organization?
• What does IDS stand for in network security?
• What is a common characteristic of the 'whaling' phishing attack?
• Which activity involves all the processes, logistics, communications, coordination, and planning to respond and overcome an incident efficiently?
• Which type of malware is used to trick the victim into performing a predefined action?
• What type of forensic analysis did Michael perform when analyzing data packets and event logs?
• What type of injection flaw involves the injection of malicious code through a web application?
• Which example best represents insider threats?
• Which type of cloud security incident involves monitoring suspicious IP addresses and user accounts?
• What type of tools are Exabeam Advanced Analytics, LogRhythm, Dtex Systems, and ZoneFox classified as?
• What is an important guideline when forming an investigation team?
• Insider attacks can be detected manually by evaluating user behavior. Is this statement true or false?
• What is an essential aspect of managing insider threats effectively?
• What term refers to a cloud's ability to manage data and systems across various organizations?
• What defines 'mail bombing' in the context of unsolicited emails?
• Which security element prevents unauthorized changes to data or resources?
• When investigating Microsoft Exchange Server, which files should an incident handler primarily focus on?
• Which practice is NOT recommended to avoid insider threats?
• HDBC's online banking website was knocked offline due to simultaneous login sessions established by a cyber attacker. What kind of attack was used?
• What is a key goal of forensic readiness in an organization?
• What is the primary function of a firewall in cloud security?
• Which of the following is NOT a common symptom of a security incident?
• Ping method and DNS method are considered what type of detection technique?
• Which process is NOT part of the investigation stage?
• In network security, what is considered a 'false positive'?
• Which definition best describes digital evidence?
• Will is an attacker who is trying to craft an input string to gain shell access to a web server. What type of command injection attack is he pursuing?
• Which type of malware propagates across networks without human interaction?
• What is a negative impact of an insider attack?
• What is the essence of a risk assessment in information security?
• What action should you implement to respond effectively to an insider attack?
• Which of the following CSIRT services include alerts and warnings, incident handling, vulnerability handling, and artifact handling activities?
• What is the appropriate process flow in the computer forensics process?
• Which type of malware accesses the victim's computer or network without the user's knowledge?
• Which of the following is NOT an indicator of cloud security incidents?
• Which risk mitigation strategy involves an organization absorbing minor risks while preparing to respond to major ones?
• What is the primary benefit of audit trail and log monitoring in insider threat detection?
• Which duties align with the role of a forensic expert?
• Where can volatile data be found, which is lost if the system loses power or is switched off?
• In a cloud environment, what does "storage" refer to?
• What tool would be suitable for gathering volatile database information for evidence of an attack?
• What benefit does the use of a spam filter provide for organizations?
• Which two types of actions make up forensic readiness?
• Which command helps an incident handler retrieve active transaction log files for a database?
• ObserveIT, Ekran System and DataRobot are tools that detect which type of threats?
• What does SIEM stand for in the context of security management?
• Which of the following is NOT included in the structure of an incident response team?
• What is defined as an organized approach to address and manage the aftermath of a security breach or attack?
• Which situation is considered a data loss issue?
• Which of the following is a characteristic of Cloud Computing?
• During the investigation process, what is vital for preserving the integrity of evidence?
• Which Wireshark filter is used to view packets with FIN, PSH, and URG TCP flags for detecting Xmas scan attempts?
• Which term refers to the process of identifying, labeling, recording, and acquiring data from all possible sources?
• What reason might deter organizations from reporting computer crimes to law enforcement?
• What is the primary purpose of host monitoring in forensic readiness?
• What type of insider attack spreads false information to create confusion among employees?
• What characteristic of cloud computing employs a "pay-per-use" metering method?
• What's a common indicator of a potential insider threat?
• What security concept involves evaluating risks and selecting the appropriate controls to mitigate those risks?
• What should first responders label along with the evidence they collect?
• Which type of threat arises from incomplete terms of use and inappropriate CSP selection in cloud computing?
• What type of information can be gathered by an attacker from improper error handling?
• What role do contingency plans play in incident response?
• What type of evidence does a Computer Forensics Lab typically handle?
• Is digital evidence considered circumstantial, making it easy for forensic investigators to differentiate system activity?
• Which element of information security includes the trustworthiness of data or resources in terms of preventing improper and unauthorized changes?
• Which of the following is essential for patch management in an organization?
• Which factor is NOT essential when recommending risk controls?
• What is the most significant risk associated with synthetic identity theft?
• What activity assesses the effects of uncontrolled events on business processes?
• What technology is commonly used to validate the authenticity of email messages?
• What is the potential outcome of failing to verify an SPF record due to incorrect format?
• Which of the following best defines "phishing"?
• Which strategy focuses on minimizing the probability of risks and losses by identifying vulnerabilities in the system and implementing appropriate controls?
• What does DLP stand for in the context of cybersecurity tools?
• What are indications of a network-based DoS attack?
• What type of intrusion is characterized by slower computer performance, random crashes, and unusual graphic displays?
• How does a private cloud compare to a public cloud regarding security and cost?
• What is the primary goal of Incident Response Planning?
• How is qualitative risk analysis characterized?
• Classification of incidents is defined based on what criteria?
• Which of the following is defined as the existence of a weakness in the design or implementation error that can lead to an unexpected, undesirable event compromising the security of the system?
• What prerequisite must be prepared by the first responder for a successful investigation?
• Which behavior is indicative of an insider threat related to data handling?
• During which phase does an incident handler perform risk assessment in computer forensics?
• What is considered the intangible cost for an incident?
• A method for identifying vulnerabilities and assessing impacts to implement security controls is known as?
• Hexagon received many malformed TCP/IP packets, causing their main server to crash. Which type of attack did the adversary use?
• What is the term for phishing conducted without a specific lure to attract victims?
• Which type of logs are crucial for an incident handler to analyze in assessing suspicious user activity?
• Identify the type of DoS/DDoS incident measured in bits per second (bps).
• Which technique is used to evade firewalls?
• Which of the following is a vital aspect of incident handling after detecting a security event?
• What is the purpose of proactive services offered by a CERT?
• What capability do Security Incident and Event Management (SIEM) solutions provide in the context of insider threat prevention?
• James is analyzing collected data after a cybercrime incident. Which phase is he in?
• What is the process of restoring computer systems affected by an incident back to normal operations called?
• What technique do responders use to identify information leaks by tracking data released to the public?
• Which website is recognized as a note-taking application compatible with multiple operating systems?
• Which process involves analyzing and reviewing data gathered from computer systems?
• Which type of interpretation is a key part of a digital forensic examination?
• What is a major benefit of using Infrastructure-as-a-Service (IaaS)?
• Which of the following is an example of a Denial-of-Service attack?
• What is the cloud server security platform that provides all necessary functions for safe deployment in public and hybrid clouds?
• Which statement about incident handling is NOT true?
• What tools do attackers use to capture sensitive data like passwords and session cookies?
• Organizations can respond to email attacks by developing which of the following?
• Which tool is commonly used to detect data exfiltration attempts by insiders?
• In incident management, what is the primary goal of incident handling?
• The ________ is a semi-trusted network zone that separates the untrusted internet from the company's trusted internal network.
• Which term refers to the process of scanning an IP range to detect live hosts?
• What type of DNS attack involves conducting phishing scams by registering a similar domain name to a cloud service provider?
• What is an advantage of using Platform-as-a-Service (PaaS)?
• Which step is critical before initiating incident recovery?
• What is the primary purpose of activity monitoring tools?
• Which guideline is NOT recommended for detecting and preventing insider threats in human resources?
• In cloud computing, which component allows users to access applications and services over the internet?
• How is quantitative risk analysis defined?
• Who is NOT typically one of the first responders to an incident?
• Which principles ensure the proper storage and examination of digital evidence?
• What is the most common medium for networking computers today?
• Which phase includes preparing for evidence collection in computer forensics?
• What guideline aids in preventing unauthorized access incidents?
• What is the main objective of malicious code attacks in an organization?
• Which aspect does not relate to Denial-of-Service Incidents?
• What is the primary use of service intermediation in cloud services?
• What is NOT a step in the recovery stage of incident handling?
• What is the purpose of Ping Sweeping in network security?
• Which process determines the level of risk and the resulting security requirements for each system?
• What is a spam filter tool that helps in automatically removing spam and phishing emails?
• What role does data encryption play in mitigating insider threats?
• Which of the following is the composition of two or more clouds that remain as unique entities but are bound together?
• What software can Dhru use to perform network traffic analysis and detect malicious connections?
• What term defines the likelihood of a threat agent using a vulnerability and the associated impact?
• In which phishing attack does the attacker imitate the style of legitimate emails?
• What is the practice of identifying infected systems by looking for evidence of recent infections?
• What type of DoS attack occurs when an attacker exploits weaknesses in programming source code?
• What online resource could an incident responder use to view logs in real-time?
• Which website helps determine the email origin by matching domain names with IP addresses?
• Which forensics analysis tool can Andrea use to help with collecting and managing necessary information during an investigation?
• Which email validation protocol is used by domain owners for preventing email spoofing?
• What phase is Julie in when setting up a forensics lab and obtaining approval?
• Which action is recommended as part of DoS attack prevention?
• What is the best way to avoid identity theft?
• Which forensic readiness procedure aids in gathering information about system behavior?
• Which is NOT a tool used to calculate the hash value?
• What methodology validates a plan for maintaining continuous business operations through incidents?
• Which term refers to the potential negative outcomes of risks associated with vulnerabilities?
• In terms of cybersecurity, what is the purpose of using a SIEM system?
• Which type of cloud has an infrastructure that operates solely for a single organization?
• How should organizations protect sensitive data from insider threats?
• Which statement best describes the importance of documentation in computer forensics?
• What does the term 'first response' refer to in incident handling?
• What tool can help gather information about network connections to and from an affected system?
• Which of the following is NOT a type of DoS attack?
• When is an investigation considered complete?
• What type of protection is essential to prevent unauthorized access to sensitive data?
• What is considered a huge network of compromised systems used by attackers for denial-of-service (DoS) attacks?
• Which phase involves preparing incident response documentation?
• Which option is NOT a goal of computer forensics?
• Dwayne wants to acquire account information from a competitor company, so he sends an illegitimate email to the payroll specialist claiming to be the CEO. What type of security attack would this be?
• Which of the following is an indication of unauthorized use of a standard user account?
• Can well-trained members of an organization prevent an incident or limit the resulting damage?
• Riya fell victim to a scam after she was requested to provide her username and password via email. Which trick did the attacker use?
• User reports of hardware that is misplaced or unauthorized typically indicate what type of incident?
• What is the purpose of the CloudPassage quarantine application?
• What tool should an incident responder use to monitor user and network activities?
• What is a common characteristic of a worm in contrast to a virus?
• What term describes an organization's ability to effectively use digital evidence with minimal costs?
• What is the name of the tool that is an insider threat management solution providing organizations with continuous monitoring of user behavior?
• What is a critical first step for incident responders upon arriving at a scene?
• What term describes the manipulation of people to reveal sensitive information?
• What is the primary tool used for filtering or blocking malicious content on a network edge?
• Which of the following is a common consequence of insufficient transport layer protection?
• Which of the following MUST be included in the incident recording step?
• What would likely indicate a change in system configuration?
• What is the main goal of forensic readiness?
• Which step follows incident detection in the incident response lifecycle?
• What result of the SPF protocol indicates that the SPF record could not be verified due to errors?
• Which are important elements of any security awareness and training program?
• Which phishing attack specifically targets high-profile individuals with access to confidential information?
• What could be the consequence of not identifying suspicious software on a network?
• Which cause of an insider attack involves a competitor luring employees to corrupt data for financial gain?
• What type of tools are ManageEngine ServiceDesk Plus and AlienVault OSSIM primarily classified as?
• Which of the following is a critical action in ensuring effective forensic readiness?
• Which of the following is NOT recognized as a type of phishing?
• An act of tricking people to reveal sensitive information is associated with which reconnaissance technique?
• What is the purpose of forensic analysis in incident handling?
• What advanced authentication protocol should Flora implement for network security?
• What type of incidents does an incident handler primarily deal with?
• What is a potential consequence of lacking forensic readiness?
• What is a key indicator that an insider threat may be present in an organization?
• What is a common mistake a first responder makes at a computer crime scene?
• What type of cloud computing threat affects the operation of automated tasks?
• Which policy is focused on controlling user access to data and resources based on user roles?
• What incident refers to a person gaining access to system and network resources without authorization?
• Which type of policy would likely involve minimal restrictions on employee internet usage?
• What is the primary purpose of PromqryUI?
• What kind of policy contains a set of rules that defines authorized connections?
• Which open-sourced phishing toolkit can Steve use for phishing simulations?
• Which option provides specific strategies for recovery from an incident?
• When implementing insider threat management, what is a critical first step?
• Which of the following is an example of an inappropriate usage incident?
• What mechanism is often used alongside user behaviors to combat insider threats?
• Which strategy is effective for minimizing the risk of insider threats?
• Which type of evidence helps incident responders build a timeline of an attack?
• Which term relates to a legal document that shows the progression of evidence from the original location to the forensic lab?
• Which of the following best describes residual risk?
• Being forensically ready allows a response team to achieve which outcome?
• High resource utilization during attacks may indicate which of the following?
• Which attack type can be prevented by guarding sensitive data during deserialization?
• What form of attack involves an employee using portable devices to extract data?
• Among the indicators of insider threats, which is the most common?
• In DNS attacks, which type involves registering an elapsed domain name?
• Which type of phishing attack typically aims to gather private information by creating a trusted scenario?
• What is NOT considered a motive behind insider attacks?
• Which of the following actions helps improve incident response effectiveness?
• What action can an incident responder take to monitor the integrity of critical files?
• Access control attacks and integrity attacks are examples of what type of incidents?
• What type of identity theft involves the illegal use of a victim's bank account and credit card information?
• Which flow correctly represents the steps of incident recovery?
• What is a common technique to secure confidential data from insider threats?
• What service is provided by a cloud broker?
• What is a critical factor in the management of an incident handling team?
• What is one of the primary purposes of incident detection systems?
• What metric is used to measure the magnitude of application layer attacks?
• Which type of DoS/DDoS incident is measured in packets per second (pps)?
• What do PKI, SDL, and WAF represent in cloud security?
• What do Proxy Servers help to prevent between the user and a web application?
• Which step is NOT part of securing computer networks against insider threats?
• Which of the following is a common consequence of insider attacks?
• Which website can Jocelyn use to find out detailed information about received emails?
• In web security, what does XSS stand for?
• Which engine is capable of real-time intrusion detection, inline intrusion prevention, and network security monitoring?
• What motivates an insider attack where an employee publicizes sensitive information for a political cause?
• Which technology does social engineering primarily exploit?
• A mobile phone might be offered for $1000, but a hacker alters the hidden text in its price field to purchase it for $10. What type of attack is this?
• Which phase of the computer forensics investigation process involves acquisition and preservation of data?
• What is a key preparation step for a cloud service provider (CSP)?
• What is a primary goal of a business impact analysis?
• Which website tool is beneficial for representing and extracting data during a network test?
• When should you ask your ISP to implement filtering in a DoS containment strategy?
• Which of the following is NOT considered a type of computer security incident?
• What is the primary effect of Denial-of-Service incidents on network resources?
• What is one way to check if an attacker has tampered with the email header?
• Computer forensic investigators must possess what type of knowledge?
• What term refers to an organization’s readiness to utilize digital evidence efficiently?
• Which information security principle aims to ensure that information is only accessible to those who are authorized?
• Which technique tricks individuals into revealing sensitive information during reconnaissance attacks?
• Which of the following incidents refers to a user performing actions that violate the acceptable computing use policies?
• Which term describes the use of multiple compromised machines to perform a coordinated attack?
• What is an important characteristic of a forensic-ready organization?
• What is the name of the process that converts object data into a linear format?
• Which security measure can be taken to mitigate unauthorized access incidents?
• What is the initial action taken after a security incident occurs?
• What is the name of the email service platform by Novell NetWare that stores messages in proprietary databases?
• What cloud service allows subscribers to use fundamental IT resources on demand?
• Which insider attack involves surreptitiously overhearing confidential conversations?
• What is a primary concern when migrating to a cloud service model?
• If a computer is turned off during a crime scene investigation, what can happen to unsaved data?
• Which element of information security ensures access is restricted to authorized users?
• Which type of network attack involves methods like reconnaissance, sniffing, and spoofing?
• Temporary shutdown and restoration of the infected system are common techniques in which stage of incident response?
• Which category of unauthorized access is associated with changes in system status?
• Which security policy places no restrictions on the usage of system resources?
• What threat to cloud computing involves ignorance of the CSP's operational capabilities?
• In the context of email security, what is the purpose of a Sender Policy Framework?
• Which regular expression is used to detect SQL injection attacks on an MS SQL Server?
• Which method is effective for eradicating SQL Injection Attacks?
• Which document is designed specifically for responding to and managing an incident?
• Which type of logs should incident handlers analyze to understand established connections and user activity?
• What is the process of removing compromised cloud networks called?
• Bethany is an attacker who sends emails containing a rewrite link to trick victims into disclosing passwords. What is the name of this method?
• What is a noted limitation of cloud computing?
• In incident response, what is the first step in dealing with malicious software detected in a system?
• What technique is often used to identify active devices on a network?
• What type of application self-replicates and degrades system performance without affecting files?
• ________ is a security strategy in which several protection layers are placed throughout an information system.
• What type of analysis assesses risks based on subjective judgments and the impact of potential threats?
• When performing behavioral analysis to detect insider threats, what is the first step to take?
• What does a neutral result indicate on the DKIM protocol?
• Which element is essential in an incident response plan for insider threats?
• Motive (Goal) + Method + Vulnerability =
• Which of the following is not a step in the incident recovery process?
• A/An ________ policy defines a standard to handle application traffic, such as web or email.
• What should be disabled for an employee upon termination regarding access?
• Which of the following is essential for maintaining a forensic workstation?
• Which malware type is known for replicating itself to spread to other systems?
• What type of attack involves an intruder intercepting and altering communication between two parties in real-time?
• Which cloud deployment model is specifically designed for a limited set of organizations with shared interests?
• What is the primary use of an email dossier?
• Which of the following guidelines helps detect and prevent insider threats?
• What is the primary goal of incident response?
• Which of the following services falls under the category of Software-as-a-Service (SaaS)?
• Where can electronic evidence typically be found?
• Which of the following is NOT a challenge in handling cloud security incident logs?
• Which type of phishing specifically targets high profile individuals such as CEOs and politicians?
• What are signs of an email attack?
• What method is used by attackers to manipulate the way a web application interprets user input to bypass authentication?
• Which of the following is NOT something security policies can accomplish?
• Which type of phishing attack uses instant messaging platforms to send spam?
• What security strategy is characterized by multilayered protection to minimize attacks on organizational assets?
• What indicates a 'negligent' insider threat?
• What role does computer forensics NOT typically perform?
• Which policy governs access to physical facilities and computers?
• What does "cloud service provider (CSP)" refer to?
• If the victim’s computer is internet-connected, what is the first step a responder must take?
• Which of the following is a method to potentially eradicate insider threats?
• Which tools can incident handlers use to monitor, collect, detect, and analyze user activities on the network?
• What process involves removing malware and isolating infected systems?
• What is the process of imaging or collecting information from various media in accordance with certain standards for analyzing its forensic value?
• The characteristic of digital evidence presented by an investigator showing actions of an attacker is considered what?
• Which of the following best describes a characteristic of distributed storage in cloud computing?
• Which harmful insider uses technical knowledge to exploit network weaknesses for profit?
• Spoofing, session hijacking, DoS attacks, firewall and IDS attacks are all considered what type of information security threat?
• What is a disadvantage of using Platform-as-a-Service (PaaS)?
• What data deletion category applies when Outlook moves deleted mail to the Deleted Items folder?
• What term describes a scenario where a large volume of junk email is sent automatically without human involvement?
• What should be the focus of an organization's response strategy during a security incident?
• What is a common type of identity theft?
• The likelihood of a given threat-source attempting to exploit a vulnerability is known as?
• What can the determination of risk for a threat/vulnerability pair functionally express?
• According to the NIST cloud deployment reference architecture, which component acts as an intermediary for connectivity and transport services?
• What is the most common type of attacks against computer systems?
• What is the primary aim of forensic analysis?
• What distinguishes a hybrid cloud from a community cloud?
• What is the designated location for conducting computer-based investigations called?
• Which of the following is a technique to respond to an insider threat?
• Megan, a disgruntled employee, committing data theft using steganography, represents which type of attack?
• ________ attacks exploit vulnerabilities in dynamically generated web pages, allowing malicious attackers to inject client-side script into web pages viewed by other users.
• Anna created her company's security policy to accept the majority of internet traffic, excluding several known dangerous services and attacks. Which type of security policy did Anna put into place?
• What type of attack is caused by insecure or obsolete encryption in cloud services?
• Identify the Wireshark filter used to view packets moving without a flag set during null scan attempts.
• What must be done during incident containment?
• What defines "soft deletion" in email management?
• What term refers to the process of trying to uncover weaknesses in a system?
• Why might Roy's MS Word application started crashing frequently after downloading certain files?
• Should the incident response team only handle incidents identified by a trusted person in the organization?
• What type of vulnerability allows attackers to inject malicious scripts into content that users view in a browser?
• Where is the best place to analyze logs for identifying multiple failed login attempts?
• In which attack does an attacker infect multiple systems, referred to as "zombies," to carry out an attack on a target?
• Which type of insider threat involves individuals who lack awareness of security measures?
• Heidi is a hacker who is trying to avoid detection by using various encoding techniques. What type of web application threat is she using?
• Which part of the email header logs the history of a message, including origin and forgery details?
• Which of the following actions is first recommended when responding to an insider threat incident?
• What security measure should be avoided to bolster protection against SQL Injection Attacks?
• Which investigation platform is known for collecting digital data and preserving evidence in a court-validated format?