Halloween Sale Special - 75% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: big75certs

Pass Using 212-89 Exam Dumps

Page: 7 / 27
Total 356 questions

EC Council Certified Incident Handler (ECIH v3) Questions and Answers

Question 25

An attacker after performing an attack decided to wipe evidences using artifact wiping techniques to evade forensic investigation. He applied magnetic field to the digital

media device, resulting in an entirely clean device of any previously stored data.

Identify the artifact wiping technique used by the attacker.

Options:

A.

File wiping utilities

B.

Disk degaussing/destruction

C.

Disk cleaning utilities

D.

Syscall proxying

Question 26

Jason, a cybersecurity analyst in the incident response team, begins investigating several complaints from employees who received emails urgently requesting wire transfers to an overseas account. The emails appeared to come from the company’s CEO, using a tone of authority and pressure to bypass standard procedures. Upon closer inspection, Jason identifies that the sender ' s email address includes a minor alteration in the domain name—a form of domain spoofing. He examines the email headers, confirms the falsified sender identity, and cross-checks with the actual CEO’s activity logs to ensure there was no internal compromise. Immediately, Jason blocks the sender’s IP address at the firewall level, alerts the finance department to prevent any unauthorized transactions, and issues a company-wide advisory about the impersonation attempt. What type of phishing is Jason handling?

Options:

A.

Whaling

B.

Mail bombing

C.

Credential stuffing

D.

Spimming

Question 27

A large insurance enterprise recently completed an internal phishing simu-lation to evaluate its incident reporting workflow. Upon reviewing the ticketing system logs, the IR lead discovered that several phishing-related reports submitted by employees had been mistakenly logged as routine IT service requests. This misrouting prevented timely review by the IH & R team, delaying appropriate follow-up actions.

The root cause was traced to frontline support staff misinterpreting subtle incident indicators as generic technical issues. Recognizing the potential risk this poses to early issue detection, the Chief Information Security Officer directed an overhaul of the alert-handling procedures. This included refining the reporting workflow, embedding clearer triage rules within the ticketing platform, and initiating refresher training to strengthen tier-one decision-making when handling ambiguous user reports. Which IR concern is being addressed through this corrective action?

Options:

Question 28

Which of the following best describes an email issued as an attack medium, in which several messages are sent to a mailbox to cause overflow?

Options:

A.

Email-bombing

B.

Masquerading

C.

Spoofing

D.

Smurf attack

Page: 7 / 27
Total 356 questions