We're so confident of our products that we provide no hassle product exchange.
EC-COUNCIL 212-89 Exam Overview:
| Certification Vendor: | EC-Council |
|---|---|
| Exam Name: | EC-Council Certified Incident Handler (ECIH v3) |
| Exam Number: | 212-89 |
| Passing Score: | 70% |
| Certificate Validity Period: | 3 Years |
| Available Languages: | English |
| Exam Price: | USD 450.00 |
| Exam Duration: | 180 minutes |
| Real Exam Qty: | 100 |
| Related Certifications: | Certified Incident Handler (ECIH) |
| Exam Format: | Multiple Choice |
| Sample Questions: | EC-COUNCIL 212-89 Sample Questions |
| Exam Way: | Online (Remote Proctored) or At a Pearson VUE Testing Center |
| Pre Condition: | None |
| Official Syllabus URL: | https://www.eccouncil.org/programs/certified-incident-handler-ecih/ |
Eligibility Process
As with other EC-Council certifications, ECIH can be earned in two ways: with or without attending the official training.
- The first option entails completing the official course at any of the EC-Council Authorized Training Centers or attending the EC-Council live online training via iWeek. It also involves joining the self-study program through iLearn or attending the EC-Council live online training via iWeek. If you choose this path, you won’t have to pay a registration fee for the exam, as this cost will be included in your training fees.
- The second option includes meeting the certification eligibility criteria. This comes with at least one year of working experience in the Information Security domain. In addition, the applicants are required to submit the Exam Eligibility Application Form and pay a non-refundable fee of $100.
Reference: https://www.eccouncil.org/programs/ec-council-certified-incident-handler-ecih/
What Are Domains Covered by ECIH Test?
Overall, this certification exam has nine domains that have a specific weightage in the official validation. The candidates who take this exam need to master the following topics:
- Incident handling and response 16%;
- Cloud environment incidents 8%;
- Process handling 14%;
- Email security incidents 10%;
- Mobile & network incidents 16%;
- First response and forensic readiness 13%.
- Application-level incidents 8%;
- Malware incidents 8%;
- Insider threats 7%;
Exam Overview
The EC-Council 212-89 exam is delivered through the ECC Test Centers that are located around the world. The certification test contains 100 multiple-choice questions and has the allocated duration of 3 hours. The exam is available in the English language only. To complete the test successfully, you need to give at least 70% of the correct answers. If one fails this EC-Council exam at the first attempt, there is no waiting period for the second try. For the third and subsequent attempts, a waiting period of 14 days is established. After passing the test, you will receive your ECIH certificate within 7 business days.
EC-COUNCIL 212-89 Exam Syllabus Topics:
| Section | Weight | Objectives |
|---|---|---|
| First Response | 14% | - Incident Handling and Response Steps
|
| Handling and Response to Email Security Incidents | 15% | - Email Incident Response
|
| Incident Handling and Response Process | 18% | - Incident Handling and Response Concepts
|
| Handling and Response to Web Application Security Incidents | 15% | - Web Application Security Incidents
|
| Handling and Response to Network Security Incidents | 15% | - Network Incident Response
|
| Handling and Response to Malware Incidents | 18% | - Malware Handling Tools
|
| Handling and Response to Cloud Security Incidents | 15% | - Cloud Incident Response
|
EC-COUNCIL EC Council Certified Incident Handler (ECIH v3) Sample Questions:
SafeGuard Inc., a cloud storage company, identified that attackers are exploiting a Server-Side Request Forgery (SSRF) vulnerability in their application, leading to internal network reconnaissance. To mitigate this vulnerability, which measure should SafeGuard Inc. prioritize?
- A. Restrict outbound traffic from the application server.
- B. Implement a Content Security Policy (CSP).
- C. Disable unused application features and services.
- D. Increase monitoring and logging of application activities.
Correct Answer: A 🗳️
Explanation: Only visible for TopExamCollection members. You can sign-up / login (it's free).
Ikeo Corp, hired an incident response team to assess the enterprise security. As part of the incident handling and response process, the IR team is reviewing the current security policies implemented by the enterprise.
The IR team finds that employees of the organization do not have any restrictions on Internet access: they are allowed to visit any site, download any application, and access a computer or network from a remote location.
Considering this as the main security threat, the IR team plans to change this policy as it can be easily exploited by attackers. Which of the following security policies is the IR team planning to modify?
- A. Permissive policy
- B. Promiscuous policy
- C. Prudent policy
- D. Paranoid policy
Correct Answer: D 🗳️
Explanation: Only visible for TopExamCollection members. You can sign-up / login (it's free).
Jason, a cybersecurity analyst in the incident response team, begins investigating several complaints from employees who received emails urgently requesting wire transfers to an overseas account. The emails appeared to come from the company's CEO, using a tone of authority and pressure to bypass standard procedures. Upon closer inspection, Jason identifies that the sender ' s email address includes a minor alteration in the domain name-a form of domain spoofing. He examines the email headers, confirms the falsified sender identity, and cross-checks with the actual CEO's activity logs to ensure there was no internal compromise. Immediately, Jason blocks the sender's IP address at the firewall level, alerts the finance department to prevent any unauthorized transactions, and issues a company-wide advisory about the impersonation attempt. What type of phishing is Jason handling?
- A. Mail bombing
- B. Whaling
- C. Credential stuffing
- D. Spimming
Correct Answer: B 🗳️
Explanation: Only visible for TopExamCollection members. You can sign-up / login (it's free).
A logistics company relying heavily on cloud-based inventory management discovered unauthorized activity initiated by a third-party contractor. The investigation revealed that the contractor ' s login was reused across multiple departments and lacked any tracking mechanism or role-specific restrictions to limit its scope. What cloud security best practice should be implemented to prevent such violations?
- A. Routine vulnerability scans on mobile apps used by delivery teams
- B. Enforcement of strict user access control and credential isolation
- C. Implementation of Secure Sockets Layer (SSL) encryption on internal systems
- D. Use of anonymized data during inventory analytics
Correct Answer: B 🗳️
Explanation: Only visible for TopExamCollection members. You can sign-up / login (it's free).
Which stage of the incident response and handling process involves auditing the system and network log files?
- A. Incident triage
- B. Incident disclosure
- C. Containment
- D. Incident eradication
Correct Answer: A 🗳️
Explanation: Only visible for TopExamCollection members. You can sign-up / login (it's free).
Viewing page 1 out of 72 pages.
Viewing questions 1-5 out of 359 questions.
By Elroy
