212-89 EC-Council Exam Questions and Free Practice Test

Question 7

Incident prioritization must be based on:

A. Potential impact

B. Current damage

C. Criticality of affected systems

D. All the above

Correct Answer:D

Question 8

The correct order or sequence of the Computer Forensic processes is:

A. Preparation, analysis, examination, collection, and reporting

B. Preparation, collection, examination, analysis, and reporting

C. Preparation, examination, collection, analysis, and reporting

D. Preparation, analysis, collection, examination, and reporting

Correct Answer:B

Question 9

Incidents are reported in order to:

A. Provide stronger protection for systems and data

B. Deal properly with legal issues

C. Be prepared for handling future incidents

D. All the above

Correct Answer:D

Question 10

An adversary attacks the information resources to gain undue advantage is called:

A. Defensive Information Warfare

B. Offensive Information Warfare

C. Electronic Warfare

D. Conventional Warfare

Correct Answer:B

Question 11

Insider threats can be detected by observing concerning behaviors exhibited by insiders, such as conflicts with supervisors and coworkers, decline in performance, tardiness or unexplained absenteeism. Select the technique that helps in detecting insider threats:

A. Correlating known patterns of suspicious and malicious behavior

B. Protecting computer systems by implementing proper controls

C. Making is compulsory for employees to sign a none disclosure agreement

D. Categorizing information according to its sensitivity and access rights

Correct Answer:A

Question 12

A self-replicating malicious code that does not alter files but resides in active memory and duplicates itself, spreads through the infected network automatically and takes advantage of file or information transport features on the system to travel independently is called:

A. Trojan

B. Worm

C. Virus

D. RootKit

Correct Answer:B

START 212-89 EXAM