ECCouncil 212-82 問題集

質問 1：
Hayes, a security professional, was tasked with the implementation of security controls for an industrial network at the Purdue level 3.5 (IDMZ). Hayes verified all the possible attack vectors on the IDMZ level and deployed a security control that fortifies the IDMZ against cyber-attacks.
Identify the security control implemented by Hayes in the above scenario.
A. MAC authentication
B. Use of authorized RTU and PLC commands
C. Point-to-po int communication
D. Anti-DoS solution
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 2：
A disgruntled employee has set up a RAT (Remote Access Trojan) server in one of the machines in the target network to steal sensitive corporate documents. The IP address of the target machine where the RAT is installed is 20.20.10.26. Initiate a remote connection to the target machine from the "Attacker Machine-1" using the Theef client. Locate the "Sensitive Corporate Documents" folder in the target machine's Documents directory and determine the number of files. Mint: Theef folder is located at Z:\CCT-Tools\CCT Module 01 Information Security Threats and Vulnerabilities\Remote Access Trojans (RAT)\Theef of the Attacker Machine1.
A. 2
B. 3
C. 4
D. 5
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 3：
At CyberGuard Corp, an industry-leading cybersecurity consulting firm, you are the Principal Incident Responder known for your expertise in dealing with high-profile cyber breaches. Your team primarily serves global corporations, diplomatic entities, and agencies with sensitive national importance. One day. you receive an encrypted, anonymous email Indicating a potential breach at WorldBank Inc., a renowned international banking consortium, and one of your prime clients. The email contains hashed files, vaguely hinting at financial transactions of high-net-worth individuals. Initial assessments indicate this might be an advanced persistent threat (APT),likely a state-sponsored actor, given the nature and precision of the data extracted. While preliminary indications point towards a potential zero-day exploit, your team must dive deep into forensics to ascertain the breach's origin, assess the magnitude, and promptly respond. Given the highly sophisticated nature of this attack and potential geopolitical ramifications, what advanced methodology should you prioritize to dissect this cyber intrusion meticulously?
A. Apply heuristics-based analysis coupled with threat-hunting tools to trace anomalous patterns, behaviors, and inconsistencies across WorldBank's vast digital infrastructure.
B. Consult with global cybersecurity alliances and partnerships to gather intelligence on similar attack patterns and potentially attribute the breach to known APT groups.
C. Utilize advanced sandboxing techniques to safely examine the behavior of potential zero-day exploits in the hashed files, gauging any unusual system interactions and network communications.
D. Perform deep dive log analysis from critical servers and network devices, focusing on a timeline based approach to reconstruct the events leading to the breach.
正解：C

質問 4：
Mark, a security analyst, was tasked with performing threat hunting to detect imminent threats in an organization's network. He generated a hypothesis based on the observations in the initial step and started the threat-hunting process using existing data collected from DNS and proxy logs. Identify the type of threat-hunting method employed by Mark in the above scenario.
A. TTP-driven hunting
B. Data-driven hunting
C. Entity-driven hunting
D. Hybrid hunting
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 5：
The incident handling and response (IH&R) team of an organization was handling a recent cyberattack on the organization's web server. Fernando, a member of the IH&P team, was tasked with eliminating the root cause of the incident and closing all attack vectors to prevent similar incidents in future. For this purpose. Fernando applied the latest patches to the web server and installed the latest security mechanisms on it. Identify the IH&R step performed by Fernando in this scenario.
A. Recovery
B. Eradication
C. Containment
D. Notification
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 6：
A John-the-Ripper hash dump of an FTP server's login credentials is stored as "target-file" on the Desktop of Attacker Machine-2. Crack the password hashes in the file to recover the login credentials of the FTP server. The FTP root directory hosts an exploit file. Read the exploit file and enter the name of the exploit's author as the answer. Hint: Not all the credentials will give access to the FTP. (Practical Question)
A. nullsecurlty
B. QcipherShield
C. CodeGuard
D. ByteDefender
正解：A