EC-COUNCIL 212-89 問題集

質問 1：
In which of the following stages of the incident handling and response (IH&R) process do the incident handlers try to find the root cause of the incident along with the threat actors behind the incidents, threat vectors, etc.?
A. Incident recording and assignment
B. Post-incident activities
C. Evidence gathering and forensics analysis
D. Incident triage
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 2：
GlobalCorp, a leading software development company, recently launched a cloud-based CRM application. However, within a week, customers reported unauthorized access incidents. On investigation, it was discovered that the vulnerability was due to improper session management, allowing session fixation attacks. How should GlobalCorp address this vulnerability?
A. Increase the complexity of user passwords.
B. Rotate session tokens after successful login.
C. Store session IDs in encrypted cookies.
D. Implement CAPTCHA on all login pages.
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 3：
MediTech, a healthcare tech company, is rolling out a proactive strategy against potential malware threats. They have a diverse range of software and hardware assets. In an executive meeting, a range of measures were discussed. Which measure would best enable them to promptly identify unauthorized applications?
A. Deploying a heuristic-based intrusion detection system.
B. Establishing a strict patch management routine.
C. Conducting weekly vulnerability assessments.
D. Enforcing application whitelisting across all company endpoints.
正解：D

質問 4：
AlphaTech, a cloud-based storage company, recently suffered data leakage. Investigation revealed an employee sent sensitive client data to a personal email. AlphaTech wants to implement a solution to monitor and prevent such incidents. What should they prioritize?
A. Implement a Data Loss Prevention (DLP) tool to monitor sensitive data movement.
B. Mandate employees to attend cyber hygiene workshops every month.
C. Block all personal email domains on the company network.
D. Limit email attachments to 5MB for all employees.
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 5：
What is the primary goal of the identification phase in the incident handling process?
A. Eliminating the threat actor's access to the network
B. Restoring affected systems to normal operation
C. Determining whether an event qualifies as a security incident
D. Deploying security patches to vulnerable systems
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 6：
In the wake of a sophisticated cyber attack targeting a global financial institution, which resulted in a suspected breach of sensitive customer data through encrypted communication channels, an incident handler is the first responder at the scene. The challenge lies in preserving the integrity of volatile memory to ensure a thorough forensic investigation, given the likelihood of sophisticated malware having been used for data exfiltration. The handler must act swiftly to secure digital evidence that could be critical in tracing the attack vector and understanding the breach's scope. The question arises: What should be the incident handler's immediate action to preserve the integrity of the volatile data while ensuring the scene's security for a detailed forensic analysis?
A. Prioritize capturing the system memory of affected devices immediately, followed by securing the physical and digital scene against unauthorized access, preserving the exact state of digital evidence.
B. Deploy forensic tools to capture the volatile memory of the affected systems, ensuring the use of trusted and verified tools to avoid contaminating the evidence.
C. Isolate the network segment of the affected systems, then systematically power down the machines to preserve their current state and prevent further unauthorized access.
D. Conduct a preliminary documentation effort of the physical and digital scene, including capturing photographs and making detailed notes about the systems' and the network's state before initiating any evidence preservation actions.
正解：A
解説: (Topexam メンバーにのみ表示されます)