You are an incident handler working for a large financial institution. The bank has recently purchased new high- end workstations for its data analysis team. In preparation for possible endpoint security incidents, you're deciding on an incident handling approach. What should be your first step?
Answer(s): C
https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-61r2.pdf
During a web application security incident, the incident response team discovers that the attacker has compromised a web server and is using it to launch further attacks against other systems on the network. What is the best course of action for the incident response team during the containment phase?
Answer(s): B
https://blog.rsisecurity.com/how-to-execute-the-containment-phase-of-incident-response/
As an incident handler, you are responsible for managing unauthorized access incidents. After a series of reconnaissance attacks on your network, you have employed tools such as Wireshark and Nmap to detect the incidents. During one such scenario, you notice an IP address, 10.10.10.9, has been repeatedly conducting ICMP echo requests and TCP SYN scans. What would be your immediate course of action to mitigate the situation?
https://bluegoatcyber.com/blog/defending-against-ping-icmp-attacks/
A company's endpoint security solution detects a malware infection on an employee's laptop. What is the first step in the incident response process for handling this endpoint security incident?
Answer(s): A
https://www.emsisoft.com/en/blog/42041/you-just-found-a-malware-infection-now-what-follow- these-steps-to-avoid-making-it-even-worse/
As the new CISO for a mid-sized healthcare organization, you've been tasked with fortifying the company's cyber defenses. Your predecessor mainly focused on network security, but you believe that endpoint security incident handling and response are equally vital. What is the most compelling reason to justify the additional investment to the board of directors?
https://heimdalsecurity.com/blog/best-practices-endpoint-security-healthcare/
Post your Comments and Discuss EC-Council 212-89 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 212-89 content, but please register or login to continue.