Update 212-89 Preparation Exams 2021

NEW QUESTION 1
What is correct about Quantitative Risk Analysis:

• A. It is Subjective but faster than Qualitative Risk Analysis
• B. Easily automated
• C. Better than Qualitative Risk Analysis
• D. Uses levels and descriptive expressions

Answer: B

NEW QUESTION 2
A malicious security-breaking code that is disguised as any useful program that installs an executable programs when a file is opened and allows others to control the victim’s system is called:

• A. Trojan
• B. Worm
• C. Virus
• D. RootKit

Answer: A

NEW QUESTION 3
The Linux command used to make binary copies of computer media and as a disk imaging tool if given a raw disk device as its input is:

• A. “dd” command
• B. “netstat” command
• C. “nslookup” command
• D. “find” command

Answer: A

NEW QUESTION 4
They type of attack that prevents the authorized users to access networks, systems, or applications by exhausting the network resources and sending illegal requests to an application is known as:

• A. Session Hijacking attack
• B. Denial of Service attack
• C. Man in the Middle attack
• D. SQL injection attack

Answer: B

NEW QUESTION 5
A computer forensic investigator must perform a proper investigation to protect digital evidence. During the investigation, an investigator needs to process large amounts of data using a combination of automated and manual methods. Identify the computer forensic process involved:

• A. Analysis
• B. Preparation
• C. Examination
• D. Collection

Answer: C

NEW QUESTION 6
An access control policy authorized a group of users to perform a set of actions on a set of resources. Access to resources is based on necessity and if a particular job role requires the use of those resources. Which of the following is NOT a fundamental element of access control policy

• A. Action group: group of actions performed by the users on resources
• B. Development group: group of persons who develop the policy
• C. Resource group: resources controlled by the policy
• D. Access group: group of users to which the policy applies

Answer: B

NEW QUESTION 7
Removing or eliminating the root cause of the incident is called:

• A. Incident Eradication
• B. Incident Protection
• C. Incident Containment
• D. Incident Classification

Answer: A

NEW QUESTION 8
US-CERT and Federal civilian agencies use the reporting timeframe criteria in the federal agency reporting categorization. What is the timeframe required to report an incident under the CAT 4 Federal Agency category?

• A. Weekly
• B. Within four (4) hours of discovery/detection if the successful attack is still ongoing and agency is unable to successfully mitigate activity
• C. Within two (2) hours of discovery/detection
• D. Monthly

Answer: A

NEW QUESTION 9
Policies are designed to protect the organizational resources on the network by establishing the set rules and procedures. Which of the following policies authorizes a group of users to perform a set of actions on a set of resources?

• A. Access control policy
• B. Audit trail policy
• C. Logging policy
• D. Documentation policy

Answer: A

NEW QUESTION 10
A computer Risk Policy is a set of ideas to be implemented to overcome the risk associated with computer security incidents. Identify the procedure that is NOT part of the computer risk policy?

• A. Procedure to identify security funds to hedge risk
• B. Procedure to monitor the efficiency of security controls
• C. Procedure for the ongoing training of employees authorized to access the system
• D. Provisions for continuing support if there is an interruption in the system or if the system crashes

Answer: C

NEW QUESTION 11
Which test is conducted to determine the incident recovery procedures effectiveness?

• A. Live walk-throughs of procedures
• B. Scenario testing
• C. Department-level test
• D. Facility-level test

Answer: A

NEW QUESTION 12
The network perimeter should be configured in such a way that it denies all incoming and outgoing traffic/ services that are not required. Which service listed below, if blocked, can help in preventing Denial of Service attack?

• A. SAM service
• B. POP3 service
• C. SMTP service
• D. Echo service

Answer: D

NEW QUESTION 13
To recover, analyze, and preserve computer and related materials in such a way that it can be presented as evidence in a court of law and identify the evidence in short time, estimate the potential impact of the malicious activity on the victim, and assess the intent and identity of the perpetrator is known as:

• A. Computer Forensics
• B. Digital Forensic Analysis
• C. Forensic Readiness
• D. Digital Forensic Examiner

Answer: B

NEW QUESTION 14
Which of the following incident recovery testing methods works by creating a mock disaster, like fire to identify the reaction of the procedures that are implemented to handle such situations?

• A. Scenario testing
• B. Facility testing
• C. Live walk-through testing
• D. Procedure testing

Answer: D

NEW QUESTION 15
The data on the affected system must be backed up so that it can be retrieved if it is damaged during incident response. The system backup can also be used for further investigations of the incident. Identify the stage of the incident response and handling process in which complete backup of the infected system is carried out?

• A. Containment
• B. Eradication
• C. Incident recording
• D. Incident investigation

Answer: A

NEW QUESTION 16
A methodical series of techniques and procedures for gathering evidence, from computing equipment and various storage devices and digital media, that can be presented in a court of law in a coherent and meaningful format is called:

• A. Forensic Analysis
• B. Computer Forensics
• C. Forensic Readiness
• D. Steganalysis

Answer: B

NEW QUESTION 17
The sign of incident that may happen in the future is called:

• A. A Precursor
• B. An Indication
• C. A Proactive
• D. A Reactive

Answer: A

NEW QUESTION 18
Installing a password cracking tool, downloading pornography material, sending emails to colleagues which irritates them and hosting unauthorized websites on the company’s computer are considered:

• A. Network based attacks
• B. Unauthorized access attacks
• C. Malware attacks
• D. Inappropriate usage incidents

Answer: D

NEW QUESTION 19
Authorized users with privileged access who misuse the corporate informational assets and directly affects the confidentiality, integrity, and availability of the assets are known as:

• A. Outsider threats
• B. Social Engineers
• C. Insider threats
• D. Zombies

Answer: C

NEW QUESTION 20
Which of the following is NOT one of the Computer Forensic types:

• A. USB Forensics
• B. Email Forensics
• C. Forensic Archaeology
• D. Image Forensics

Answer: C

NEW QUESTION 21
In a qualitative risk analysis, risk is calculated in terms of:

• A. (Attack Success + Criticality ) –(Countermeasures)
• B. Asset criticality assessment – (Risks and Associated Risk Levels)
• C. Probability of Loss X Loss
• D. (Countermeasures + Magnitude of Impact) – (Reports from prior risk assessments)

Answer: C

NEW QUESTION 22
......