ECIH 212-89 Exam Questions and Answers PDF

Anti-forensics refers to techniques used to hinder the forensic analysis of a computer system. By hiding files in slack space, changing file headers, embedding suspicious files in executables, and altering metadata, BadGuy Bob is attempting to make it difficult for forensic analysts to find, analyze, and attribute the malicious activities and data on his laptop. These actions are designed to conceal evidence, manipulate digital artifacts, and obstruct investigations, making them clear examples of anti-forensic techniques. While such actions could be part of broader criminal activities, constituting a felony, and could be seen as adversarial mechanics or legal hostility in specific contexts, the most accurate classification of these techniques is anti-forensics.References:The ECIH v3 certification program includes discussions on forensic analysis and the challenges posed by anti-forensic techniques, teaching incident handlers how to recognize and counteract attempts to obstruct investigations.

As of my last update, the most recent NIST standard for incident response was NIST Special Publication 800-61 Revision 2 (800-61r2), titled "Computer Security Incident Handling Guide." This document provides guidelines for establishing an effective incident response program, including preparation, detection and analysis, containment, eradication, recovery, and post-incident activity.

References:The document is a key resource in the field of incident response, frequently cited in the ECIH v3 curriculum for its comprehensive guidelines on managing and responding to cybersecurity incidents.

When Joseph, the IH&R team lead, alerted service providers, developers, and manufacturers about the affected resources, he was engaged in the Containment stage of the Incident Handling and Response (IH&R) process. Containment involves taking steps to limit the spread or impact of an incident and to isolate affected systems to prevent further damage. Alerting relevant stakeholders, including service providers and developers, is part of containment efforts to ensure that the threat does not escalate and that measures are taken to protect unaffected resources. This stage precedes eradication and recovery, focusing on immediate response actions to secure the environment.References:The ECIH v3 certification program outlines the IH&R process stages, explaining the roles and actions involved in containment, including communication with external and internal stakeholders to manage and mitigate the incident's effects.

A Trojan, short for Trojan horse, is a type of malicious software that misleads users of its true intent. It disguises itself as a legitimate and useful program, but once executed, it allows unauthorized access to the user's system. Unlike viruses and worms, Trojans do not replicate themselves but can be just as destructive. They are often used to create a backdoor to a computer system, allowing an attacker to gain access to the system or to deliver other malware. Trojans can be used for a variety of purposes, including stealing information, downloading or uploading files, monitoring the user's screen and keyboard, and more. The term "Trojan" comes from the Greek story of the wooden horse that was used to sneak soldiers into the city of Troy, which is analogous to the deceptive nature of this type of malware in cyber security.

References:The EC-Council's Certified Incident Handler (ECIH v3) program covers various types of malware, including Trojans, in detail, explaining their mechanisms, how they can be identified, and the steps to take in response to such threats.