Authentic ECCouncil Certification Exam 212-89 Questions Answers

Software as a Service (SaaS) offers the least amount of security responsibility for the end-user or organization, as the service provider manages the underlying infrastructure, software maintenance, security patching, and updates. Choosing a SaaS application means the colleague ' s organization would not be responsible for the physical servers, operating systems, or the application ' s security configurations, making it the best option for minimizing their security responsibilities.

The EC-Council Incident Handler (ECIH) curriculum stresses that periodic access reviews are essential for preventing insider threats. When user roles change or projects end, permissions must be reviewed and adjusted according to the Principle of Least Privilege (PoLP).

In this case, the intern retained access privileges beyond the project duration due to lack of periodic auditing. Regular auditing of user access rights ensures that permissions remain aligned with job responsibilities and reduces the risk of privilege misuse.

Option A (data classification) helps identify sensitive data but does not ensure access rights are revoked. Option B (account lockout policies) addresses brute-force login attempts, not permission creep. Option D (surveillance cameras) concerns physical monitoring.

ECIH emphasizes implementing Role-Based Access Control (RBAC), enforcing least privilege, conducting quarterly or periodic access reviews, and maintaining strong identity governance to mitigate insider threats.

Therefore, regular auditing of user access rights would have prevented this issue.

Access point monitoring is the technique that helps incident handlers to detect man-in-the-middle (MitM) attacks by continuously observing and managing the wireless access points (APs) within a network. This includes identifying unauthorized or new APs attempting to connect to the network or mimic existing APs, even if they present similar IP and MAC addresses to legitimate access points. Through access point monitoring, incident handlers can quickly identify and mitigate spoofed APs, thus preventing MitM attacks that exploit wireless networks by intercepting and manipulating communications.