Free Nov-2025 UPDATED EC-COUNCIL 212-89 Exam Questions & Answer [Q19-Q35]

QUESTION 19
Clark is investigating a cybercrime at TechSoft Solutions. While investigating the case, he needs to collect volatile information such as running services, their process IDs, startmode, state, and status.
Which of the following commands will help Clark to collect such information from running services?

QUESTION 20
Drake is an incident handler in Dark CLoud Inc. He is intended to perform log analysis in order to detect traces of malicious activities within the network infrastructure.
Which of the following tools Drake must employ in order to view logs in real time and identify malware propagation within the network?

QUESTION 21
Which of the following email security tools can be used by an incident handler to prevent the organization against evolving email threats?

QUESTION 22
Sam received an alert through an email monitoring tool indicating that their company was targeted by a phishing attack. After analyzing the incident, Sam identified that most of the targets of the attack are high-profile executives of the company. What type of phishing attack is this?

QUESTION 23
Francis received a spoof email asking for his bank information. He decided to use a tool to analyze the email headers. Which of the following should he use?

QUESTION 24
Marley was asked by his incident handing and response (IH&R) team lead to collect volatile data such as system information and network information present in the registries, cache, and RAM of victim’s system.
Identify the data acquisition method Marley must employ to collect volatile data.

QUESTION 25
Your company sells SaaS, and your company itself is hosted in the cloud (using it as a PaaS).
In case of a malware incident in your customer’s database, who is responsible for eradicating the malicious software?

QUESTION 26
Which of the following tools helps incident handlers to view the file system, retrieve deleted data, perform timeline analysis, web artifacts, etc., during an incident response process?

QUESTION 27
Bonney’s system has been compromised by a gruesome malware.
What is the primary step that is advisable to Bonney in order to contain the malware incident from spreading?

QUESTION 28
Which of the following digital evidence temporarily stored on a digital device that requires a constant power supply and is deleted if the power supply is interrupted?

QUESTION 29
Malicious downloads that result from malicious office documents being manipulated are caused by which of the following?

QUESTION 30
Jacob is an employee at a firm called Dolphin Investment. While he was on duty, he identified that his computer was facing some problems, and he wanted to convey the issue to the concerned authority in his organization. However, this organization currently does not have a ticketing system to address such types of issues. In the above scenario, which of the following ticketing systems can be employed by Dolphin Investment to allow Jacob to inform the concerned team about the incident?

QUESTION 31
Patrick is performing a cyber forensic investigation. He is in the process of collect ng physical evidence at the crime scene.
Which of the following elements must he consider while collecting physical evidence?

QUESTION 32
Mike is an incident handler for PNP Infosystems Inc. One day, there was a ticket submitted regarding a critical incident and Mike was assigned to handle the incident. During the process of incident handling, at one stage, he performed incident analysis and validation to check whether the incident is a genuine incident or a false positive.
Identify the stage he is currently in.

QUESTION 33
In which of the following confidentiality attacks attackers try to lure users by posing themselves as authorized AP by beaconing the WLAN’s SSID?

QUESTION 34
Which of the following types of fuzz testing strategies does new data get generated from scratch, and the amount of data generated is predefined based on the testing model?

QUESTION 35
Which of the following is NOT a network forensic tool?