ECCouncil Updated 212-89 Exam Questions and Answers by ameera

The EC-Council Incident Handler (ECIH) curriculum highlights the importance of proactive security controls, asset management, configuration management, and vulnerability management as foundational elements of forensic readiness and incident prevention.

The scenario describes challenges related to unmanaged systems, inconsistent configurations, and lack of asset visibility—core issues addressed by the CIS Critical Security Controls (CIS CSC). The CIS Controls provide prioritized, actionable cybersecurity best practices designed to mitigate the most common attack vectors. These include inventory and control of hardware assets, inventory and control of software assets, secure configuration of enterprise assets, continuous vulnerability management, and controlled use of administrative privileges.

ECIH emphasizes that organizations must first establish visibility into assets and enforce baseline security configurations to reduce attack surfaces. The CIS framework is specifically designed for practical implementation, making it ideal for organizations seeking efficient deployment using available resources.

Option B (NIST 800-61) focuses on incident response lifecycle management, not proactive exposure reduction. Option C (ITIL) focuses on IT service management and service restoration, not cybersecurity hardening. Option D (COBIT) provides high-level governance and enterprise control objectives but does not offer the hands-on, prioritized technical safeguards described in the scenario.

Therefore, consistent with ECIH guidance on preventive controls and security baselining, the CIS Critical Security Controls framework is the best fit for implementing proactive, real-world defensive measures.

Liam is establishing and maintaining the chain of custody for digital evidence. ECIH forensic-readiness procedures require responders to document evidence from the moment it is identified and collected through every subsequent transfer, examination, storage, and presentation. Exhibit numbers, collector identification, seizure date and time, device descriptions, original locations, photographs, and transfer records provide traceability and demonstrate that evidence has remained controlled. Recording who receives each item next is particularly important because every change in possession must be documented. These procedures protect evidence integrity and support its admissibility during disciplinary, civil, or criminal proceedings. Imaging volatile memory concerns acquisition from active systems, while malware removal would modify the evidence. Endpoint detection software is unrelated to evidence documentation. Liam ' s systematic labeling and transfer recording therefore constitute creation of a chain-of-custody record.

================

True attribution in the context of cyber incidents involves the identification of the actual individuals, groups, or entities behind an attack. This can include pinpointing specific persons, organizations, societies, or even countries that sponsor or carry out cyber intrusions or attacks. Alexis ' s efforts to identify and attribute the actors behind a recent attack by distinguishing the specific origins of the threat align with the concept of true attribution, which goes beyond mere speculation to provide concrete evidence about the perpetrators.

An active assessment involves using automated tools to scan and probe the network actively to identify hosts, services, and vulnerabilities. This type of assessment directly interacts with the network components to gather information about the existing security posture, unlike passive assessments, which analyze traffic without sending packets to the target systems. Dickson ' s approach, employing automated tools to identify the network ' s hosts, services, and vulnerabilities, fits the definition of an active assessment. This method provides a more immediate understanding of the network ' s vulnerabilities, allowing for timely remediation actions.