ECCouncil Updated 712-50 Exam Questions and Answers by eleni

 Explanation:

Incident response encompasses the processes and actions taken to assess, contain, and mitigate security breaches.

It includes detection, investigation, containment, and recovery activities.

 Why Other Options Are Incorrect:

A. IT support team: May assist but lacks the specialized role of incident response teams.

B. Forensic analysis: A part of the incident response process but does not encompass the entire containment effort.

D. Physical security team: Relevant for physical breaches, not digital security incidents.

 EC-Council CISO Reference:

Incident response is a critical component of the CISO role, focusing on minimizing damage and ensuring swift recovery from breaches.

 Explanation:

In-line hardware keyloggers are physical devices placed between a keyboard and a computer.

They are a concern because they are not detectable by software-based monitoring tools, posing a significant risk to the confidentiality of sensitive information.

 Why Other Options Are Incorrect:

A. Don’t require physical access: Physical access is required to install the hardware.

B. Don’t comply with regulations: While true, this is a secondary concern compared to their undetectability.

D. Are relatively inexpensive: Cost is a factor but not the primary security concern.

 EC-Council CISO Reference:

The curriculum addresses the risks posed by hardware-based attacks and the need for physical security controls to mitigate such threats.

 Investigative Support for Open Guest Networks:

IP and MAC addresses associated with network activity provide crucial identifiers for tracing a user's activity. This is especially helpful for law enforcement when investigating illegal activities.

 Why IP and MAC Address Are Critical:

IP Address: Helps identify network traffic origin during a specific time frame.

MAC Address: Provides device-specific identification.

 Why Not Other Options:

A. Configure logging on each access point: While useful, it does not directly assist without extracting IP and MAC addresses.

B. Install firewall software: Does not help track user activity retroactively.

D. Disable SSID broadcast and enable MAC filtering: Prevents unauthorized access but doesn’t support investigations.

 EC-Council CISO Alignment:

Proper logging and identification practices ensure legal compliance and effective support during investigations.

A cold site is a backup facility that provides minimal infrastructure and requires significant time to become operational after a disaster. It typically includes only basic physical space, utilities, and possibly some hardware.

Definition of Backup Sites:

Cold Site: Minimal or no IT infrastructure; requires setting up systems, installing software, and restoring data, leading to the longest recovery time.

Hot Site: Fully equipped with operational IT infrastructure; minimal setup time required for recovery.

Warm Site: Partially equipped with essential systems but requires additional setup and restoration before becoming fully operational.

Mobile Backup Site: Portable and flexible backup sites with quicker setup times but still slower than hot sites.

Recovery Time Comparison:

Cold sites are cost-effective but slowest for recovery.

They are suitable for organizations with lower criticality needs or budget constraints.

Use Cases:

Best for non-critical applications or organizations willing to tolerate extended downtime.

Disaster Recovery Planning: EC-Council outlines the use of backup sites as part of a comprehensive disaster recovery plan, emphasizing the trade-offs between cost and recovery time.

Risk Management Framework: The importance of selecting backup sites based on organizational risk tolerance and business continuity needs is stressed.

EC-Council CISO References: