| Exam Name: | EC Council Certified Incident Handler (ECIH v3) | ||
| Exam Code: | 212-89 Dumps | ||
| Vendor: | ECCouncil | Certification: | ECIH |
| Questions: | 356 Q&A's | Shared By: | aron |
Rose is an incident-handling person and she is responsible for detecting and eliminating
any kind of scanning attempts over the network by any malicious threat actors. Rose
uses Wireshark tool to sniff the network and detect any malicious activities going on.
Which of the following Wireshark filters can be used by her to detect TCP Xmas scan
attempt by the attacker?
Clark, a professional hacker, exploited the web application of a target organization by
tampering the form and parameter values. He successfully exploited the web
application and gained access to the information assets of the organization.
Identify the vulnerability in the web application exploited by the attacker.
Daniel, a SOC analyst, detects multiple incoming TCP requests to the organization ' s mail server from different IP addresses. However, none of the requests complete the handshake. He suspects a potential attempt to exhaust server resources and confirms this with netstat logs. Which type of protocol-level incident is Daniel identifying?
After a successful exploitation attempt, a university web server started exhibiting anomalies such as high server load, random form submission errors, and repeated spam complaints. Hosting providers flagged the domain as suspicious and disabled the web application. The IH & R team discovered new unknown files within the web root directory. Which action would be most appropriate to contain the incident and avoid further damage?
TESTED 10 Oct 2026
