ECIH Assessment

"*" indicates required fields

Step 1 of 51

1. Which of the following is defined as the existence of a weakness in the design or implementation error that can lead to an unexpected, undesirable event compromising the security of the system?*

Incident

Patch

Vulnerability

Attack

2. Which of the following is defined as an organized approach to address and manage the aftermath of a security breach or attack?*

Vulnerability assessment

Threat

Incident response

Risk assessment

3. Which of the following activity involves all of the processes, logistics, communications, coordination, and planning to respond and overcome an incident efficiently?*

Incident investigation

Incident handling

Incident recovery

Incident reporting

4. Which one of the following is the intangible cost for an incident?*

Lost productivity hours

Investigation and recovery efforts

Loss of business

Loss of reputation

5. Which of the following is a technical threat?*

Shoulder surfing

Incorrect data entry

Sniffing and scanning of the network traffic

Password guessing

6. How will you define quantitative risk analysis?*

Probability of loss + value of loss

Value of loss/ Probability of loss

Probability of loss X value of loss

Probability of loss - value of loss

7. Which of the following determines the level of risk and the resulting security requirements for each system?*

Risk assessment

Contingency planning

Risk mitigation

Residual risk

8. How will you define qualitative risk analysis?*

(Attack Success) + (Criticality – Countermeasures)

(Countermeasures) + (Criticality – Attack Success)

(Attack Success + Criticality) – (Countermeasures)

(Attack Success + Countermeasures) – (Criticality)

9. Which of the following risk mitigation strategy makes an organization absorb minor risks while preparing to respond to major ones?*

Risk assumption

Risk limitation

Risk avoidance

Risk planning

10. Which of the following strategies focuses on minimizing the probability of risks and losses by searching vulnerabilities in the system and appropriate controls?*

Risk planning

Risk avoidance

Research and acknowledgment

Risk limitation

11. Which of the following types of risk is defined by the formula (Threats x Vulnerability)?*

Inherent risk

Qualitative risk

Residual risk

Quantitative risk

12. In which Risk Assessment Methodology step do you identify the boundaries of the IT system and characterize it in order to establish the scope of the risk assessment effort ?*

System Characterization

Threat Characterization

System Identification

Threats Identification

13. Which of the following statements defines a risk policy?*

Finding the level of the risk

Defined probability of the occurrence of an incident

Estimating the damage caused due to occurrence of a disaster

Set of ideas implemented to overcome risks

14. What is a residual risk?*

Risk caused due to a threat exercising vulnerability

Risk resolved with the implementation of possible controls

Risk within the acceptable level of threshold

Risk remaining after implementation of all the possible controls

15. Which one of the following is the correct flow of stages during incident response?*

Identification -> Preparation -> Containment -> Recovery -> Follow-up -> Eradication

Preparation -> Identification -> Containment -> Eradication -> Recovery -> Follow-up

Eradication -> Containment -> Identification -> Preparation -> Recovery -> Follow-up

Containment -> Identification -> Preparation -> Recovery -> Follow-up -> Eradication

16. Which of the following reports contains logs, records, documents, and any other information that is found on a system?*

Incident preparation report

Incident response report

Network-based evidence report

Host-based evidence report

17. Which phase of incident response involves reporting and assessment, event identity and severity level assignment, and incident task force member selection?*

Data collection

Containment

Identification

Incident Classification

18. What following incident response action focuses on limiting the scope and extent of an incident?*

Formulating a response strategy

Eradication

Identification

Containment

19. Which of the following is a process that ensures systems and major applications adhere to formal and established security requirements that are well documented and authorized?*

Computer forensics

Penetration testing

Certification and Accreditation (C&A)

Incident handling

20. Which of the following personnel in incident response team focuses on the incident and handles it from a management and technical point of view?*

Incident Manager (IM)

Incident Coordinator (IC)

Incident Analyst (IA)

Technical Expert

21. Which of the following CSIRT services include alerts and warnings, incident handling, vulnerability handling, and artifact handling activities?*

Proactive Services

Security Quality Management Services

Reactive Services

Vulnerability Management Services

22. What is the purpose of proactive services offered by a CERT?*

To develop the infrastructure and security processes

To find the cost of fixing a problem

None of the above

To provide services to the constituency

23. Which of the following incidents refers to a user performing actions that violate the acceptable computing use policies?*

Distributed Denial-of-Service (DDoS) incident

Multiple Component incident

Unauthorized access incident

Inappropriate usage incident

24. Terry is managing a web server that runs a PHP-based web service. An incident was reported to Terry, where users were not able to access the service. During the investigation, he discovered that the webserver was live and there were no alerts from the anti-malware system. However, in the Task Manager, he discovered a large number of php-cgi processes that were consuming up to ninety-nine percent of the CPU. What can Terry infer from the above observation?*

It indicates a DoS attack

It indicates an unauthorized access attack

It indicates a Trojan attack

It indicates a php-cgi injection attack

25. Hexagon, a leading IT company in the USA received a lot of malformed TCP/IP packets, which led to the crashing of the main server’s operating system. This rendered the organization’s information resources inaccessible to its employees. Which attack did the adversary use in the above situation?*

Man-in-the-Middle

Session Hijacking

Cross-Site-Scripting

DoS attack

26. HDBC’s online banking website was knocked offline. In result, customers were unable to login and make online transactions. After a few hours, the bank authorities identified that a cyber attacker had kept their server busy by establishing simultaneous login sessions which restricted their customers from logging into the bank website. Identify the attack that the cyber attacker has used to draw the bank server offline.*

DoS attack

Session Hijacking

Man-in-the-Middle

Cross-Site-Scripting

27. Riya received the following email: Dear user, Due to an unexpected software glitch, we have lost all our customer details and left with only email IDs. In order to continue our services, we request you provide your username and password in the below fields and revert back. If not, your balance amount will be lost and account will be deleted permanently. Username: _____________ Password: ______________ Click reply and send. Note: Please Forward this mail to all the HDBC users you know. Sorry for the inconvenience. Thank you for your cooperation HDBC Bank Admin </br> Copyright © 2017 Service Providers administrator All rights reserved. After seeing the message, Riya got startled and immediately responded to the sender with her username and password. Later she discovered that her account had been hacked. Which trick did the attacker use to trap Riya?*

Keylogger technique

Sniffing technique

Phishing technique

Pharming technique

28. In which attack does an attacker(s) infect multiple systems called “zombies”, and uses them to attack a particular target?*

Denial of Service

Identity Spoofing

Distributed denial of service

Man-in-the-Middle

29. Which of the following steps do you implement as a part of DoS attack prevention?*

Enable Remote Desktop Connection

Block traffic from unassigned IP address ranges

Install and run packet sniffer on the workstation

Disable Intrusion Detection Systems

30. Which category of unauthorized access is associated with changes in system status?*

Unauthorized Usage of Standard User Account

Unauthorized Data Modification

Unauthorized Data Access

Physical Intruder

31. Which of the following is an indication of unauthorized use of a standard user account?*

Use of a secret account

Misplaced hardware parts

Alert of network and host IDS

Increase in the usage of resource

32. Which of the following incidents refers to a person gaining access to a system and network resources that he or she was not authorized to access?*

Unauthorized Access Incident

Authorized Access Incident

Handling Multiple Component Incidents

Handling Inappropriate Usage Incidents

33. In the DoS containment strategy, at what point will you ask your ISP to implement filtering?*

After relocating the affected target

After determining the method of attack

After correcting the vulnerability or weakness that is being exploited

After identifying the attackers

34. Which of the following malware takes advantage of a file or information transport features on the system to propagate across systems and networks without any human interactions?*

Virus

Worms

Spyware

Trojan

35. Which of the following is the practice of identifying the infected systems by looking for evidence of recent infections?*

Manual identification

Passive identification

Forensic identification

Active identification

36. Roy is a software employee working at Nexawave, a leading IT firm. One day Roy downloaded a few files from the internet and referred to them within a current project. While developing the project document, Roy observed that his MS Word application started crashing frequently. What could be the reason for the above situation?*

Roy’s system has infected by Micro virus

Roy’s system has infected through phishing

Roy’s system has infected by Macro virus

Roy’s system has infected by boot-record infectors

37. Rob, an incident manager, was informed about an incident where a suspicious application was found residing in the active memory of multiple systems on a network. Upon investigating, he learned that the application was self-replicating and degrading the systems performance, but it did not affect the files in those systems. What application is this?*

The application is a Trojan

The application is a Virus

The application is a Worm

The application is a Backdoor

38. Which following malware pretends to be a program that offers useful applications, but acquires the information of your computer and sends it to a remote attacker?*

Rootkit

Spyware

Virus

Worm

39. Which of the following techniques do you implement to respond to an insider attack?*

Place malicious users in a quarantine network

Leave the insider’s computer open in the network

Allow malicious users to access sensitive information

Place all the users in a quarantine network

40. Chris is a forensic expert and was hired by a major financial company for his services supporting computer incidents and crimes. Chris must perform many day-to-day activities as a forensic expert. What duties from the list below are aligned with the role of a forensic expert? I. Uncovering the reason an incident occurred II. Determining the status of the system by analyzing it III. Establishing secure network measures to avoid incidents IV. Preserve, analyze and submit evidence in a court of law*

I, II, and III

I, II, III, and IV

I, II, and IV

II, III, and IV

41. Which of the following is the appropriate process flow in the computer forensics process?*

Analysis -> Preparation -> Collection -> Reporting -> Examination

Preparation -> Analysis -> Collection -> Examination -> Reporting

Examination -> Analysis -> Preparation -> Collection -> Reporting

Preparation -> Collection -> Examination -> Analysis -> Reporting

42. Michael is a forensic expert in an organization based in New York City. As a part of his analysis, he sniffed the data packets that are trying to communicate with the server of the organization while recording and analyzing the event logs. Which type of forensic analysis did Michael perform?*

Source-code forensics

Network Forensics

Data Forensics

Internet Forensics

43. Which of the following refers to the process of identifying, labeling, recording, and acquiring data from all possible sources?*

Analysis

Examination

Collection

Preservation

44. Identify all reasons below that cause organizations to not report computer crimes to law enforcement. I. Fear of negative publicity II. The organization is unaware of the attack III. The organization has the capability to handle the incident internally IV. Potential loss of customers*

I, II, and IV

I, II, II and IV

I and II

I, II, and III

45. What is the process of rebuilding and restoring computer systems affected by an incident to the normal operational stage?*

Incident recovery

Incident handling

Incident reporting

Incident preparation

46. Which of the following is an appropriate process flow of incident recovery steps?*

System validation -> System operations -> System monitoring -> System restoration

System operations -> System restoration -> System validation -> System monitoring

System restoration -> System validation -> System operations -> System monitoring

System operations -> System validation -> System monitoring -> System restoration

47. Which of the following activities identifies the effects of uncontrolled and unspecific events in the business process?*

Temporary plan analysis

Business impact analysis

Support plan analysis

Threat Analysis

48. Which of the following is a set of specific strategies, guidelines, and processes that aids recovery from an incident?*

Temporary plan analysis

Incident recovery testing

Contingency plan

Business impact analysis

49. Which of the following is a methodology to create and validate a plan for maintaining continuous business operations before, during, and after incidents and disruptive events?*

Incident response plan

Business continuity planning

Business impact analysis

Incident recovery plan

50. Which of the following policies controls access to facilities and computers?*

Information Security Policy

Personnel Security Policy

Physical Security Policy

Evidence Collection Policy

Please submit form to see your quiz results.

Name*

First Last

Phone*

Email*

Address*

Country

We care about your data privacy. We will only collect your data via this form if you agree to our terms of use. If you do not agree to the collection of your data, we will not be able to send you the information you have requested.

Certifications

Micro Learning

Executive Team

Governing Committees

Code Of Ethics

Diversity

Global Awards 2022

Pressroom

Accreditations

Career

Contact Us

Become a Trainer

Become a Training Partner

Become an Academic Partner

Become a Reseller

Become a Subject Matter Expert

Become an EC-Council Advisory Board Member

Become a Conference Partner

Become a Media Partner

RESOURCES

NICE Framework Mapping

Store

Certified Member Portal

Training Partner Portal

Have a Question

THOUGHT LEADERSHIP

Hall of Fame 2023

Hall of Fame 2021-2022

Success Stories

Cybersecurity Exchange

Ethical Hacking Leaderboard

What is Cybersecurity

ECIH ASSESSMENT

CAREER TRACKS

Vulnerability Assessment And Penetration Testing (VAPT)

Network Defense And Operation

Digital Forensic

Application Security

Incident Handling And Response

TRENDING CERTIFICATIONS

Certified Ethical Hacker (CEH)

Certified Chief Information Security Officer (CCISO)

Computer Hacking Forensic Investigator (CHFI)

Certified Network Defender (CND)

Certified Incident Handler (ECIH)

Certified Threat Intelligence Analyst (CTIA)

Blockchain Certifications

CUSTOMER SERVICE

Partner With Us

Have A Question

Report Grievance

Training Partner Portal

Bug Bounty Program

Community

COMPANY

About

Contact Us

Careers

Pressroom