Detailed Guide on 212-89 Areas

The first tested area is focused on incident handling and response. Thus, the candidates should know how to deal with computer security, information security, and security policies. Moreover, you will also learn about risk management in incident response and threat intelligence. Incident handling is also part of the tested area. Finally, the candidates should possess in-depth knowledge of how information security is implemented to resolve the issues related to security.

When it comes to the second category, it focuses on email security incidents. Particularly, this area involves email security features as well as various email incidents. Also, the candidate's knowledge of how suspicious emails are is measured in such a topic. Besides, you will also need to identify phishing emails as well as to detect deceptive emails to be successful in this domain.

As you remember, the third objective involves process handling. It describes the incident readiness, security auditing, and incident handling alongside response. The candidate will also get knowledge about how to do forensic investigation for incident handling. The eradication and recovery are also included in the exam syllabus.

The fourth section defines application-level incidents. It deals with web application vulnerabilities and threats. Here, you will also be able to identify the web attacks that occur in the application. Finally, it involves the eradication of the web application.

The fifth tested area focuses on mobile & network incidents. It allows the candidates to learn about illegal access, denial-of-service, and wireless networks. You will also come across network attacks, unsuitable usage, and mobile platform risks and vulnerabilities. Moreover, the abolition of mobile recovery and incidents is also part of the official exam.

The sixth domain includes malware incidents. Particularly, it describes the malware as a whole, malicious codes, and malware incidents. What's more, you will learn information about malware facets and how it affects the information system and applications.

The seventh objective revolves around insider threats. It defines insider threat particularities and how to detect and prevent them. Within such a section, you will also get to know about the employee monitoring tools and insider threats eradication.

The eighth area focuses on cloud environment incidents. It involves the security of cloud computing and cloud computing threats. Plus, you will learn about recovery in the cloud and the eradication threats in this area of 212-89 exam. Mainly, the candidate's knowledge about incidents occurring in a cloud environment is assessed during such a test.

The ninth portion is first response and forensic readiness. It focuses on digital evidence, forensic readiness, and volatile evidence. You will also be tested upon computer forensics, the protection of electronic evidence, and static evidence. On top of these, the candidate should also have knowledge of anti-forensics for attempting the final test.

The content of the exam for the EC-Council Certified Incident Handler certification revolves around nine domains. They all have different weights in the content. The specific knowledge and skills as well as percentage share of questions related to each subject area of EC-Council 212-89 are outlined below:

• Network and Mobile Incidents (16%). This section comes with the individuals’ knowledge of inappropriate usage; network attacks; Denial-of-Service; unauthorized access; wireless network; eradication of mobile incidents and recovery; mobile platform vulnerabilities and risks.
• Insider Threats (7%). To deal with the questions from this domain, the learners should be conversant with insider threats; eradication; employee monitoring tools; detecting and preventing insider threats.
• Incidents Occurred in a Cloud Environment (8%). The last topic focuses on Cloud computing threats; eradication; security in Cloud computing; recovery in Cloud.
• Email Security Incidents (10%). Here the examinees need to show good comprehension of email security as well as familiarity with deceptive and suspicious email; email incident; phishing email.
• Malware Incidents (8%). In the framework of this area, the students are required to be aware of malware, malware incident triage, as well as malicious code.
• Process Handling (14%). Within this domain, the applicants need to demonstrate competency in security auditing; incident handling and response; incident readiness; forensic investigation; security incidents; eradication and recovery.
• Application Level Incidents (8%). The objective entails your knowledge of web application threats and vulnerabilities; web attacks; eradication of web applications.
• Incident Response and Handling (16%). This topic requires a solid understanding of information security; threat intelligence; computer security; risk management; incident handling; security policies.
• Forensic Readiness and First Response (13%). This subject area encompasses an understanding of digital evidence; forensic readiness; computer forensics; volatile evidence; preservation of electronic evidence anti-forensics; static evidence.

Reference: https://www.eccouncil.org/programs/ec-council-certified-incident-handler-ecih/