EC-Council 212-82 Practice Exams
Last updated on Oct 21,2026- Exam Code: 212-82
- Exam Name: Certified Cybersecurity Technician(C|CT)
- Certification Provider: EC-Council
- Latest update: Oct 21,2026
You are the cybersecurity lead for an International financial institution. Your organization offers online banking services to millions of customers globally, and you have recently migrated your core banking system to a hybrid cloud environment to enhance scalability and cost efficiencies.
One evening, after a routine system patch, there is a surge in server-side request forgery (SSRF) alerts from your web application firewall (WAF). Simultaneously, your intrusion detection system (IDS) flags possible attempts to interact with cloud metadata services from your application layer, which could expose sensitive cloud configuration details and API keys. This Is a clear Indication that attackers might be trying to leverage the SSRF vulnerability to breach your cloud infrastructure.
Considering the critical nature of your services and the high stakes involved, how should you proceed to tackle this imminent threat while ensuring minimal disruption to your banking customers?
- A . Engage with a third-party cybersecurity firm specializing in cloud security to conduct an emergency audit, relying on its expertise to identify the root cause and potential breaches.
- B . Rollback the recent patch immediately and inform the cloud service provider about potential unauthorized access to gauge the extent of vulnerability and coordinate a joint response.
- C . Isolate the affected cloud servers and redirect traffic to backup servers, ensuring continuous service while initiating a deep-dive analysis of the suspicious activities using cloud-native security tools.
- D . Notify all banking customers about the potential security incident, urging them to change their passwords and monitor their accounts for any unauthorized activity.
C
Explanation:
In response to the SSRF alerts and potential breach attempts flagged by your IDS, the immediate priority is to contain the threat while maintaining the integrity of your services. Here’s a step-by-step approach:
Isolation and Containment:
Isolate Affected Servers: Disconnect the affected cloud servers from the network to prevent further unauthorized access or data exfiltration.
Redirect Traffic: Redirect incoming traffic to backup servers that are not compromised to ensure that online banking services remain available to customers. Deep-Dive Analysis:
Cloud-Native Security Tools: Utilize cloud-native security tools provided by your cloud service provider (such as AWS GuardDuty, Azure Security Center, or Google Cloud Security Command Center) to conduct a thorough investigation of the suspicious activities.
Examine Network Logs: Analyze network logs to identify the attack vectors and understand the scope of the attack.
Coordinate with Cloud Provider:
Joint Response: Inform your cloud service provider about the incident to collaborate on identifying
and mitigating the vulnerability. Cloud providers often have additional tools and expertise that can
be leveraged during a security incident.
Remediation:
Patch and Harden Systems: Once the root cause is identified, apply necessary patches and harden the security posture of your cloud infrastructure to prevent similar attacks in the future. Communication:
Internal Stakeholders: Keep internal stakeholders, including the executive team and legal department, informed about the incident and the steps being taken to address it.
Reference: NIST Computer Security Incident Handling Guide: NIST SP 800-61r2
AWS Security Best Practices: AWS Documentation
Kaison. a forensic officer, was investigating a compromised system used for various online attacks. Kaison initiated the data acquisition process and extracted the data from the systems DVD-ROM.
Which of the following types of data did Kaison acquire in the above scenario?
- A . Archival media
- B . Kernel statistics
- C . ARP cache
- D . Processor cache
A
Explanation:
Archival media is the type of data that Kaison acquired in the above scenario. Archival media is a type of data that is stored on removable media such as DVD-ROMs, CD-ROMs, tapes, or flash drives. Archival media can be used to backup or transfer data from one system to another. Archival media can be acquired using forensic tools that can read and copy the data from the media4.
Reference: Archival Media
Leo has walked to the nearest supermarket to purchase grocery. At the billing section, the billing executive scanned each product’s machine-readable tag against a readable machine that automatically reads the product details, displays the prices of the individual product on the computer, and calculates the sum of those scanned items. Upon completion of scanning all the products, Leo has to pay the bill.
Identify the type of short-range wireless communication technology that the billing executive has used in the above scenario.
- A . Radio-frequency identification (RFID)
- B . Near-field communication (NFC)
- C . QUIC
- D . QR codes and barcodes
A
Explanation:
Radio-frequency identification (RFID) is the type of short-range wireless communication technology that the billing executive has used in the above scenario. RFID uses radio-frequency electromagnetic waves to transfer data for automatic identification and for tracking tags attached to objects. RFID tags are machine-readable tags that store information about the products, such as name, price, expiry date, etc. RFID readers are readable machines that scan the RFID tags and display the product details on the computer. RFID technology is widely used in supermarkets, warehouses, libraries, and other places where inventory management and tracking are required.
Johnson, an attacker, performed online research for the contact details of reputed cybersecurity firms. He found the contact number of sibertech.org and dialed the number, claiming himself to represent a technical support team from a vendor. He warned that a specific server is about to be compromised and requested sibertech.org to follow the provided instructions. Consequently, he prompted the victim to execute unusual commands and install malicious files, which were then used to collect and pass critical Information to Johnson’s machine.
What is the social engineering technique Steve employed in the above scenario?
- A . Quid pro quo
- B . Diversion theft
- C . Elicitation
- D . Phishing
A
Explanation:
Quid pro quo is the social engineering technique that Johnson employed in the above scenario. Quid pro quo is a social engineering method that involves offering a service or a benefit in exchange for information or access. Quid pro quo can be used to trick victims into believing that they are receiving help or assistance from a legitimate source, while in fact they are compromising their security or privacy. In the scenario, Johnson performed quid pro quo by claiming himself to represent a technical support team from a vendor and offering to help sibertech.org with a server issue, while in fact he prompted the victim to execute unusual commands and install malicious files, which were then used to collect and pass critical information to Johnson’s machine. If you want to learn more about social engineering techniques, you can check out these resources:
[1] A guide to different types of social engineering attacks and how to prevent them: [https://www.csoonline.com/article/2124681/what-is-social-engineering.html]
[2] A video that explains how quid pro quo works and how to avoid falling for it: [https://www.youtube.com/watch?v=3Yy0gZ9xw8g]
[3] A quiz that tests your knowledge of social engineering techniques and scenarios: [https://www.proprofs.com/quiz-school/story.php?title=social-engineering-quiz]
Stella purchased a smartwatch online using her debit card. After making payment for the product through the payment gateway, she received a transaction text message with a deducted and available balance from her bank.
Identify the information security element that ensures that Stella’s transaction status is immediately reflected in her bank account in this scenario.
- A . Non-repudiation
- B . Integrity
- C . Availability
- D . Confidentiality
C
Explanation:
Availability is the information security element that ensures that Stella’s transaction status is immediately reflected in her bank account in this scenario. Information security is the practice of protecting information and information systems from unauthorized access, use, disclosure, modification, or destruction. Information security can be based on three fundamental principles: confidentiality, integrity, and availability. Confidentiality is the principle that ensures that information is accessible only to authorized parties and not disclosed to unauthorized parties. Integrity is the principle that ensures that information is accurate, complete, and consistent and not altered or corrupted by unauthorized parties. Availability is the principle that ensures that information and information systems are accessible and usable by authorized parties when needed. In the scenario, Stella purchased a smartwatch online using her debit card. After making payment for the product through the payment gateway, she received a transaction text message with a deducted and available balance from her bank. This means that her transaction status was immediately reflected in her bank account, which indicates that availability was ensured by her bank’s information system.
You are the chief cybersecurity officer at a multi-national corporation, which specializes in satellite-based communication systems. Recently, you transitioned to a more advanced system architecture that includes multiple ground stations globally. These stations synchronize and communicate via a central hub that manages the distribution of encrypted data across the network. Upon reviewing the quarterly network logs, you uncover a series of sophisticated intrusions. These intrusions are intermittently taking place inground stations located in three continents. Evidence suggests that these attacks are coordinated, aiming to map out the network’s communication paths, likely in preparation for a much larger scale cyber-attack. Further investigation uncovers small pockets of malware within the system, specifically designed to circumvent your current security controls.
Given the criticality of ensuring uninterrupted satellite communication, which countermeasure would be most effective in thwarting these intrusions, ensuring data integrity, and maintaining the operational status of your satellite communication systems?
- A . Enhance end-point security solutions at each ground station, focusing on advanced malware detection, eradication, and prevention.
- B . Implement air-gapped systems for each ground station to ensure complete isolation, minimizing the risk of malware spread and external intrusions.
- C . Deploy an advanced network segmentation strategy, ensuring each ground station operates in a micro-segmented environment, with real-time threat monitoring and dynamic policy adjustments.
- D . Rollback the system to its previous architecture, while launching a thorough investigation into the identified intrusions and taking the necessary legal actions.
C
Explanation:
Network Segmentation:
Network segmentation involves dividing the network into smaller, isolated segments, each with its own security policies and controls. This limits the spread of malware and unauthorized access.
Reference: NIST SP 800-125, Guide to Security for Full Virtualization Technologies. Micro-Segmentation:
Micro-segmentation takes this further by creating even smaller segments within each ground station, ensuring that even if one segment is compromised, the others remain secure.
Reference: VMware NSX Micro-Segmentation Guide.
Real-Time Threat Monitoring:
Deploying real-time threat monitoring allows for the detection and response to threats as they occur, providing a dynamic and adaptive security posture.
Reference: CIS Controls, Control 6 – Maintenance, Monitoring, and Analysis of Audit Logs.
Dynamic Policy Adjustments:
Implementing policies that can adjust in real-time based on detected threats ensures that the network remains resilient against ongoing and evolving attacks.
Reference: IEEE Communications Surveys & Tutorials on Dynamic Network Security Policies.
By adopting an advanced network segmentation strategy with real-time monitoring and dynamic policy adjustments, the corporation can effectively counter sophisticated intrusions and ensure the integrity and operational status of its satellite communication systems.
Martin, a network administrator at an organization, received breaching alerts for an application. He identified that a vulnerability in the application allowed attackers to enter malicious input. Martin evaluated the threat severity and extent of damage that could be caused by this vulnerability. He then escalated the issue to the security management team to determine appropriate mitigation strategies.
In which of the following threat-modeling steps did Martin evaluate the severity level of the threat?
- A . Identify vulnerabilities
- B . Application overview
- C . Risk and impact analysis
- D . Decompose the application
C
Explanation:
Risk and impact analysis is the threat-modeling step in which Martin evaluated the severity level of the threat in the above scenario. Threat modeling is a process that involves identifying, analyzing, and mitigating threats and risks to a system or network. Threat modeling can be used to improve the security and resilience of a system or network by applying various methods or techniques, such as STRIDE, DREAD, PASTA, etc. Threat modeling consists of various steps or phases that perform different tasks or roles. Risk and impact analysis is a threat-modeling step that involves assessing the likelihood and consequences of threats and risks to a system or network. Risk and impact analysis can be used to evaluate the severity level of threats and risks and prioritize them for mitigation. In the scenario, Martin received breaching alerts for an application. He identified that a vulnerability in the application allowed attackers to enter malicious input. Martin evaluated the threat severity and extent of damage that could be caused by this vulnerability. He then escalated the issue to the security management team to determine appropriate mitigation strategies. This means that he performed risk and impact analysis for this purpose. Identify vulnerabilities is a threat-modeling step that involves finding and documenting the weaknesses or flaws in a system or network that can be exploited by threats or risks. Application overview is a threat-modeling step that involves defining and understanding the scope, architecture, components, and functionality of a system or network. Decompose the application is a threat-modeling step that involves breaking down a system or network into smaller and simpler elements, such as data flows, processes, assets, etc.
Brielle. a security professional, was instructed to secure her organization’s network from malicious activities. To achieve this, she started monitoring network activities on a control system that collected event data from various sources. During this process. Brielle observed that a malicious actor had logged in to access a network device connected to the organizational network.
Which of the following types of events did Brielle identify in the above scenario?
- A . Failure audit
- B . Error
- C . Success audit
- D . Warning
C
Explanation:
Success audit is the type of event that Brielle identified in the above scenario. Success audit is a type of event that records successful attempts to access a network device or resource. Success audit can be used to monitor authorized activities on a network, but it can also indicate unauthorized activities by malicious actors who have compromised credentials or bypassed security controls4.
Reference: Success Audit Event
TechTYendz. a leading tech company, is moving towards the final stages of developing a new cloud-based web application aimed at real-time data processing for financial transactions. Given the criticality of data and the high user volume expected. TechTYendz’s security team is keen on employing rigorous application security testing techniques. The team decides to carry out a series of tests using tools that can best mimic potential real-world attacks on the application. The team’s main concern Is to detect vulnerabilities In the system, including those stemming from configuration errors, software bugs, and faulty APIs. The security experts have shortlisted four testing tools and techniques.
Which of the following would be the MOST comprehensive method to ensure a thorough assessment of the application’s security?
- A . Employing dynamic application security testing (DAST) tools that analyze running applications in realtime.
- B . Utilizing static application security testing (SAST) tools to scan the source code for vulnerabilities.
- C . Implementing a tool that combines both SAST and DAST features for a more holistic security overview.
- D . Conducting a manual penetration test focusing only on the user interface and transaction modules.
C
Explanation:
For comprehensive application security testing, combining Static Application Security Testing (SAST)
and Dynamic Application Security Testing (DAST) provides the best coverage:
Static Application Security Testing (SAST):
Source Code Analysis: Scans the source code to identify vulnerabilities such as code injection, buffer overflows, and insecure APIs.
Early Detection: Allows developers to fix vulnerabilities early in the development lifecycle.
Dynamic Application Security Testing (DAST):
Runtime Analysis: Tests the running application for vulnerabilities, including issues related to configuration, authentication, and authorization.
Real-World Attacks: Simulates real-world attacks to identify how the application behaves under
different threat scenarios.
Combined Approach:
Holistic Security: Using both SAST and DAST provides a thorough security assessment, covering both code-level and runtime vulnerabilities.
Comprehensive Coverage: Ensures that both internal code issues and external attack vectors are
addressed.
Reference: OWASP Guide on SAST and DAST: OWASP
NIST Application Security Guidelines: NIST SP 800-53
You have been assigned to perform a vulnerability assessment of a web server located at IP address 20.20.10.26. Identify the vulnerability with a severity score of & A. You can use the OpenVAS vulnerability scanner, available with the Parrot Security machine, with credentials admin/password for this challenge. (Practical Question)
- A . TCP limestamps
- B . FTP Unencrypted Cleartext Login
- C . Anonymous FTP Login Reporting
- D . UDP limestamps
A
Explanation:
TCP Timestamps is the vulnerability with a severity score of 8.0. This can be verified by performing a vulnerability assessment of the web server located at IP address 20.20.10.26 using the OpenVAS vulnerability scanner, available with the Parrot Security machine, with credentials admin/password.
To perform the vulnerability assessment, one can follow these steps:
Launch the Parrot Security machine and open a terminal.
Enter the command sudo openvas-start to start the OpenVAS service and wait for a few minutes until it is ready.
Open a web browser and navigate to https://127.0.0.1:9392 to access the OpenVAS web interface.
Enter the credentials admin/password to log in to OpenVAS.
Click on Scans -> Tasks from the left menu and then click on the blue icon with a star to create a new task.
Enter a name and a comment for the task, such as “Web Server Scan”.
Select “Full and fast” as the scan config from the drop-down menu.
Click on the icon with a star next to Target to create a new target.
Enter a name and a comment for the target, such as “Web Server”.
Enter 20.20.10.26 as the host in the text box and click on Save.
Select “Web Server” as the target from the drop-down menu and click on Save.
Click on the green icon with a play button next to the task name to start the scan and wait for it to finish.
Click on the task name to view the scan report and click on Results from the left menu to see the list of vulnerabilities found.
Sort the list by Severity in descending order and look for the vulnerability with a severity score of 8.0. The screenshot below shows an example of performing these steps: The vulnerability with a severity score of 8.0 is TCP Timestamps, which is an option in TCP packets that can be used to measure round-trip time and improve performance, but it can also reveal information about the system’s uptime, clock skew, or TCP sequence numbers, which can be used by attackers to launch various attacks, such as idle scanning, OS fingerprinting, or TCP hijacking1. The vulnerability report provides more details about this vulnerability, such as its description, impact, solution, references, and CVSS score2.
Reference: Screenshot of OpenVAS showing TCP Timestamps vulnerability, TCP Timestamps Vulnerability, Vulnerability Report