EC-Council 212-82 Practice Exams
Last updated on Oct 21,2026- Exam Code: 212-82
- Exam Name: Certified Cybersecurity Technician(C|CT)
- Certification Provider: EC-Council
- Latest update: Oct 21,2026
The SOC department in a multinational organization has collected logs of a security event as "Windows.events.evtx". Study the Audit Failure logs in the event log file located in the Documents folder of the -Attacker Maehine-1" and determine the IP address of the attacker. (Note: The event ID of Audit failure logs is 4625.) (Practical Question)
- A . 10.10.1.12
- B . 10.10.1.10
- C . 10.10.1.16
- D . 10.10.1.19
C
Explanation:
The IP address of the attacker is 10.10.1.16. This can be verified by analyzing the Windows.events.evtx file using a tool such as Event Viewer or Log Parser. The file contains several Audit Failure logs with event ID 4625, which indicate failed logon attempts to the system. The logs show that the source network address of the failed logon attempts is 10.10.1.16, which is the IP address of the attacker3. The screenshot below shows an example of viewing one of the logs using Event Viewer4:
Reference: Audit Failure Log, [Windows.events.evtx], [Screenshot of Event Viewer showing Audit Failure log]
Nicolas, a computer science student, decided to create a guest OS on his laptop for different lab operations. He adopted a virtualization approach in which the guest OS will not be aware that it is running in a virtualized environment. The virtual machine manager (VMM) will directly interact with the computer hardware, translate commands to binary instructions, and forward them to the host OS.
Which of the following virtualization approaches has Nicolas adopted in the above scenario?
- A . Hardware-assisted virtualization
- B . Full virtualization
- C . Hybrid virtualization
- D . OS-assisted virtualization
A
Explanation:
Hardware-assisted virtualization is a virtualization approach in which the guest OS will not be aware that it is running in a virtualized environment. The virtual machine manager (VMM) will directly interact with the computer hardware, translate commands to binary instructions, and forward them to the host OS. Hardware-assisted virtualization relies on special hardware features in the CPU and chipset to create and manage virtual machines efficiently and securely34. Full virtualization is a virtualization approach in which the guest OS will not be aware that it is running in a virtualized environment, but the VMM will run in software and emulate all the hardware resources for each virtual machine5. Hybrid virtualization is a virtualization approach that combines hardware-assisted and full virtualization techniques to optimize performance and compatibility6. OS-assisted virtualization is a virtualization approach in which the guest OS will be modified to run in a virtualized environment and cooperate with the VMM to access the hardware resources
A software company has implemented a wireless technology to track the employees’ attendance by recording their in and out timings. Each employee in the company will have an entry card that is embedded with a tag. Whenever an employee enters the office premises, he/she is required to swipe the card at the entrance. The wireless technology uses radio-frequency electromagnetic waves to transfer data for automatic identification and for tracking tags attached to objects.
Which of the following technologies has the software company implemented in the above scenario?
- A . WiMAX
- B . RFID
- C . Bluetooth
- D . Wi-Fi
B
Explanation:
RFID (Radio Frequency Identification) is the wireless technology that the software company has implemented in the above scenario. RFID uses radio-frequency electromagnetic waves to transfer data for automatic identification and for tracking tags attached to objects1112. WiMAX (Worldwide Interoperability for Microwave Access) is a wireless technology that provides high-speed broadband access over long distances13. Bluetooth is a wireless technology that enables short-range data communication between devices, such as phones, laptops, printers, etc.14. Wi-Fi (Wireless Fidelity) is a wireless technology that allows devices to connect to a local area network or the internet using radio waves
NovusCorp, a leading healthcare provider, had meticulously designed its BC and DR plans, ensuring every potential risk was covered. Recently, its primary data center experienced a catastrophic flood. It swiftly activated its DR plan, transferring operations to its secondary data center. But within 24 hours, the provider faced an unforeseen challenge: the secondary data center began to receive a huge, unprecedented amount of data requests, causing system overloads and disruptions. This situation was not a part of the provider’s initial risk assessment.
In the face of this predicament, what should NovusCorp’s immediate course of action be to ensure business continuity?
- A . Allocate resources to upgrade the secondary data center’s infrastructure to handle the increased data request loads.
- B . Initiate an immediate Tailback to the primary data center despite potential risks.
- C . Engage a cloud based data storage provider for temporary overflow until the primary center is restored.
- D . Reduce non-critical data requests and impose temporary restrictions on data access to maintain system stability.
C
Explanation:
Engaging a cloud-based data storage provider allows NovusCorp to manage the sudden influx of data requests without overloading the secondary data center. Cloud providers can quickly scale resources to meet demand.
Reference: NIST SP 800-146, Cloud Computing Synopsis and Recommendations.
Business Continuity:
Cloud services provide a flexible and reliable solution to maintain business continuity. They offer robust disaster recovery options and can be integrated with existing DR plans.
Reference: ISO/IEC 27017, Code of Practice for Information Security Controls Based on ISO/IEC 27002
for Cloud Services.
Temporary Overflow Solution:
Using cloud storage as a temporary solution ensures that critical operations continue without interruption while the primary data center is restored.
Reference: ENISA’s Guidelines on Cloud Security.
Cost and Time Efficiency:
Cloud-based solutions can be implemented quickly and cost-effectively compared to upgrading the
secondary data center’s infrastructure or other complex solutions.
Reference: "The Economics of Cloud Computing" by Bill Williams.
Given the unexpected load on the secondary data center, engaging a cloud-based data storage provider is the most effective immediate action to ensure business continuity.
As a system administrator handling the integration of a recently acquired subsidiary’s Linux machines with your company’s Windows environment for centralized log management, what is your most significant challenge likely to be?
- A . Dealing with the sheer volume of logs generated by both systems.
- B . Navigating the different user interfaces of the built-in log viewers (Event Viewer vs. Syslog).
- C . Finding skilled personnel proficient in both Windows and Linux log management tools.
- D . Managing the incompatibility of log formats used by Windows and Linux systems.
D
Explanation:
Integrating Linux machines with a Windows environment for centralized log management poses significant challenges, primarily due to the incompatibility of log formats: Log Format Differences:
Windows: Uses Event Viewer to store logs in a proprietary format.
Linux: Uses Syslog to store logs in plain text files with a different structure.
Centralized Management: To achieve effective centralized log management, logs from both systems need to be normalized into a common format.
Solutions:
Log Aggregators: Tools like Logstash or Fluentd can collect, parse, and transform logs from different systems into a unified format.
SIEM Systems: Security Information and Event Management (SIEM) systems like Splunk or ELK Stack can handle log ingestion from multiple sources, normalizing data for analysis.
Reference: SIEM Implementation Guides: Splunk Documentation
Log Management Best Practices: Syslog-ng Documentation
Perform vulnerability assessment of an Android device located at IP address 172.30.20.110. Identify the severity score for the device. You can use the OpenVAS vulnerability scanner, available with Parrot Security, with credentials admln/password for this challenge. (Practical Question)
- A . 2.2
- B . 2.8
- C . 02.6
- D . 2.4
B
Explanation:
Performing a vulnerability assessment on an Android device using OpenVAS involves several steps.
Here’s how to approach this practical task:
OpenVAS Setup: Ensure OpenVAS is installed and properly configured on Parrot Security OS.
Scan Configuration:
Launch OpenVAS and log in using the provided credentials (admin/password).
Navigate to the "Scans" section and create a new task.
Target Specification:
Set the target IP address to 172.30.20.110.
Perform the Scan:
Initiate the scan and wait for it to complete. The duration will depend on the network and device
complexity.
Analyze Results:
Once the scan completes, review the report generated by OpenVAS.
Identify the severity score, which is typically displayed as part of the scan results summary.
Reference: OpenVAS User Guide: Link
Parrot Security documentation: Link
Riley sent a secret message to Louis. Before sending the message, Riley digitally signed the message using his private key. Louis received the message, verified the digital signature using the corresponding key to ensure that the message was not tampered during transit.
Which of the following keys did Louis use to verify the digital signature in the above scenario?
- A . Riley’s public key
- B . Louis’s public key
- C . Riley’s private key
- D . Louis’s private key
A
Explanation:
Riley’s public key is the key that Louis used to verify the digital signature in the above scenario. A digital signature is a cryptographic technique that verifies the authenticity and integrity of a message or document. A digital signature is created by applying a hash function to the message or document
and then encrypting the hash value with the sender’s private key. A digital signature can be verified by decrypting the hash value with the sender’s public key and comparing it with the hash value of the original message or document. Riley’s public key is the key that corresponds to Riley’s private key, which he used to sign the message. Louis’s public key is the key that corresponds to Louis’s private key, which he may use to encrypt or decrypt messages with Riley. Louis’s private key is the key that only Louis knows and can use to sign or decrypt messages. Riley’s private key is the key that only Riley knows and can use to sign or encrypt messages.
An organization’s risk management team identified the risk of natural disasters in the organization’s current location. Because natural disasters cannot be prevented using security controls, the team suggested to build a new office in another location to eliminate the identified risk. Identify the risk treatment option suggested by the risk management team in this scenario.
- A . Risk modification
- B . Risk avoidance
- C . Risk sharing
- D . Risk retention
B
Explanation:
Risk avoidance is the risk treatment option suggested by the risk management team in this scenario. Risk avoidance is a risk treatment option that involves eliminating the identified risk by changing the scope, requirements, or objectives of the project or activity. Risk avoidance can be used when the risk cannot be prevented using security controls or when the risk outweighs the benefits2.
Reference: Risk Avoidance
An organization hired a network operations center (NOC) team to protect its IT infrastructure from external attacks. The organization utilized a type of threat intelligence to protect its resources from evolving threats. The threat intelligence helped the NOC team understand how attackers are expected to perform an attack on the organization, identify the information leakage, and determine the attack goals as well as attack vectors.
Identify the type of threat intelligence consumed by the organization in the above scenario.
- A . Operational threat intelligence
- B . Strategic threat intelligence
- C . Technical threat intelligence
- D . Tactical threat intelligence
C
Explanation:
Technical threat intelligence is a type of threat intelligence that provides information about the technical details of specific attacks, such as indicators of compromise (IOCs), malware signatures, attack vectors, and vulnerabilities. Technical threat intelligence helps the NOC team understand how attackers are expected to perform an attack on the organization, identify the information leakage, and determine the attack goals as well as attack vectors. Technical threat intelligence is often consumed by security analysts, incident responders, and penetration testers who need to analyze and respond to active or potential threats.
You are the Lead Cybersecurity Specialist at GlobalTech, a multinational tech conglomerate renowned for its avant-garde technological solutions in the aerospace and defense sector. The organization’s reputation stands on the innovative technologies it pioneers, many of which are nation’s top secrets.
Late on a Sunday night, you are alerted about suspicious activities on a server holding the schematics and project details for a groundbreaking missile defense system. The indicators suggest a complex, multi-stage cyberattack that managed to bypass traditional security measures. Preliminary investigations reveal that the cybercrlmlnals might have used an Insider’s credentials, further complicating the breach. Given the extremely sensitive nature of the data involved, a leak could have severe national security implications and irreparably tarnish the company’s reputation.
Considering the potential gravity and intricacies of this security incident, what immediate action should you undertake to handle this situation effectively, safeguard crucial data, and minimize potential fallout?
- A . Inform the top executive board and legal team about the breach. Prepare a public statement to ensure shareholders and clients are kept in the loop about the incident and the measures being undertaken.
- B . Initiate the incident response protocol, focusing on immediate containment by isolating the impacted server. Concurrently, assess the breadth and depth of the breach by examining network logs and affected systems.
- C . Notify federal agencies about the potential breach of national security. Work in tandem with them to ensure all necessary measures are taken to prevent further data exfiltration and protect national interests.
- D . Engage with an external specialized cybersecurity firm to conduct a parallel investigation, leveraging its expertise to identify the culprits and understand the breach’s modus operandi.
B
Explanation:
In the event of a cyberattack involving highly sensitive data, such as a missile defense system, the immediate focus should be on containing the breach and understanding its scope.
Here’s a step-by-step approach:
Incident Response Protocol:
Containment: Isolate the impacted server to prevent further unauthorized access or data exfiltration.
This helps to limit the damage and secure sensitive information.
Assessment: Examine network logs, affected systems, and user activities to determine the extent of the breach. This includes identifying how the attackers gained access and what data might have been compromised.
Minimize Fallout:
Preservation of Evidence: Ensure that all logs and forensic data are preserved for a detailed investigation.
Internal Coordination: Inform key stakeholders within the organization, including the executive board and legal team, about the breach and ongoing response efforts.
Collaboration:
Federal Agencies: Depending on the severity and national security implications, notifying federal agencies might be necessary after initial containment and assessment.
External Experts: If required, engage external cybersecurity firms to assist with the investigation and
provide additional expertise.
Reference: NIST Computer Security Incident Handling Guide: NIST SP 800-61r2
SANS Institute Incident Handling Handbook: SANS Reading Room