EC-Council 212-82 Practice Exams
Last updated on Oct 21,2026- Exam Code: 212-82
- Exam Name: Certified Cybersecurity Technician(C|CT)
- Certification Provider: EC-Council
- Latest update: Oct 21,2026
Tenda, a network specialist at an organization, was examining logged data using Windows Event Viewer to identify attempted or successful unauthorized activities. The logs analyzed by Tenda include events related to Windows security; specifically, log-on/log-off activities, resource access, and also information based on Windows system’s audit policies. Identify the type of event logs analyzed by Tenda in the above scenario.
- A . Application event log
- B . Setup event log
- C . Security event log
- D . System event log
C
Explanation:
Security event log is the type of event log analyzed by Tenda in the above scenario. Windows Event Viewer is a tool that displays logged data about various events that occur on a Windows system or network. Windows Event Viewer categorizes event logs into different types based on their source and purpose. Security event log is the type of event log that records events related to Windows security; specifically, log-on/log-off activities, resource access, and also information based on Windows system’s audit policies. Security event log can help identify attempted or successful unauthorized activities on a Windows system or network. Application event log is the type of event log that records events related to applications running on a Windows system, such as errors, warnings, or information messages. Setup event log is the type of event log that records events related to the installation or removal of software or hardware components on a Windows system. System event log is the type of event log that records events related to the operation of a Windows system or its components, such as drivers, services, processes, etc.
You recently purchased a smart thermostat for your home. It allows you to control the temperature remotely through a mobile app. Considering the security of your new smart thermostat, which of the following actions would be the LEAST effective
In protecting It from unauthorized access?
- A . Keeping the thermostat firmware updated with the latest security patches from the manufacturer.
- B . Leaving the thermostat connected to the "Guest" Wi-Fi network in your home, which is open to all guests.
- C . Changing the default password for the mobile app and thermostat upon initial setup.
- D . Enabling remote access to the thermostat only on your secure home Wi-Fi network.
B
Explanation:
Leaving the thermostat connected to the "Guest" Wi-Fi network, which is open to all guests, is the least effective action in protecting it from unauthorized access.
Here is a detailed explanation: Network Segmentation:
A guest Wi-Fi network is typically designed to provide internet access to visitors without granting access to the main network or its devices. However, if the guest network is open (i.e., no password), it poses significant security risks.
Reference: CIS Controls, Control 13 – Network Monitoring and Defense.
Unauthorized Access:
An open guest network allows anyone within range to connect, increasing the risk of unauthorized access to the thermostat. This can lead to potential misuse, tampering, or even entry points for further attacks on your network.
Reference: NIST SP 800-153, Guidelines for Securing Wireless Local Area Networks (WLANs).
Best Practices for IoT Devices:
IoT devices, such as smart thermostats, should be connected to a secure and encrypted network to prevent unauthorized access and ensure data privacy.
Reference: OWASP IoT Top Ten, which lists “Insecure Network Services” as a major risk.
Firmware Updates:
Keeping the thermostat firmware updated with the latest security patches from the manufacturer (Option A) is crucial for protecting against known vulnerabilities.
Reference: Best practices for IoT device security, including regular updates.
Password Management:
Changing the default password for the mobile app and thermostat upon initial setup (Option C) ensures that default credentials, which are often publicly known, are not exploited.
Reference: NIST Special Publication 800-63B, Digital Identity Guidelines. Secure Network Configuration:
Enabling remote access to the thermostat only on your secure home Wi-Fi network (Option D) limits access to authorized users and devices, reducing the risk of unauthorized access.
Reference: CIS Controls, Control 16 – Account Monitoring and Control.
Initiate an SSH Connection to a machine that has SSH enabled in the network. After connecting to the machine find the file flag.txt and choose the content hidden in the file.
Credentials for SSH login are provided below:
Hint:
Username: sam
Password: admin@l23
- A . sam@bob
- B . bob2@sam
- C . bob@sam
- D . sam2@bob
C
Explanation:
Quid pro quo is the social engineering technique that Johnson employed in the above scenario. Social engineering is a technique that involves manipulating or deceiving people into performing actions or revealing information that can be used for malicious purposes. Social engineering can be performed through various methods, such as phone calls, emails, websites, etc. Quid pro quo is a social engineering method that involves offering a service or a benefit in exchange for information or access. Quid pro quo can be used to trick victims into believing that they are receiving help or assistance from a legitimate source, while in fact they are compromising their security or privacy. In the scenario, Johnson performed quid pro quo by claiming himself to represent a technical support team from a vendor and offering to help sibertech.org with a server issue, while in fact he prompted the victim to execute unusual commands and install malicious files, which were then used to collect and pass critical information to Johnson’s machine. Diversion theft is a social engineering method that involves diverting the delivery or shipment of goods or assets to a different location or destination. Elicitation is a social engineering method that involves extracting information from a target by engaging them in a conversation or an interaction. Phishing is a social engineering method that involves sending fraudulent emails or messages that appear to come from a trusted source, such as a bank, a company, or a person, and asking the recipient to click on a link, open an attachment, or provide personal or financial information.
Elliott, a security professional, was appointed to test a newly developed application deployed over an organizational network using a Bastion host. Elliott initiated the process by configuring the nonreusable bastion host. He then tested the newly developed application to identify the presence of security flaws that were not yet known; further, he executed services that were not secure. identify the type of bastion host configured by Elliott in the above scenario.
- A . External services hosts
- B . Victim machines
- C . One-box firewalls
- D . Non-routing dual-homed hosts
D
Explanation:
Non-routing dual-homed hosts are the type of bastion hosts configured by Elliott in the above scenario. A bastion host is a system or device that is exposed to the public internet and acts as a gateway or a proxy for other systems or networks behind it. A bastion host can be used to provide an additional layer of security and protection for internal systems or networks from external threats and attacks. A bastion host can have different types based on its configuration or functionality. A non-routing dual-homed host is a type of bastion host that has two network interfaces: one connected to the public internet and one connected to the internal network. A non-routing dual-homed host does not allow any direct communication between the two networks and only allows specific services or applications to pass through it. A non-routing dual-homed host can be used to isolate and secure internal systems or networks from external access. In the scenario, Elliott was appointed to test a newly developed application deployed over an organizational network using a bastion host. Elliott initiated the process by configuring the non-reusable bastion host. He then tested the newly developed application to identify the presence of security flaws that were not yet known; further, he executed services that were not secure. This means that he configured a non-routing dual-homed host for this purpose. An external services host is a type of bastion host that provides external services, such as web, email, FTP, etc., to the public internet while protecting internal systems or networks from direct access. A victim machine is not a type of bastion host, but a term that describes a system or device that has been compromised or infected by an attacker or malware. A one-box firewall is not a type of bastion host, but a term that describes a firewall that performs both packet filtering and application proxy functions in one device .
Malachi, a security professional, implemented a firewall in his organization to trace incoming and outgoing traffic. He deployed a firewall that works at the session layer of the OSI model and monitors the TCP handshake between hosts to determine whether a requested session is legitimate. Identify the firewall technology implemented by Malachi in the above scenario.
- A . Next generation firewall (NGFW)
- B . Circuit-level gateways
- C . Network address translation (NAT)
- D . Packet filtering
B
Explanation:
A circuit-level gateway is a type of firewall that works at the session layer of the OSI model and monitors the TCP handshake between hosts to determine whether a requested session is legitimate. It does not inspect the contents of each packet, but rather relies on the session information to filter traffic
A disgruntled employee has set up a RAT (Remote Access Trojan) server in one of the machines in the target network to steal sensitive corporate documents. The IP address of the target machine where
the RAT is installed is 20.20.10.26. Initiate a remote connection to the target machine from the "Attacker Machine-1" using the Theef client. Locate the "Sensitive Corporate Documents" folder in the target machine’s Documents directory and determine the number of files. Mint: Theef folder is located at Z:CCT-ToolsCCT Module 01 Information Security Threats and VulnerabilitiesRemote Access Trojans (RAT)Theef of the Attacker Machine1.
- A . 2
- B . 4
- C . 5
- D . 3
B
Explanation:
The number of files in the “Sensitive Corporate Documents” folder is 4. This can be verified by initiating a remote connection to the target machine from the “Attacker Machine-1” using Theef client. Theef is a Remote Access Trojan (RAT) that allows an attacker to remotely control a victim’s machine and perform various malicious activities. To connect to the target machine using Theef client, one can follow these steps:
Launch Theef client from Z:CCT-ToolsCCT Module 01 Information Security Threats and VulnerabilitiesRemote Access Trojans (RAT)Theef on the “Attacker Machine-1”. Enter the IP address of the target machine (20.20.10.26) and click on Connect.
Wait for a few seconds until a connection is established and a message box appears saying “Connection Successful”.
Click on OK to close the message box and access the remote desktop of the target machine. Navigate to the Documents directory and locate the “Sensitive Corporate Documents” folder. Open the folder and count the number of files in it. The screenshot below shows an example of performing these steps:
Reference: [Theef Client Tutorial], [Screenshot of Theef client showing remote desktop and folder]
You work in a Multinational Company named Vector Inc. on Hypervisors and Virtualization Software. You are using the Operating System (OS) Virtualization and you have to handle the Security risks
associated with the OS virtualization.
How can you mitigate these security risks?
- A . All of the above
- B . Implement least privilege access control for users managing VMs.
- C . Regularly patch and update the hypervisor software for security fixes.
- D . Disable security features on virtual machines to improve performance.
A
Explanation:
Mitigating security risks associated with OS virtualization involves a comprehensive approach. Here’s a breakdown of the steps:
Implement Least Privilege Access Control for Users Managing VMs:
Limit access to only those users who need it.
Ensure that users have only the permissions necessary to perform their tasks.
Regularly Patch and Update the Hypervisor Software for Security Fixes:
Keep the hypervisor and virtualization software up-to-date to protect against known vulnerabilities.
Regular patching minimizes the risk of exploitation.
Disable Security Features on Virtual Machines to Improve Performance:
Note: This is actually a security risk. The correct approach is to enable and configure security features to protect VMs, despite the potential minor impact on performance.
Comprehensive Approach:
A holistic security strategy includes enforcing least privilege, maintaining updated systems, and enabling security features on VMs to protect against a wide range of threats.
Reference: EC-Council Certified Ethical Hacker (CEH) materials.
Best practices for virtualization security from NIST and other cybersecurity frameworks.
A software company is developing a new software product by following the best practices for secure application development. Dawson, a software analyst, is checking the performance of the application on the client’s network to determine whether end users are facing any issues in accessing the application.
Which of the following tiers of a secure application development lifecycle involves checking the performance of the application?
- A . Development
- B . Testing
- C . Quality assurance (QA)
- D . Staging
B
Explanation:
The testing tier of a secure application development lifecycle involves checking the performance of the application on the client’s network to determine whether end users are facing any issues in accessing the application. Testing is a crucial phase of software development that ensures the quality, functionality, reliability, and security of the application. Testing can be done manually or automatically using various tools and techniques, such as unit testing, integration testing, system testing, regression testing, performance testing, usability testing, security testing, and acceptance testing
Henry Is a cyber security specialist hired by BlackEye – Cyber security solutions. He was tasked with discovering the operating system (OS) of a host. He used the Unkornscan tool to discover the OS of the target system. As a result, he obtained a TTL value, which Indicates that the target system is running a Windows OS. Identify the TTL value Henry obtained, which indicates that the target OS is Windows.
- A . 64
- B . 128
- C . 255
- D . 138
B
Explanation:
128 is the TTL value that Henry obtained, which indicates that the target OS is Windows. TTL (Time to Live) is a field in the IP (Internet Protocol) header that specifies how long a packet can remain in a network before it is discarded or dropped. TTL is usually expressed in seconds or hops (the number of routers or gateways that a packet passes through). TTL is used to prevent packets from looping endlessly in a network or consuming network resources. Different operating systems have different default TTL values for their packets. By observing the TTL value of a packet from a target system or network, one can infer the operating system of the target.
Some common TTL values and their corresponding operating systems are:
64: Linux, Unix, Android
128: Windows
255: Cisco IOS
60: Mac OS
In the scenario, Henry used Nmap tool to discover the OS of the target system. Nmap (Network Mapper) is a tool that can perform various network scanning and enumeration tasks, such as port scanning, OS detection, service identification, etc. Nmap can use various techniques to detect the OS of a target system, such as TCP/IP fingerprinting, which involves analyzing various TCP/IP characteristics of packets from the target system, such as TTL value. In the scenario, Henry obtained a TTL value of 128 , which indicates that the target OS is Windows.
Shawn, a forensic officer, was appointed to investigate a crime scene that had occurred at a coffee shop. As a part of investigation, Shawn collected the mobile device from the victim, which may contain potential evidence to identify the culprits.
Which of the following points must Shawn follow while preserving the digital evidence? (Choose three.)
- A . Never record the screen display of the device
- B . Turn the device ON if it is OFF
- C . Do not leave the device as it is if it is ON
- D . Make sure that the device is charged
B, C, D
Explanation:
Turn the device ON if it is OFF, do not leave the device as it is if it is ON, and make sure that the device is charged are some of the points that Shawn must follow while preserving the digital evidence in the above scenario. Digital evidence is any information or data stored or transmitted in digital form that can be used in a legal proceeding or investigation. Digital evidence can be found on various devices, such as computers, mobile phones, tablets, etc. Preserving digital evidence is a crucial step in forensic investigation that involves protecting and maintaining the integrity and authenticity of digital evidence from any alteration or damage. Some of the points that Shawn must follow while preserving digital evidence are:
Turn the device ON if it is OFF: If the device is OFF, Shawn must turn it ON to prevent any data loss or encryption that may occur when the device is powered off. Shawn must also document any password or PIN required to unlock or access the device.
Do not leave the device as it is if it is ON: If the device is ON, Shawn must not leave it as it is or use it for any purpose other than preserving digital evidence. Shawn must also disable any network connections or communication features on the device, such as Wi-Fi, Bluetooth, cellular data, etc., to prevent any remote access or deletion of data by unauthorized parties.
Make sure that the device is charged: Shawn must ensure that the device has enough battery power to prevent any data loss or corruption that may occur due to sudden shutdown or low battery. Shawn must also use a write blocker or a Faraday bag to isolate the device from any external interference or signals.
Never record the screen display of the device is not a point that Shawn must follow while preserving digital evidence. On contrary, Shawn should record or photograph the screen display of the device to capture any relevant information or messages that may appear on the screen. Recording or photographing the screen display of the device can also help document any changes or actions performed on the device during preservation.