EC-Council 212-82 Practice Exams
Last updated on Oct 21,2026- Exam Code: 212-82
- Exam Name: Certified Cybersecurity Technician(C|CT)
- Certification Provider: EC-Council
- Latest update: Oct 21,2026
A company decided to implement the cloud infrastructure within its corporate firewall 10 secure sensitive data from external access. The company invested heavily in creating a cloud architecture within its premises to manage full control over its corporate data.
Which of the following types of cloud deployment models did the company implement in this scenario?
- A . Multi cloud
- B . Public cloud
- C . Private cloud
- D . Community cloud
C
Explanation:
Private cloud is the type of cloud deployment model that the company implemented in this scenario. Cloud computing is a model that provides on-demand access to shared and scalable computing resources, such as servers, storage, networks, applications, etc., over the internet or a network. Cloud computing can have different types based on its service or deployment model. A cloud deployment model defines how and where the cloud infrastructure and services are hosted and accessed. A cloud deployment model can have different types, such as public cloud, private cloud, hybrid cloud, community cloud, etc. A private cloud is a type of cloud deployment model that provides exclusive access to cloud infrastructure and services to a single organization or entity. A private cloud can be hosted within or outside the organization’s premises and managed by the organization or a third-party provider. A private cloud can be used to secure sensitive data from external access and maintain full control over the corporate data. In the scenario, the company decided to implement the cloud infrastructure within its corporate firewall to secure sensitive data from external access. The company invested heavily in creating a cloud architecture within its premises to manage full control over its corporate data. This means that the company implemented a private cloud for this purpose. A multi-cloud is not a type of cloud deployment model, but a term that describes a strategy that uses multiple public or private clouds from different providers for different purposes or functions. A public cloud is a type of cloud deployment model that provides open access to cloud infrastructure and services to multiple organizations or entities over the internet. A public cloud can be hosted and managed by a third-party provider that owns and operates the cloud infrastructure and services. A community cloud is a type of cloud deployment model that provides shared access to cloud infrastructure and services to multiple organizations or entities that have common interests or goals
NexaCorp. an enterprise with a robust Linux infrastructure, has been facing consistent downtimes without any apparent reasons. The company’s initial investigation suggests possible unauthorized system-level changes. NexaCorp’s IT team realizes that It needs to monitor and analyze system logs more efficiently to pinpoint the cause.
What would be the optimal approach for NexaCorp to monitor and analyze its Linux system logs to detect and prevent unauthorized changes?
- A . Monitor and analyze the /var/)og/syslog file daily for any unusual activities.
- B . Set up an automated script to send alerts if the last’ command shows unexpected users.
- C . Implement a SIEM system that centralizes, correlates, and analyzes logs in real-time.
- D . Only focus on monitoring SSH logs since most changes likely come through remote access.
C
Explanation:
For NexaCorp to effectively monitor and analyze system logs, implementing a Security Information and Event Management (SIEM) system is the optimal approach:
SIEM Overview: SIEM systems collect, normalize, and analyze log data from various sources in real-
time.
Benefits:
Centralization: Aggregates logs from all systems into a single platform.
Correlation: Identifies patterns and correlates events from different sources to detect anomalies.
Implementation Steps:
Select a SIEM Solution: Choose a suitable SIEM tool (e.g., Splunk, ELK Stack, QRadar).
Integration: Configure the SIEM to collect logs from all relevant systems.
Alerting and Reporting: Set up alerts for suspicious activities and generate periodic reports.
Reference: SIEM Basics: Link
Implementing SIEM: Link
You are the lead cybersecurity specialist at a cutting-edge tech organization that specializes In developing artificial intelligence (Al)products for clients across various sectors. Given the sensitivity and proprietary nature of your products, ensuring top-notch security is of paramount importance. Late one evening, you receive an alert from your threat Intelligence platform about potential vulnerabilities In one of the third-party components your Al products heavily rely upon. This component is known to have integration points with several key systems within your organization. Any successful exploitation of this vulnerability could grant attackers unparalleled access to proprietary algorithms and client-specific modifications, which could be catastrophic in the wrong hands.
While you are analyzing the threat’s details, a member of your team identifies several unusual patterns of data access, suggesting that the vulnerability might already have been exploited. The potential breach’s initial footprint suggests a highly sophisticated actor, possibly even a nation-state entity. Given the gravity of the situation and the potential consequences of a full-blown breach, what should be your immediate course of action to address the incident and ensure minimal risk exposure?
- A . Engage an external cybersecurity consultancy with expertise in nation-state level threats. Collaborate to devise a mitigation strategy while also running parallel investigations to understand the full scope of the breach.
- B . Disconnect the potentially compromised systems from the network, archive all logs and related data for future analysis, and shift core services to backup systems ensuring business continuity.
- C . Alert the organization s legal and PR teams, preparing a communication strategy to notify clients and the public about the potential breach, ensuring transparency and proactive damage control.
- D . Initiate an emergency patching protocol, immediately updating all instances of the vulnerable component across your infrastructure and closely monitor the network for further unusual activities.
B
Explanation:
Immediate Containment:
Disconnecting the compromised systems from the network is crucial to prevent further exploitation and lateral movement by the attackers. This limits their ability to cause additional harm.
Reference: NIST SP 800-61, Computer Security Incident Handling Guide. Preservation of Evidence:
Archiving all logs and related data ensures that crucial evidence is preserved for future forensic analysis. This helps in understanding the attack vector and the scope of the breach.
Reference: ISO/IEC 27037:2012, Guidelines for Identification, Collection, Acquisition, and
Preservation of Digital Evidence.
Business Continuity:
Shifting core services to backup systems ensures that the business operations continue with minimal disruption. This maintains client trust and operational stability.
Reference: NIST SP 800-34, Contingency Planning Guide for Federal Information Systems.
Parallel Investigation:
While the immediate response focuses on containment and continuity, a parallel investigation can be conducted to understand the breach and devise long-term mitigation strategies.
Reference: SANS Incident Handler’s Handbook.
Given the severity and sophistication of the threat, immediate containment, preservation of evidence, and ensuring business continuity are the top priorities.
Kevin, a professional hacker, wants to penetrate CyberTech Inc.’s network. He employed a technique, using which he encoded packets with Unicode characters. The company’s IDS cannot recognize the packet, but the target web server can decode them.
What is the technique used by Kevin to evade the IDS system?
- A . Desynchronization
- B . Obfuscating
- C . Session splicing
- D . Urgency flag
B
Explanation:
Obfuscating is the technique used by Kevin to evade the IDS system in the above scenario. Obfuscating is a technique that involves encoding or modifying packets or data with various methods or characters to make them unreadable or unrecognizable by an IDS (Intrusion Detection System). Obfuscating can be used to bypass or evade an IDS system that relies on signatures or patterns to detect malicious activities. Obfuscating can include encoding packets with Unicode characters, which are characters that can represent various languages and symbols. The IDS system cannot recognize the packet, but the target web server can decode them and execute them normally. Desynchronization is a technique that involves creating discrepancies or inconsistencies between the state of a connection as seen by an IDS system and the state of a connection as seen by the end hosts. Desynchronization can be used to bypass or evade an IDS system that relies on stateful inspection to track and analyze connections. Desynchronization can include sending packets with invalid sequence numbers, which are numbers that indicate the order of packets in a connection. Session splicing is a technique that involves splitting or dividing packets or data into smaller fragments or segments to make them harder to detect by an IDS system. Session splicing can be used to bypass or evade an IDS system that relies on packet size or content to detect malicious activities. Session splicing can include sending packets with small MTU (Maximum Transmission Unit) values, which are values that indicate the maximum size of packets that can be transmitted over a network. An urgency flag is a flag in the TCP (Transmission Control Protocol) header that indicates that the data in the packet is urgent and should be processed immediately by the receiver. An urgency flag is not a technique to evade an IDS system, but it can be used to trigger an IDS system to generate an alert or a response.
An attacker used the ping-of-death (PoD) technique to crash a target Android device. The network traffic was captured by the SOC team and was provided to you to perform a detailed analysis. Analyze the android.pcapng file located In the Documents folder of the Attacker machine-2 and determine the length of PoD packets In bytes. (Practical Question)
- A . 52
- B . 056
- C . 58
- D . 54
D
Explanation:
To determine the length of Ping of Death (PoD) packets in bytes from the provided network traffic
capture (android.pcapng), follow these steps:
Open the Capture File:
Use a network analysis tool like Wireshark to open the android.pcapng file.
Filter for PoD Packets:
Apply filters to isolate ICMP echo request packets (Ping packets) and specifically look for oversized
packets characteristic of a Ping of Death attack.
Analyze Packet Length:
Examine the packet details to determine the length of the packets involved in the attack. PoD packets
are typically malformed and exceed the standard 65,535 bytes limit, but in this case, the length is
identified as 54 bytes.
Reference: Wireshark documentation and usage: Wireshark User Guide
Analysis of Ping of Death attacks: CERT Advisory
A web application, www.moviescope.com, was found to be prone to SQL injection attacks. You are tasked to exploit the web application and fetch the user data. Identify the contact number (Contact) of a user, Steve, in the moviescope database. Note: You already have an account on the web application, and your credentials are sam/test. (Practical Question)
- A . 1-202-509-7316
- B . 1-202-509-7432
- C . 01-202-509-7364
- D . 1-202-509-8421
A
Explanation:
SQL Injection Basics:
SQL injection is a code injection technique that exploits vulnerabilities in an application’s software by inserting malicious SQL statements into an input field for execution.
Reference: OWASP Top Ten Security Risks – A1:2017 Injection.
Exploiting SQL Injection:
To find Steve’s contact number, you need to perform an SQL injection attack to extract the specific data from the database.
Example payload: ‘ OR 1=1; SELECT contact FROM users WHERE name=’Steve’;–
Execution Process:
Log in to the application with the provided credentials (sam/test).
Locate an input field vulnerable to SQL injection, such as a search or login field.
Inject the SQL payload to extract the contact number for Steve.
Extracting Data:
The payload modifies the SQL query executed by the application, making it return the desired data (Steve’s contact number).
Reference: "SQL Injection Attacks and Defense" by Justin Clarke.
After performing the injection and extracting the data, you find that Steve’s contact number is 1-202-509-7316.
Maisie. a new employee at an organization, was given an access badge with access to only the first and third floors of the organizational premises. Maisie Hied scanning her access badge against the badge reader at the second-floor entrance but was unsuccessful. Identify the short-range wireless communication technology used by the organization in this scenario.
- A . RFID
- B . Li-Fi
- C . Bluetooth
- D . Wi Fi
A
Explanation:
RFID (Radio Frequency Identification) is a short-range wireless communication technology that uses radio waves to identify and track objects. RFID tags are attached to objects and RFID readers scan the tags to obtain the information stored in them. RFID is commonly used for access control, inventory management, and identification3.
Reference: What is RFID?
A web application www.movieabc.com was found to be prone to SQL injection attack. You are given a task to exploit the web application and fetch the user credentials. Select the UID which is mapped to user john in the database table.
Note:
Username: sam
Pass: test
- A . 5
- B . 3
- C . 2
- D . 4
D
Explanation:
4 is the UID that is mapped to user john in the database table in the above scenario. SQL injection is a type of web application attack that exploits a vulnerability in a web application that allows an attacker to inject malicious SQL statements into an input field, such as a username or password field, and execute them on the database server. SQL injection can be used to bypass authentication, access or modify sensitive data, execute commands, etc. To exploit the web application and fetch the user credentials, one has to follow these steps:
Open a web browser and type www.movieabc.com
Press Enter key to access the web application.
Enter sam as username and test as password.
Click on Login button.
Observe that a welcome message with username sam is displayed.
Click on Logout button.
Enter sam’ or ‘1’=’1 as username and test as password.
Click on Login button.
Observe that a welcome message with username admin is displayed, indicating that SQL injection was successful.
Click on Logout button.
Enter sam’; SELECT * FROM users; C as username and test as password.
Click on Login button.
Observe that an error message with user credentials from users table is displayed.
The user credentials from users table are:
The UID that is mapped to user john is 4.
An attacker with malicious intent used SYN flooding technique to disrupt the network and gain advantage over the network to bypass the Firewall. You are working with a security architect to design security standards and plan for your organization. The network traffic was captured by the SOC team and was provided to you to perform a detailed analysis. Study the Synflood.pcapng file and determine the source IP address. Note: Synflood.pcapng file is present in the Documents folder of Attacker-1 machine.
- A . 20.20.10.180
- B . 20.20.10.19
- C . 20.20.10.60
- D . 20.20.10.59
B
Explanation:
Jase. a security team member at an organization, was tasked with ensuring uninterrupted business operations under hazardous conditions. Thus, Jase implemented a deterrent control strategy to minimize the occurrence of threats, protect critical business areas, and mitigate the impact of threats.
Which of the following business continuity and disaster recovery activities did Jase perform in this scenario?
- A . Prevention
- B . Response
- C . Restoration
- D . Recovery
A
Explanation:
Prevention is the business continuity and disaster recovery activity performed by Jase in this scenario. Prevention is an activity that involves implementing a deterrent control strategy to minimize the occurrence of threats, protect critical business areas, and mitigate the impact of threats. Prevention can include measures such as backup systems, firewalls, antivirus software, or physical security1.
Reference: Prevention Activity in BCDR