EC-Council 212-82 Practice Exams
Last updated on Oct 22,2026- Exam Code: 212-82
- Exam Name: Certified Cybersecurity Technician(C|CT)
- Certification Provider: EC-Council
- Latest update: Oct 22,2026
Giovanni, a system administrator, was tasked with configuring permissions for employees working on a new project. Hit organization used active directories (ADs) to grant/deny permissions to resources Giovanni created a folder for AD users with the required permissions and added all employees working on the new project in it. Identify the type of account created by Giovanni in this scenario.
- A . Third-party account
- B . Croup-based account
- C . Shared account
- D . Application account
B
Explanation:
Group-based account is the type of account created by Giovanni in this scenario. An account is a set of credentials, such as a username and a password, that allows a user to access a system or network.
An account can have different types based on its purpose or usage. A group-based account is a type of account that allows multiple users to access a system or network with the same credentials and permissions. A group-based account can be used to simplify the management of users and resources by assigning them to groups based on their roles or functions. In the scenario, Giovanni was tasked with configuring permissions for employees working on a new project. His organization used active directories (ADs) to grant/deny permissions to resources. Giovanni created a folder for AD users with the required permissions and added all employees working on the new project in it. This means that he created a group-based account for those employees. A third-party account is a type of account that allows an external entity or service to access a system or network with limited permissions or scope. A shared account is a type of account that allows multiple users to access a system or network with the same credentials but different permissions. An application account is a type of account that allows an application or software to access a system or network with specific permissions or functions.
Rickson, a security professional at an organization, was instructed to establish short-range communication between devices within a range of 10 cm. For this purpose, he used a mobile connection method that employs electromagnetic induction to enable communication between devices. The mobile connection method selected by Rickson can also read RFID tags and establish Bluetooth connections with nearby devices to exchange information such as images and contact lists.
Which of the following mobile connection methods has Rickson used in above scenario?
- A . NFC
- B . Satcom
- C . Cellular communication
- D . ANT
A
Explanation:
NFC (Near Field Communication) is the mobile connection method that Rickson has used in the
above scenario. NFC is a short-range wireless communication technology that enables devices to exchange data within a range of 10 cm. NFC employs electromagnetic induction to create a radio frequency field between two devices. NFC can also read RFID tags and establish Bluetooth connections with nearby devices to exchange information such as images and contact lists. Satcom (Satellite Communication) is a mobile connection method that uses satellites orbiting the earth to provide communication services over long distances. Cellular communication is a mobile connection method that uses cellular networks to provide voice and data services over wireless devices. ANT is a low-power wireless communication technology that enables devices to create personal area networks and exchange data over short distances.
The IH&R team in an organization was handling a recent malware attack on one of the hosts connected to the organization’s network. Edwin, a member of the IH&R team, was involved in reinstating lost data from the backup media. Before performing this step, Edwin ensured that the backup does not have any traces of malware.
Identify the IH&R step performed by Edwin in the above scenario.
- A . Eradication
- B . Incident containment
- C . Notification
- D . Recovery
D
Explanation:
Recovery is the IH&R step performed by Edwin in the above scenario. IH&R (Incident Handling and Response) is a process that involves identifying, analyzing, containing, eradicating, recovering from, and reporting on security incidents that affect an organization’s network or system. Recovery is the IH&R step that involves restoring the normal operation of the system or network after eradicating the incident. Recovery can include reinstating lost data from the backup media, applying patches or updates, reconfiguring settings, testing functionality, etc. Recovery also involves ensuring that the backup does not have any traces of malware or compromise. Eradication is the IH&R step that involves removing all traces of the incident from the system or network, such as malware, backdoors, compromised files, etc. Incident containment is the IH&R step that involves implementing appropriate measures to stop the infection from spreading to other organizational assets and to prevent further damage to the organization. Notification is the IH&R step that involves informing relevant stakeholders, authorities, or customers about the incident and its impact.
TechTonic, a leading software solution provider, is incorporating stringent cybersecurity measures for their Windows-based server farm. Recently, it noticed a series of unauthorized activities within its systems but could not trace back tot he origins. The company Intends to bolster Its monitoring capabilities by comprehensively analyzing Windows system logs.
Which strategy should TechTonic prioritize to gain an insightful and effective analysis of its Windows logs, aiming to trace potential intrusions?
- A . Implement a centralized logging server and analyze logs using pattern-detection algorithms.
- B . Set up monitoring only for Windows Event Log IDs commonly associated with security breaches.
- C . Routinely back up logs every week and conduct a monthly manual review to detect anomalies.
- D . Focus solely on logs from critical servers, assuming other logs are less consequential.
A
Explanation:
To effectively trace unauthorized activities within TechTonic’s Windows-based server farm, the best
strategy is:
Centralized Logging:
Aggregation: Collect all system logs in a centralized logging server. This ensures that all log data is stored in one place, making it easier to manage and analyze.
Correlation: Correlate logs from different sources to identify patterns and anomalies that might
indicate unauthorized activities.
Pattern-Detection Algorithms:
Automated Analysis: Use algorithms to automatically detect patterns that are indicative of security breaches. This can include machine learning models trained to recognize signs of intrusion. Real-Time Alerts: Set up real-time alerts for suspicious activities identified by the pattern-detection algorithms, enabling swift responses to potential threats.
Reference: Best practices for Windows logging and monitoring: Microsoft Docs
Centralized logging solutions and their benefits: Splunk Documentation
A disgruntled employee transferred highly confidential tender data of upcoming projects as an encoded text. You are assigned to decode the text file snitch.txt located in the Downloads folder of the Attacker Machined and determine the value of the greenfarm project in dollars. Hint 1: All the cryptography tools are located at "Z:CCT-ToolsCCT Module 14 Cryptography". Hint 2: If required, you can use sniffer@123 as the password to decode the file. (Practical Question)
- A . 9S000
- B . 36000
- C . 80000
- D . 75000
D
Explanation:
Decoding the Text File:
Use cryptographic tools located at Z:CCT-ToolsCCT Module 14 Cryptography to decode the text file snitch.txt found in the Downloads folder. The provided password sniffer@123 will be used if required.
Reference: "Cryptography and Network Security" by William Stallings.
Using Decryption Tools:
Employ the appropriate decryption tool from the provided directory to decode the text file and extract the information about the greenfarm project. Extracting the Project Value:
After decoding, the content of the file reveals that the value of the greenfarm project is 75000 dollars.
The decoded value of the greenfarm project is 75000 dollars.
Desmond, a forensic officer, was investigating a compromised machine involved in various online attacks. For this purpose. Desmond employed a forensic tool to extract and analyze computer-based evidence to retrieve information related to websites accessed from the victim machine. Identify the computer-created evidence retrieved by Desmond in this scenario.
- A . Cookies
- B . Documents
- C . Address books
- D . Compressed files
A
Explanation:
Cookies are the computer-created evidence retrieved by Desmond in this scenario. Cookies are small files that are stored on a user’s computer by a web browser when the user visits a website. Cookies can contain information such as user preferences, login details, browsing history, or tracking data. Cookies can be used to extract and analyze computer-based evidence to retrieve information related to websites accessed from the victim machine2.
Reference: Cookies
RevoMedia, a digital marketing agency, often conducts client presentations off-site. The agency’s team uses mobile devices to connect to various networks and display content. With the rising threat landscape, it wants to adopt the most secure method for connecting its mobile devices to unfamiliar networks.
Which of the following should RevoMedia adopt?
- A . Bluetooth pairing
- B . Virtual Private Network (VPN) connections
- C . USB tethering
- D . Direct Wi-Fi connectivity
B
Explanation:
Secure Data Transmission:
VPNs encrypt data transmitted between the mobile device and the network, ensuring that sensitive information is protected from interception and eavesdropping.
Reference: NIST SP 800-77, Guide to IPsec VPNs.
Authentication and Access Control:
VPNs provide strong authentication mechanisms, ensuring that only authorized users can establish a connection. This adds an additional layer of security compared to other methods.
Reference: CIS Controls, Control 12 – Boundary Defense.
Network Privacy:
VPNs mask the user’s IP address and network activity, providing privacy and anonymity when connecting to unfamiliar networks. This is particularly important for protecting against targeted attacks.
Reference: ENISA’s Guidelines for Secure Use of VPNs.
Mitigation of Threats:
By using VPNs, RevoMedia can protect its devices from various network-based attacks, such as man-in-the-middle attacks, which are common on public and unfamiliar networks.
Reference: OWASP Top Ten Network Security Risks.
VPNs offer a comprehensive solution for secure network connectivity, making them the best choice for RevoMedia’s off-site operations.
A software team at an MNC was involved in a project aimed at developing software that could detect the oxygen levels of a person without physical contact, a helpful solution for pandemic situations. For this purpose, the team used a wireless technology that could digitally transfer data between two devices within a short range of up to 5 m and only worked in the absence of physical blockage or obstacle between the two devices, identify the technology employed by the software team in the above scenario.
- A . Infrared
- B . USB
- C . CPS
- D . Satcom
A
Explanation:
Explanation of Correct
Infrared is a wireless technology that can digitally transfer data between two devices within a short range of up to 5 m and only works in the absence of physical blockage or obstacle between the two devices. Infrared is commonly used for remote controls, wireless keyboards, and medical devices.
Reference: Infrared Technology
Stephen, a security professional at an organization, was instructed to implement security measures that prevent corporate data leakage on employees’ mobile devices. For this purpose, he employed a technique using which all personal and corporate data are isolated on an employee’s mobile device. Using this technique, corporate applications do not have any control of or communication with the private applications or data of the employees.
Which of the following techniques has Stephen implemented in the above scenario?
- A . Full device encryption
- B . Geofencing
- C . Containerization
- D . OTA updates
C
Explanation:
Containerization is the technique that Stephen has implemented in the above scenario. Containerization is a technique that isolates personal and corporate data on an employee’s mobile device. Containerization creates separate encrypted containers or partitions on the device, where corporate applications and data are stored and managed. Containerization prevents corporate data leakage on employees’ mobile devices by restricting access, sharing, copying, or transferring of data between containers. Containerization also allows remote wiping of corporate data in case of device loss or theft. Full device encryption is a technique that encrypts all the data on a mobile device using a password or a key. Geofencing is a technique that uses GPS or RFID to define geographical boundaries and trigger actions based on the location of a mobile device. OTA (Over-the-Air) updates are updates that are delivered wirelessly to mobile devices without requiring physical connection to a computer.
Ayden works from home on his company’s laptop. During working hours, he received an antivirus software update notification on his laptop. Ayden clicked on the update button; however, the system restricted the update and displayed a message stating that the update could only be performed by authorized personnel.
Which of the following PCI-DSS requirements is demonstrated In this scenario?
- A . PCI-DSS requirement no 53
- B . PCI-DSS requirement no 1.3.1
- C . PCI-DSS requirement no 5.1
- D . PCI-DSS requirement no 1.3.2
A
Explanation:
PCI-DSS requirement no 5.3 is the PCI-DSS requirement that is demonstrated in this scenario. PCI-DSS
(Payment Card Industry Data Security Standard) is a set of standards that applies to entities that store, process, or transmit payment card information, such as merchants, service providers, or payment processors. PCI-DSS requires them to protect cardholder data from unauthorized access, use, or disclosure. PCI-DSS consists of 12 requirements that are grouped into six categories: build and maintain a secure network and systems, protect cardholder data, maintain a vulnerability management program, implement strong access control measures, regularly monitor and test networks, and maintain an information security policy. PCI-DSS requirement no 5.3 is part of the category “maintain a vulnerability management program” and states that antivirus mechanisms must be actively running and cannot be disabled or altered by users, unless specifically authorized by management on a case-by-case basis for a limited time period. In the scenario, Ayden works from home on his company’s laptop. During working hours, he received an antivirus software update notification on his laptop. Ayden clicked on the update button; however, the system restricted the update and displayed a message stating that the update could only be performed by authorized personnel. This means that his company’s laptop has an antivirus mechanism that is actively running and cannot be disabled or altered by users, which demonstrates PCI-DSS requirement no 5.3.