EC-Council 212-82 Practice Exams
Last updated on Oct 22,2026- Exam Code: 212-82
- Exam Name: Certified Cybersecurity Technician(C|CT)
- Certification Provider: EC-Council
- Latest update: Oct 22,2026
Kasen, a cybersecurity specialist at an organization, was working with the business continuity and disaster recovery team. The team initiated various business continuity and discovery activities in the organization. In this process, Kasen established a program to restore both the disaster site and the damaged materials to the pre-disaster levels during an incident.
Which of the following business continuity and disaster recovery activities did Kasen perform in the above scenario?
- A . Prevention
- B . Resumption
- C . Response
- D . Recovery
D
Explanation:
Recovery is the business continuity and disaster recovery activity that Kasen performed in the above scenario. Business continuity and disaster recovery (BCDR) is a process that involves planning, preparing, and implementing various activities to ensure the continuity of critical business functions and the recovery of essential resources in the event of a disaster or disruption. BCDR activities can be categorized into four phases: prevention, response, resumption, and recovery. Prevention is the BCDR phase that involves identifying and mitigating potential risks and threats that can cause a disaster or disruption. Response is the BCDR phase that involves activating the BCDR plan and executing the immediate actions to protect people, assets, and operations during a disaster or disruption. Resumption is the BCDR phase that involves restoring the minimum level of services and functions required to resume normal business operations after a disaster or disruption. Recovery is the BCDR phase that involves restoring both the disaster site and the damaged materials to the pre-disaster levels during an incident.
TechSolutions, a leading IT consultancy, has been contracted to overhaul the wireless network infrastructure for the city’s public libraries. With thousands of users accessing the network daily, there is a critical need for robust encryption that can deter potential threats. TechSolutions must also consider the diverse range of devices used by library»goers and ensure backward compatibility.
Which encryption mechanism would best suit this scenario?
- A . WPA3 (Wi-Fi Protected Access 3)
- B . WEP (Wired Equivalent Privacy)
- C . TKIP (Temporal Key Integrity Protocol)
- D . AES-CCMP (Advanced Encryption Standard with Counter Mode Cipher Block Chaining Message Authentication Code Protocol)
A
Explanation:
For TechSolutions to overhaul the wireless network infrastructure for the city’s public libraries, WPA3 is the best choice due to the following reasons:
Security: WPA3 provides enhanced security over previous protocols like WPA2, offering stronger encryption mechanisms and protection against brute-force attacks.
Backward Compatibility: WPA3 ensures compatibility with devices supporting WPA2, making it suitable for diverse devices used by library-goers. Features:
Simultaneous Authentication of Equals (SAE): Enhances security during the handshake process.
Forward Secrecy: Protects past communications even if the current encryption key is compromised.
Improved Encryption: Uses AES-256 in Galois/Counter Mode (AES-GCM) for secure encryption.
Reference: Wi-Fi Alliance WPA3 Overview: Wi-Fi Alliance
Analysis of WPA3 features: ACM Digital Library
A global financial services firm Is revising its cybersecurity policies to comply with a diverse range of international regulatory frameworks and laws. The firm operates across multiple continents, each with distinct legal requirements concerning data protection, privacy, and cybersecurity. As part of their compliance strategy, they are evaluating various regulatory frameworks to determine which ones are most critical to their operations.
Given the firm’s international scope and the nature of its services, which of the following regulatory frameworks should be prioritized for compliance?
- A . ISO 27001 Information Security Management System
- B . ISO 27002 Code of Practice for information security controls
- C . Qceneral Data Protection Regulation (CDPR) – European Union
- D . NIST Cybersecurity Framework
C
Explanation:
GDPR Overview:
The General Data Protection Regulation (GDPR) is a comprehensive data protection law in the European Union that sets out requirements for companies and organizations on collecting, storing, and managing personal data.
Reference: GDPR Regulation (EU) 2016/679.
Global Impact:
GDPR applies to any organization that processes the personal data of EU residents, regardless of where the organization is based. This makes it critical for global firms to comply with GDPR when operating in or serving clients from the EU.
Reference: Article 3 of the GDPR – Territorial Scope.
Compliance Requirements:
GDPR requires strict compliance measures, including data protection by design, data protection impact assessments (DPIAs), appointing a Data Protection Officer (DPO), and ensuring data subjects’ rights.
Reference: Articles 25, 35, and 37 of the GDPR.
Penalties for Non-Compliance:
Non-compliance with GDPR can result in significant fines, up to 20 million or 4% of the annual
global turnover, whichever is higher.
Reference: Article 83 of the GDPR.
Given the firm’s international scope and the critical nature of complying with stringent data protection laws in the EU, prioritizing GDPR compliance is essential.
Cairo, an incident responder. was handling an incident observed in an organizational network. After performing all IH&R steps, Cairo initiated post-incident activities. He determined all types of losses caused by the incident by identifying And evaluating all affected devices, networks, applications, and software. Identify the post-incident activity performed by Cairo in this scenario.
- A . Incident impact assessment
- B . Close the investigation
- C . Review and revise policies
- D . Incident disclosure
A
Explanation:
Incident impact assessment is the post-incident activity performed by Cairo in this scenario. Incident impact assessment is a post-incident activity that involves determining all types of losses caused by the incident by identifying and evaluating all affected devices, networks, applications, and software. Incident impact assessment can include measuring financial losses, reputational damages, operational disruptions, legal liabilities, or regulatory penalties1.
Reference: Incident Impact Assessment
Tristan, a professional penetration tester, was recruited by an organization to test its network infrastructure. The organization wanted to understand its current security posture and its strength in defending against external threats. For this purpose, the organization did not provide any information about their IT infrastructure to Tristan. Thus, Tristan initiated zero-knowledge attacks, with no information or assistance from the organization.
Which of the following types of penetration testing has Tristan initiated in the above scenario?
- A . Black-box testing
- B . White-box testing
- C . Gray-box testing
- D . Translucent-box testing
A
Explanation:
Black-box testing is a type of penetration testing where the tester has no prior knowledge of the target system or network and initiates zero-knowledge attacks, with no information or assistance from the organization. Black-box testing simulates the perspective of an external attacker who tries to find and exploit vulnerabilities without any insider information. Black-box testing can help identify unknown or hidden vulnerabilities that may not be detected by other types of testing. However, black-box testing can also be time-consuming, costly, and incomplete, as it depends on the tester’s skills and tools.
PolarFin. a global finance institution, is in the process of migrating to a new transactional system. Given the sensitivity of financial data and international regulations it adheres to. PolarFin needs an
encryption algorithm that provides strong security and Is also widely accepted Internationally. The algorithm should also support both encryption and decryption functions.
Which cryptographic algorithm should PolarFin consider as its primary choice for this transition?
- A . HMAC (Hash-Based Message Authentication Code)
- B . RSA (Rivest Shamir Adleman)
- C . DES (Data Encryption Standard)
- D . Blowfish
B
Explanation:
RSA Overview:
RSA is a widely accepted and strong public-key cryptographic algorithm that supports both encryption and decryption functions. It is based on the mathematical difficulty of factoring large prime numbers.
Reference: NIST SP 800-57, Recommendation for Key Management.
Strong Security:
RSA provides strong security through its use of large key sizes (typically 2048 bits or higher), making it resistant to brute force and other cryptographic attacks.
Reference: RSA Laboratories’ "PKCS #1: RSA Cryptography Specifications."
International Acceptance:
RSA is widely used and accepted internationally, making it suitable for PolarFin’s requirements to comply with various global financial regulations.
Reference: ISO/IEC 18033-2:2006, Information technology ― Security techniques ― Encryption algorithms.
Encryption and Decryption:
RSA supports secure encryption of data, ensuring confidentiality, and decryption, allowing authorized
parties to access the encrypted information.
Reference: "Applied Cryptography" by Bruce Schneier.
Given the need for strong security and international acceptance, RSA is the best cryptographic algorithm for PolarFin’s new transactional system.
Hayes, a security professional, was tasked with the implementation of security controls for an industrial network at the Purdue level 3.5 (IDMZ). Hayes verified all the possible attack vectors on the IDMZ level and deployed a security control that fortifies the IDMZ against cyber-attacks. Identify the security control implemented by Hayes in the above scenario.
- A . Point-to-po int communication
- B . MAC authentication
- C . Anti-DoS solution
- D . Use of authorized RTU and PLC commands
D
Explanation:
The use of authorized RTU and PLC commands is the security control implemented by Hayes in the above scenario. RTU (Remote Terminal Unit) and PLC (Programmable Logic Controller) are devices that control and monitor industrial processes, such as power generation, water treatment, oil and gas production, etc. RTU and PLC commands are instructions that are sent from a master station to a slave station to perform certain actions or request certain data. The use of authorized RTU and PLC commands is a security control that fortifies the IDMZ (Industrial Demilitarized Zone) against cyber-attacks by ensuring that only valid and authenticated commands are executed by the RTU and PLC devices. Point-to-point communication is a communication method that establishes a direct connection between two endpoints. MAC authentication is an authentication method that verifies the MAC (Media Access Control) address of a device before granting access to a network. Anti-DoS solution is a security solution that protects a network from DoS (Denial-of-Service) attacks by filtering or blocking malicious traffic.
Ashton is working as a security specialist in SoftEight Tech. He was instructed by the management to strengthen the Internet access policy. For this purpose, he implemented a type of Internet access policy that forbids everything and imposes strict restrictions on all company computers, whether it is system or network usage.
Identify the type of Internet access policy implemented by Ashton in the above scenario.
- A . Paranoid policy
- B . Prudent policy
- C . Permissive policy
- D . Promiscuous policy
A
Explanation:
The correct answer is A, as it identifies the type of Internet access policy implemented by Ashton in the above scenario. An Internet access policy is a set of rules and guidelines that defines how an organization’s employees or members can use the Internet and what types of websites or services they can access.
There are different types of Internet access policies, such as:
Paranoid policy: This type of policy forbids everything and imposes strict restrictions on all company computers, whether it is system or network usage. This policy is suitable for organizations that deal with highly sensitive or classified information and have a high level of security and compliance requirements.
Prudent policy: This type of policy allows some things and blocks others and imposes moderate restrictions on company computers, depending on the role and responsibility of the user. This policy is suitable for organizations that deal with confidential or proprietary information and have a medium level of security and compliance requirements.
Permissive policy: This type of policy allows most things and blocks few and imposes minimal restrictions on company computers, as long as the user does not violate any laws or regulations. This policy is suitable for organizations that deal with public or general information and have a low level of security and compliance requirements.
Promiscuous policy: This type of policy allows everything and blocks nothing and imposes no restrictions on company computers, regardless of the user’s role or responsibility. This policy is suitable for organizations that have no security or compliance requirements and trust their employees or members to use the Internet responsibly.
In the above scenario, Ashton implemented a paranoid policy that forbids everything and imposes strict restrictions on all company computers, whether it is system or network usage.
Option B is incorrect, as it does not identify the type of Internet access policy implemented by Ashton in the above scenario. A prudent policy allows some things and blocks others and imposes moderate restrictions on company computers, depending on the role and responsibility of the user. In the above scenario, Ashton did not implement a prudent policy, but a paranoid policy.
Option C is incorrect, as it does not identify the type of Internet access policy implemented by Ashton in the above scenario. A permissive policy allows most things and blocks few and imposes minimal restrictions on company computers, as long as the user does not violate any laws or regulations. In the above scenario, Ashton did not implement a permissive policy, but a paranoid policy.
Option D is incorrect, as it does not identify the type of Internet access policy implemented by Ashton in the above scenario. A promiscuous policy allows everything and blocks nothing and imposes no restrictions on company computers, regardless of the user’s role or responsibility. In the above scenario, Ashton did not implement a promiscuous policy, but a paranoid policy.
Reference: , Section 6.2
Elliott, a security professional, was tasked with implementing and deploying firewalls in the corporate network of an organization. After planning and deploying firewalls in the network, Elliott monitored the firewall logs to detect evolving threats And attacks; this helped in ensuring firewall security and addressing network issues beforehand.
in which of the following phases of firewall implementation and deployment did Elliott monitor the firewall logs?
- A . Deploying
- B . Managing and maintaining
- C . Testing
- D . Configuring
B
Explanation:
Managing and maintaining is the phase of firewall implementation and deployment in which Elliott monitored the firewall logs in the above scenario. A firewall is a system or device that controls and filters the incoming and outgoing traffic between different networks or systems based on predefined rules or policies. A firewall can be used to protect a network or system from unauthorized access, use, disclosure, modification, or destruction. Firewall implementation and deployment is a process that involves planning, installing, configuring, testing, managing, and maintaining firewalls in a network or system. Managing and maintaining is the phase of firewall implementation and deployment that involves monitoring and reviewing the performance and effectiveness of firewalls over time. Managing and maintaining can include tasks such as updating firewall rules or policies, analyzing firewall logs , detecting evolving threats or attacks , ensuring firewall security , addressing network issues , etc. In the scenario, Elliott was tasked with implementing and deploying firewalls in the corporate network of an organization. After planning and deploying firewalls in the network, Elliott monitored the firewall logs to detect evolving threats and attacks; this helped in ensuring firewall security and addressing network issues beforehand. This means that he performed managing and maintaining phase for this purpose. Deploying is the phase of firewall implementation and deployment that involves installing and activating firewalls in the network or system according to the plan. Testing is the phase of firewall implementation and deployment that involves verifying and validating the functionality and security of firewalls before putting them into operation. Configuring is the phase of firewall implementation and deployment that involves setting up and customizing firewalls according to the requirements and specifications.
SecuraCorp, a leading financial institution, is worried about zero-day vulnerabilities. With a sprawling network infrastructure and multiple transaction points, it needs a system that does not solely rely on signatures but can effectively identify suspicious patterns based on the behavior in the network.
Which type of IDS/IPS should SecuraCorp primarily deploy for its needs?
- A . Network-based IDS
- B . Anomaly-based IDS
- C . Signature-based IDS
- D . Host-based IDS
B
Explanation:
SecuraCorp needs an Intrusion Detection System (IDS) that can identify suspicious patterns based on behavior rather than relying solely on known signatures. Here’s why an Anomaly-based IDS is the best fit:
Anomaly-based IDS:
Behavior Analysis: Detects deviations from normal network behavior, which is crucial for identifying zero-day vulnerabilities.
Pattern Recognition: Uses machine learning and statistical methods to identify unusual patterns that might indicate malicious activity.
Advantages: Effective against unknown threats and zero-day exploits because it does not rely on predefined signatures.
Network-based IDS: Primarily monitors network traffic but often relies on signatures, making it less effective against unknown threats.
Signature-based IDS: Relies on a database of known attack signatures, which is not sufficient for detecting new or unknown threats.
Host-based IDS: Monitors individual systems but might not provide a comprehensive view of the
network.
Reference: EC-Council Certified Security Analyst (ECSA) materials.