Chapter 8 of 8 · EC-Council 312-38
Incident Prediction
Risk and vulnerability management, attack surface, threat intelligence and hunting, worth 15%.
- 4topics
- 20 minfast track
- 2diagrams and exhibits
- 15%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Risk Management and Risk Management FrameworksLearn risk management concepts, the risk program lifecycle, treatment options and frameworks such as NIST RMF, ISO 31000 and…Diagram4 min
- 2Vulnerability Management, Assessment, Scanning and PIALearn the vulnerability management program, vulnerability assessment and scanning, CVSS scoring and the Privacy Impact Assessment…Diagram5 min
- 3Attack Surface Analysis, Exposures, Simulation and ReductionLearn attack surface analysis and visualization, indicators of exposure, attack simulation and how to reduce the attack surface…5 min
- 4Threat Intelligence, IoCs, IoAs and Threat HuntingLearn cyber threat intelligence types, IoCs versus IoAs, how to consume intelligence for proactive defense, and how threat…6 min
About this chapter
What this chapter covers
Incident Prediction is 15% of the EC-Council CND 312-38 exam. It covers risk management and its frameworks, vulnerability management and scanning, privacy impact assessment, attack surface analysis, attack simulation, cyber threat intelligence, indicators and threat hunting.
Questions are single-answer multiple choice, often "Which of the following" and short named scenarios. You are asked to choose the right method for finding and reducing risk before an attack happens.
It has 17 outline topics, and four pages cover them.
How the topics fit together
Prediction moves from understanding risk to finding weaknesses, shrinking exposure and watching for adversaries.
- Risk and vulnerability pages show how to rank and fix weaknesses.
- The attack surface page shows how to map, test and shrink exposure.
- The intelligence and hunting page shows how to use knowledge of adversaries to detect them sooner.
Keep IoE, IoC and IoA apart. Exposure means open to attack, compromise means already hit, and attack means happening now.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorize.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Try to name the correct term for each short scenario before reading the answer. The exam often describes an activity and asks what it is called.
Ready for more practice?
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.