ECCouncil 212-89 - EC Council Certified Incident Handler (ECIH v3)
A ransomware attack recently disrupted operations at a manufacturing facility, specifically targeting its IoT-integrated conveyor system. While attempting to recover from the incident, the incident response team discovered that the available backups were incomplete—several critical sensor logs and control commands were missing, which caused delays in restoring device functions and syncing with other systems. The team concludes that relying on traditional backup routines alone is insufficient for restoring full IoT functionality after an attack. Which strategy would best prevent such issues in future recovery efforts?
Stenley is an incident handler working for Texa Corp. located in the United States. With the growing concern of increasing emails from outside the organization, Stenley was
asked to take appropriate actions to keep the security of the organization intact. In the process of detecting and containing malicious emails, Stenley was asked to check the
validity of the emails received by employees.
Identify the tools he can use to accomplish the given task.
Khai was tasked with examining the logs from a Linux email server. The server uses Sendmail to execute the command to send emailsand Syslog to maintain logs. To validate the data within email headers, which of the following directories should Khai check for information such as source and destination IP addresses, dates, and timestamps?
You are talking to a colleague who Is deciding what information they should include in their organization’s logs to help with security auditing. Which of the following items should you tell them to NOT log?
In response to suspicious communications originating from executive accounts, the organization's response team traced the root cause to spoofed identity relays exploiting unsecured DNS entries. The attack had triggered internal alerts but required deeper remediation to eliminate recurring forged message injections and restore the integrity of interdepartmental mail routing. What action reflects an appropriate eradication strategy in this context?
Logan, an incident handler, ensures the chain of custody is documented while handling backup media post-attack. The goal is to preserve evidence integrity while restoring critical systems. Which recovery principle is Logan adhering to?
During the vulnerability assessment phase, the incident responders perform various
steps as below:
1. Run vulnerability scans using tools
2. Identify and prioritize vulnerabilities
3. Examine and evaluate physical security
4. Perform OSINT information gathering to validate the vulnerabilities
5. Apply business and technology context to scanner results
6. Check for misconfigurations and human errors
7. Create a vulnerability scan report
Identify the correct sequence of vulnerability assessment steps performed by the
incident responders.
An organization notices unusual API activity in its AWS account, suggesting unauthorized access and potential data exfiltration. What is the most critical immediate action to take to mitigate this security incident?
DeltaDynamics, a large-scale data analytics firm, found that one of its data scientists was sharing proprietary algorithms with external parties. The firm wishes to monitor its employees more closely without breaching privacy laws. What is the most effective measure it should consider?
A global retail enterprise operating across multiple e-commerce platforms and physical locations has recently been targeted by a well-orchestrated cyberattack that disrupted transaction processing systems and led to a temporary shutdown of online services. Following the incident, customer confidence dropped, and the board demanded immediate corrective and preventive measures to strengthen cybersecurity resilience. The Chief Information Security Officer (CISO) directed the incident response team to establish a forward-looking approach that not only mitigates such incidents but also ensures that all stakeholders are trained in advance. This includes defining clear roles and responsibilities, creating and training a dedicated response team, conducting simulation exercises, reviewing existing IR tools, auditing organizational assets, and developing a comprehensive set of policies and playbooks. Which phase of the IH&R process should the organization focus on to achieve this?
