ECCouncil 212-89 - EC Council Certified Incident Handler (ECIH v3)

This question is based on the shared responsibility model, a fundamental concept in ECIH cloud incident handling. While customers manage applications, configurations, and data, the cloud service provider (CSP) controls the underlying infrastructure, including orchestration engines, schedulers, and runtime environments.

System-level telemetry such as hypervisor activity and orchestration logs cannot be accessed by customers. Only the CSP can provide this visibility. Therefore, Option C is correct.

The other options manage higher-level responsibilities but lack authority over infrastructure-layer components.

This scenario exemplifies a classic malicious insider threat, where a trusted employee with legitimate access abuses their privileges. According to the EC-Council ECIH curriculum, traditional perimeter controls and static access restrictions are often ineffective against insiders because the actions appear legitimate at a surface level. Therefore, the primary emphasis must be on behavior-based detection.

Option D is correct because behavioral analytics enables organizations to establish baselines of normal employee behavior and identify deviations such as unusual access times, excessive data downloads, atypical system usage, or abnormal data transfer patterns. ECIH highlights behavioral monitoring as a critical control for detecting insider threats early, especially when access credentials are valid and authorized.

Option A may limit productivity and does not detect malicious intent. Option B is an administrative practice with limited security value. Option C improves awareness but does not detect deliberate malicious behavior.

By implementing behavioral analytics, ClobalTech can identify subtle indicators of insider misuse, respond earlier, and reduce the impact of long-term data exfiltration, aligning with ECIH best practices for insider threat mitigation.

This scenario requires decisive action across containment, analysis, and recovery, as defined in the ECIH incident handling lifecycle.

Option C is correct because isolating affected systems prevents further manipulation, forensic examination identifies scope and method, and restoring from a verified clean backup ensures data integrity. ECIH emphasizes verified restoration only after investigation begins.

Options A, B, and D are premature or speculative and risk misinformation.

The EC-Council Incident Handler (ECIH) curriculum defines drive-by download attacks as web-based attacks where malicious code is automatically executed when a user visits a compromised website. These attacks often exploit browser or rendering engine vulnerabilities without requiring user interaction or explicit file downloads.

In this scenario, trusted informational websites were covertly modified to include obfuscated scripts that executed upon page rendering. The exploit chains targeted unpatched vulnerabilities and injected payloads directly into memory, avoiding file creation and traditional detection mechanisms. This behavior is characteristic of drive-by download attacks leveraging exploit kits.

Option A involves email-based delivery, which is not described. Option B relates to manipulating search engine rankings but does not inherently describe memory-based exploit execution. Option D involves malicious advertisements; however, the scenario specifically references compromised websites rather than third-party ad platforms.

ECIH emphasizes patch management, browser hardening, memory analysis, and exploit mitigation technologies to defend against drive-by downloads. Therefore, the most consistent technique is a drive-by download attack exploiting vulnerabilities.

URL encoding, also known as percent-encoding, is a mechanism for encoding information in a Uniform Resource Identifier (URI) under certain circumstances. This technique involves replacing unsafe ASCII characters with a "%" followed by two hexadecimal digits that represent the character's ASCII code. This is necessary for embedding characters that are not allowed in URLs directly, such as spaces and symbols, or characters that have special meanings within URLs, ensuring that the URL is correctly interpreted by web browsers and servers.

The GPG18 and Forensic readiness planning (SPF) principles outline various guidelines to enhance an organization's readiness for forensic investigation and response. Principle 5, which suggests that organizations should adopt a scenario-based Forensic Readiness Planning approach that learns from experience gained within the business, emphasizes the importance of being prepared for a wide range of potential incidents by leveraging lessons learned from past experiences. This approach helps in continuously improving forensic readiness and response capabilities by adapting to the evolving threat landscape and organizational changes.

Eradication is the phase in the incident response process where the root cause of an incident is removed or eliminated, and all attack vectors are closed to prevent similar incidents in the future. This step follows the containment phase, where the immediate threat is isolated to prevent further damage, and precedes the recovery phase, where normal operations are restored. Eradication involves thoroughly removing malware, unauthorized access mechanisms, or any other elements used in the attack, and securing any vulnerabilities that were exploited. The goal is to ensure that the threat cannot re-emerge and that the systems are secure before they are returned to operational status.

Threat correlation is a method used by incident responders to analyze and associate various indicators of compromise (IoCs) and alerts to identify genuine threats. By correlating data from multiple sources and applying intelligence to distinguish between unrelated events and coordinated attack patterns, responders can significantly reduce the rate of false-positive alerts. This enables teams to prioritize their efforts on the most critical and likely threats, thereby reducing potential risks and corporate liabilities. Effective threat correlation involves the use of sophisticated security information and event management (SIEM) systems, threat intelligence platforms, and analytical techniques to identify relationships between seemingly disparate security events and alerts.

The EC-Council Incident Handler (ECIH) curriculum explains that certain advanced mobile malware strains embed themselves as background services configured to restart automatically upon reboot. In such cases, traditional antivirus scans may fail to fully remove the threat because the malicious service remains active.

Switching the mobile device to safe mode (or emergency mode) prevents third-party applications and background services from automatically launching during startup. This isolates the malicious process and prevents it from reinitializing, allowing responders to perform forensic analysis and removal without triggering additional payload execution or data exfiltration.

ECIH emphasizes that during malware eradication, responders must prevent the malware from executing while conducting cleanup procedures. Safe mode supports controlled analysis and minimizes risk during remediation.

Option B (lost device tracking) is a monitoring measure, not an eradication technique. Option C (revoking cloud permissions) is relevant to access control but does not remove embedded malware. Option D (network scans) supports broader investigation but does not directly eliminate the persistent mobile threat.

ECIH guidance for malware eradication includes isolating infected devices, disabling malicious processes, applying clean firmware or OS reinstallation if necessary, and ensuring persistence mechanisms are removed. Therefore, switching the phone to safe mode before cleanup is the most appropriate eradication step.

IDOR is fundamentally an authorization flaw: the application exposes object identifiers (IDs) and fails to enforce that the requesting user is allowed to access that object. The primary remediation is to implement robust authorization checks—commonly RBAC (C) plus object-level access control—so every request verifies user identity and privileges against the requested resource.

(A) WAFs can help with certain injection patterns, but default WAF rules rarely fix logical authorization flaws like IDOR. A WAF also risks false positives and doesn’t replace secure design. (B) pen testing is important for assurance, but it’s not the primary patch; it helps validate the fix later. (D) encryption protects confidentiality in transit/at rest, but it does not prevent an authenticated user from accessing another user’s records if authorization checks are missing.

Therefore (C) is the correct first-line fix: enforce authorization server-side, avoid predictable identifiers, and ensure access control is consistently applied across all endpoints (including APIs).