Pass the ECCouncil ECIH 212-89 Questions and answers with CertsForce

In the context of incident handling and response (IH & R), the preparation phase is the initial step where teams and resources are organized to effectively respond to potential security incidents. This phase involves building the IH & R team, developing incident response plans and policies, setting up communication channels, and ensuring that the team has the necessary tools and authority to act. James, being assigned to build an IH & R plan and organize his team, is engaging in the preparation step of the incident response process. This foundational step is crucial for ensuring a coordinated and efficient response to incidents when they occur.

When an attacker installs a fake AP (Access Point) within a company ' s network, especially behind a firewall, this constitutes the deployment of a Rogue Access Point. Rogue APs are unauthorized wireless access points installed within a network without the network administrator ' s knowledge or consent. They pose a significant security risk because they can be used to intercept sensitive information, bypass network security configurations, and provide a gateway for attackers to enter the network undetected. This type of attack circumvents the security measures put in place by a company, including firewalls, by creating an illicit entry point into the network that is under the control of the attacker.

A robust Data Loss Prevention system provides the most directly relevant technical control for preventing and detecting unauthorized transfer of sensitive research information. ECIH ' s insider-threat coverage includes monitoring user activities, identifying anomalous behavior, protecting sensitive information, and implementing controls that reduce opportunities for malicious insiders to remove organizational data. DLP technologies can monitor data at rest, in use, and in transit; enforce policies governing sensitive information; and alert or block suspicious copying, uploading, emailing, or other exfiltration attempts. HR meetings and anonymous feedback mechanisms may help identify workplace dissatisfaction, but they cannot reliably prevent deliberate data theft. Completely restricting all employees from research information is operationally unrealistic and fails to apply access according to legitimate business requirements. DLP therefore provides the strongest targeted control against the type of insider-driven data exfiltration described.

================

Viruses are a type of malicious software program designed to infect legitimate software programs. Once a virus is executed, it can corrupt or delete data on a computer, replicate itself, and spread to other files and systems. Unlike worms, which can spread across networks on their own, viruses usually require some form of user interaction, such as opening an infected email attachment or downloading and executing a malicious file, to propagate. Trojans and spyware, while also malicious software, serve different malicious purposes, such as creating backdoors for attackers (Trojans) or spying on users ' activities (Spyware).

Splunk is a powerful tool for log analysis, capable of collecting, analyzing, and visualizing data from various sources in real time. For an incident handler like Drake, intending to detect traces of malicious activities within the network infrastructure, Splunk can efficiently parse large volumes of log data, enabling the identification of patterns and anomalies that may indicate malware propagation or other security incidents. Its real-time analysis capabilities make it an ideal tool for monitoring network activities and responding to incidents promptly.

Persistent mobile malware that survives antivirus scans indicates deep system compromise. The ECIH Endpoint and Mobile Incident Handling guidance states that when malware cannot be reliably removed, reimaging or OS reinstallation is the safest remediation.

Option C is correct because performing a factory reset or reinstalling the OS ensures complete removal of malicious components and restores device integrity. ECIH cautions that partial containment actions may stop symptoms but not eradicate threats.

Options A and B are temporary containment steps. Option D is ineffective against malware.

Therefore, full OS reinstallation is the correct next action.

Rate limiting is the most appropriate response because the attack specifically abuses the application ' s search functionality by generating excessive requests. Application-layer DoS attacks consume server-side resources through apparently legitimate HTTP requests rather than simply overwhelming network bandwidth. Applying rate limits to the affected search endpoint restricts how frequently individual clients or sessions can invoke the resource-intensive function, directly reducing the attack ' s effectiveness while allowing legitimate users to continue accessing the application. Moving to a higher-bandwidth host does not address exhaustion of application resources. Clearing the cache is unrelated to controlling malicious request volume. IP-based blocking can help in limited situations, but distributed attackers can rotate or spoof sources, making static blocking less effective. Rate limiting therefore provides targeted containment of the abused application functionality.

================

The ECIH incident validation phase emphasizes the importance of direct evidence when confirming unauthorized access. Log entries that show access to sensitive or restricted files provide concrete proof that an attacker successfully breached controls.

Option B is correct because access logs tied to critical resources confirm both authentication success and unauthorized activity. Failed logins or system performance issues alone do not confirm compromise.

Option A, C, and D are indirect indicators that may signal suspicious behavior but cannot independently confirm unauthorized access.

Therefore, verified log evidence is the strongest indicator, aligning with ECIH incident triage and validation principles.

The ECIH Endpoint Security module identifies EDR systems as the cornerstone of modern endpoint incident response. Advanced attacks targeting intellectual property often bypass traditional antivirus controls.

Option C is correct because EDR provides continuous monitoring, behavioral detection, rapid containment, and automated response across endpoints. This capability is critical during high-risk periods such as product launches.

Options A, B, and D are important but insufficient alone for real-time detection and response.

Therefore, deploying a robust EDR system is essential.

Incident triage is the phase in the Incident Handling and Response (IH & R) process where identified security incidents are analyzed, validated, categorized, and prioritized. This step is crucial for determining the severity of incidents and deciding on the order in which they should be addressed. During triage, incident handlers assess the impact, urgency, and potential harm of an incident to prioritize their response efforts effectively. This ensures that resources are allocated efficiently, and the most critical incidents are handled first. Incident recording and assignment involve logging incidents and assigning them to handlers, containment focuses on limiting the extent of damage, and notification involves informing stakeholders about the incident.