EC-Council Certified Incident Handler ECIH v3 212-89 Exam Questions

Page: 1 / 14
Total 356 questions
Question 1

EcoEarth Inc. detects abnormal archival data access from dormant employee profiles, modification of critical datasets, and suspicious encrypted packet transmissions. Given the risk, what is the first responder's primary action?



Answer : D

Explanation (first response priorities):

First responders prioritize containment and preservation: stop ongoing harm while protecting evidence. The scenario suggests active misuse (dormant accounts modifying data) and possible exfiltration (encrypted transmissions). The quickest way to prevent further manipulation/leakage is isolating affected services/segments---reducing attacker access paths and limiting spread. This also prevents additional data corruption while investigators capture logs, account activity, and network traces.

(A) decrypting traffic is not a first responder priority; it may be impossible (TLS/unknown keys) and consumes time while damage continues. (B) external notification can be necessary later, but premature partner notification can create panic and doesn't stop the incident. (C) rollback is a recovery step and can destroy forensic context or reintroduce compromised states if you haven't validated backup integrity; it also doesn't address how access happened or stop current attacker sessions unless paired with containment.

Therefore, (D) best matches initial response doctrine: contain first, preserve evidence, then analyze and recover.


Question 2

Which of the following is defined as the identification of the boundaries of an IT system along with the resources and information that constitute the system?



Answer : A

System characterization is the process of defining the boundaries of an IT system, which includes identifying the resources, information, and functionality that constitute the system. This process is crucial for understanding the scope of the system, the data it processes, and the technology it employs. By characterizing a system, incident handlers can better understand the system's normal operations and behaviors, which is essential for identifying anomalies that may indicate a security incident. System characterization involves documenting the hardware, software, network configuration, data flows, and other critical elements of the IT environment. This foundational knowledge supports effective incident handling by providing a baseline against which suspicious activities can be compared.


Question 3

A global logistics company recently experienced a targeted ransomware attack that began through a deceptive email campaign. The malicious software encrypted critical files on several systems tied to dispatch and finance operations. Fortunately, the organization had deployed an advanced security setup that could swiftly recognize abnormal behaviors, isolate compromised devices, and alert both the technical support desk and the security operations team.

In parallel, system logs were captured and analyzed using integrated threat detection tools, and a detailed file was automatically created with relevant data such as affected assets, user activity, and potential entry points. Security analysts then assessed the case, adapted containment measures based on the affected departments, and continued tracking suspicious activity across the network. Additional countermeasures were executed based on a mix of pre-approved workflows and expert decisions, ensuring the issue was contained without major disruption. Which combination of technologies is MOST likely supporting this workflow?



Answer : D

The EC-Council Incident Handler (ECIH) curriculum describes Security Orchestration, Automation, and Response (SOAR) platforms as integrated systems that combine automated detection, case management, workflow execution, and coordinated response actions.

The scenario includes automated abnormal behavior detection, endpoint isolation, log correlation, automatic incident ticket creation, asset mapping, user activity analysis, and adaptive containment using predefined workflows with analyst oversight. These capabilities align directly with incident response automation and orchestration technologies.

ECIH emphasizes that modern IR programs integrate SIEM, endpoint detection and response (EDR), and orchestration platforms to streamline alert triage, automate containment steps, and reduce response time. Automation ensures rapid isolation of infected systems, while orchestration coordinates multiple tools and teams across departments.

Option A lacks automation. Option B (legacy antivirus) cannot perform coordinated isolation and workflow execution. Option C (backup system) supports recovery but not detection or containment.

Therefore, a coordinated system combining incident response automation with orchestration capabilities best supports the described workflow.


Question 4

Rachel, a digital forensics investigator, arrives at the scene of a suspected data breach. She photographs all electronic devices, labels and packages each item in static-resistant bags, and ensures each item is documented with time, location, and device details. What activity best describes Rachel's task?



Answer : A

According to the EC-Council Incident Handler (ECIH) curriculum, proper handling of digital evidence is a critical responsibility of first responders. This includes photographing the scene, labeling devices, packaging them in anti-static or static-resistant bags, and documenting detailed information such as time, location, and device identifiers.

These steps are part of evidence preservation and packaging procedures designed to prevent contamination, electrostatic damage, or loss of evidentiary integrity. ECIH emphasizes maintaining a clear chain of custody and ensuring that all digital evidence is properly documented before transportation to a forensic laboratory.

Option B relates to policy review, not field evidence handling. Option C involves technical log analysis performed later during investigation. Option D concerns witness interviews, which are separate from physical evidence handling.

Rachel's actions clearly describe the packaging and transporting of electronic evidence while maintaining forensic standards and documentation integrity.


Question 5

Adam is an incident handler who intends to use DBCC LOG command to analyze a database and retrieve the active transaction log files for the specified database. The syntax of DBCC LOG command is DBCC LOG(, ), where the output parameter specifies the level of information an incident handler wants to retrieve. If Adam wants to retrieve the full information on each operation along with the hex dump of a current transaction row, which of the following output parameters should Adam use?



Answer : C

The DBCC LOG command is used in SQL Server environments to analyze the transaction log files of a database. It provides insights into the transactions that have occurred, which is crucial for forensic analysis in the event of an incident. The syntaxDBCC LOG(<database_name>, <output_level>)allows an incident handler to specify the level of detail they wish to retrieve from the log files. When an incident handler like Adam requires the full information on each operation along with the hex dump of the current transaction row, the output parameter should be set to 4. This level of output is the most verbose, providing comprehensive details about each transaction, including a hex dump which is essential for a deep forensic analysis. It helps in understanding the exact changes made by transactions, which can be pivotal in investigating incidents involving data manipulation or other unauthorized database activities.


Question 6

Zoe, a security analyst, deploys a high-interaction honeypot in the DMZ that mimics critical systems and monitors logs for scans, exploit attempts, and lateral movement techniques. What is the main purpose of Zoe's activity?



Answer : A

Explanation (aligned to threat intelligence & detection):

A high-interaction honeypot is designed to attract and engage adversaries, providing realistic services so defenders can observe tactics, techniques, and procedures (TTPs) with higher fidelity than a low-interaction decoy. The goal is not to ''stop'' attacks directly, but to detect and learn: identify scanning patterns, credential stuffing attempts, exploit chains, payload delivery methods, and post-exploitation behaviors such as enumeration and lateral movement. That intelligence is then used to improve controls---signatures, detections, segmentation, and hardening priorities.

Sandboxing (B) is typically about detonating suspicious files/URLs to observe behavior in a controlled environment; it's not what a DMZ honeypot primarily does. ACL rules and DDoS blocking (C) are traffic filtering measures, not deception telemetry. Backup/recovery testing (D) is resilience planning, unrelated to studying attacker behavior in real-time.

In incident handling terms, honeypots support the ''preparation'' and ''detection'' posture---expanding visibility, generating early warning, and enriching threat intelligence. They can also reduce risk by luring opportunistic attackers away from production assets, but their primary value is behavioral observation and evidence collection.


Question 7

OmegaTech Corp identified unauthorized remote access to its primary server and data exfiltration tunnels. Simultaneously, IoT device firmware corruption was reported. As the first responder, what should Olivia prioritize?



Answer : B

ECIH prioritizes containment of the most critical threat vector. The primary server actively exfiltrating data represents the highest risk.

Option B is correct because isolating the primary server immediately stops data loss and attacker control. IoT remediation can follow once core assets are secured.

Options A and D delay containment. Option C causes unnecessary disruption.

ECIH stresses that responders must address the most damaging threat first, making Option B correct.


Page:    1 / 14   
Total 356 questions