212-89 EC Council Certified Incident Handler (ECIH v3) Questions and Answers

The vulnerability exploited by Clark through tampering with form and parameter values to gain unauthorized access to information assets is indicative of Broken Access Control. Broken Access Control vulnerabilities occur when a web application does not properly enforce restrictions on what authenticated users are allowed to do. Attackers can exploit these vulnerabilities to access unauthorized functionality or data, such as accessing other users' accounts, viewing sensitive files, and modifying other users’ data.

Racheal should check for DKIM (DomainKeys Identified Mail) in the email headers to analyze the authenticity of received emails. DKIM is an email authentication method designed to detect email spoofing. It provides a way for the receiver to check that an email claimed to have come from a specific domain was indeed authorized by the owner of that domain. It achieves this by affixing a digital signature, linked to a domain name, to each outgoing email message. The recipient can verify this signature to confirm that the email was not altered during its transmission and that it indeed comes from the specified domain, thereby helping to prevent email spoofing. Other options like SNMP (Simple Network Management Protocol), POP (Post Office Protocol), and ARP (Address Resolution Protocol) are not directly related to email authenticity checks.

Avoiding VPN (Virtual Private Network) and other secure network channels is not a countermeasure to eradicate inappropriate usage incidents. On the contrary, using VPNs and secure network channels is a best practice for enhancing security, as these technologies help protect data in transit, ensuring that it is encrypted and less susceptible to interception or eavesdropping. Countermeasures for inappropriate usage typically involve enhancing security and monitoring, not reducing the security of communications.

Risk assessment is the risk management process that involves identifying risks, estimating their impact on the organization, and determining the sources of those risks to recommend appropriate mitigation measures. The goal of a risk assessment is to understand the nature of potential threats, vulnerabilities, and the consequences of those risks materializing, allowing an organization to make informed decisions about how to address them effectively. Risk assumption involves accepting the potential impact of a risk, risk mitigation focuses on reducing the likelihood or impact of risks, and risk avoidance involves taking actions to avoid the risk entirely.

This incident demonstrates a document-based web malware delivery mechanism, specifically leveraging remotely hosted Rich Text Format (RTF) injection, which is explicitly discussed in ECIH web and malware handling modules. RTF documents can reference external objects or templates, allowing malicious payloads to be fetched dynamically when the document is opened—without requiring macros or user interaction.

Option A is correct because the behavior described aligns precisely with remote template injection. The absence of macros, the silent external connections, and the use of structural document elements are classic indicators of RTF-based malware delivery. ECIH highlights this as a high-risk technique because it bypasses traditional macro-based detection and user warning mechanisms.

Option B is incorrect because the payload was delivered via downloaded documents, not email impersonation of social contacts. Option C references browser extensions and PDFs, which are not involved. Option D describes lateral spread, not initial delivery.

ECIH emphasizes that modern web-based attacks increasingly abuse trusted document formats and remote object references to evade controls. Understanding these techniques enables responders to improve document sanitization, outbound traffic monitoring, and content disarm and reconstruction (CDR) controls.

This incident involves active data exfiltration, which ECIH malware handling guidance identifies as a critical containment priority. When malware is actively transmitting sensitive data, stopping the leak takes precedence over deep analysis.

Option B is correct because using the network traffic analyzer to identify and halt outbound malicious communication immediately prevents further data loss. ECIH stresses that containment actions must first stop harm before eradication and recovery.

Option A supports eradication but does not immediately stop exfiltration. Option C is premature. Option D is unreliable and risks reinfection.

Therefore, halting malicious transmissions is the ideal first step.

In the described attack, where attackers pose as legitimate access points (APs) by beaconing the WLAN's SSID to lure users, the attack is known as an Evil twin AP attack. This type of attack involves setting up a rogue AP with the same SSID as a legitimate wireless access point, making it appear as an authorized network to users. Unsuspecting users may connect to this malicious AP, allowing attackers to intercept sensitive information, conduct man-in-the-middle attacks, or distribute malware. The Evil twin AP attack exploits the trust users have in known SSIDs to compromise their security.

Anti-forensics techniques are designed to prevent, mislead, or interfere with the incident handling process, affecting the collection, preservation, and identification phases of the forensic investigation process. These techniques include methods to erase, encrypt, or alter information, make data recovery difficult, hide data (e.g., steganography), or otherwise obstruct forensic analysis and investigation efforts. Anti-forensics can significantly challenge the efforts of incident responders and forensic investigators in establishing the facts of a security incident or crime.

This question focuses on post-incident recovery and resilience, a key ECIH concept. After restoring services, organizations must strengthen defenses to prevent recurrence.

Option B is correct because Content Delivery Networks (CDNs) distribute traffic and absorb volumetric attacks, while blackhole routing discards malicious traffic upstream. ECIH identifies these as industry-standard controls for DDoS resilience.

Options A, C, and D weaken security or increase attack surface and contradict ECIH guidance.

ECIH stresses that recovery is not complete until preventive measures are implemented. CDN deployment and upstream traffic control significantly improve availability during future attacks.

ISO/IEC 27001 Annex A.16 focuses on information security incident management, including reporting, assessment, response, and learning. The ECIH curriculum aligns closely with these requirements, emphasizing structured procedures and continuous improvement.

Option C is correct because it directly addresses the identified gaps: clear escalation channels, consistent outcome tracking, and incorporation of lessons learned. ECIH stresses that post-incident activities—often overlooked—are essential for improving readiness and preventing recurrence.

Option A supports preparedness but does not address systemic process gaps. Option B improves visibility but not governance. Option D is a technical control unrelated to incident learning and escalation.

Thus, implementing structured incident escalation and post-incident knowledge integration is the priority action for compliance and resilience.

ECIH cloud incident handling guidance emphasizes that containment must be immediate and within the organization’s control. Modifying cloud security groups allows responders to restrict network access instantly, preventing further data exfiltration.

Option D is correct because it is actionable without CSP dependency and directly limits attacker movement. Option A may take time. Option B is investigative. Option C is regulatory and premature.

Containment through security group modification is therefore the most critical first step.

A permissive security policy is characterized by allowing all activities except those that are explicitly blocked. This approach starts with a default state of allowing access and functionality, with restrictions applied only to known dangerous services, attacks, or behaviors. Such a policy can lead to a wider attack surface because it assumes services and behaviors are safe unless proven otherwise.

A prudent policy would typically involve more conservative security measures, applying necessary restrictions to protect against identified and potential threats.

A paranoic policy would be at the extreme end of security measures, possibly blocking more than necessary to ensure the highest level of security, often at the expense of usability or functionality.

A promiscuous policy, in contrast, would be even more open than a permissive policy, essentially allowing nearly all traffic or actions with minimal restrictions, which is not what Rica observed.

The primary objective of endpoint incident handling, as outlined in the ECIH curriculum, is rapid containment and eradication of threats to preserve business operations. Advanced malware that bypasses traditional defenses requires coordinated response capabilities to prevent widespread compromise.

Option D is correct because endpoint IH&R enables organizations to quickly isolate infected systems, remove malicious components, and restore trusted states, thereby maintaining operational continuity. ECIH emphasizes speed and coordination as critical success factors in endpoint response.

Option A is secondary. Option B is a compliance outcome, not a response objective. Option C is a consequence, not the primary driver.

Therefore, the most critical reason is to ensure rapid containment and eradication, making Option D correct.

Access point monitoring is the technique that helps incident handlers to detect man-in-the-middle (MitM) attacks by continuously observing and managing the wireless access points (APs) within a network. This includes identifying unauthorized or new APs attempting to connect to the network or mimic existing APs, even if they present similar IP and MAC addresses to legitimate access points. Through access point monitoring, incident handlers can quickly identify and mitigate spoofed APs, thus preventing MitM attacks that exploit wireless networks by intercepting and manipulating communications.

This scenario indicates identity compromise in a cloud environment, reflected by unusual API activity. The ECIH Cloud Security Incident Handling module emphasizes that in cloud platforms, identity and access management (IAM) is the primary security boundary. When API misuse is detected, the most urgent action is to invalidate potentially compromised credentials.

Option D is correct because rotating all IAM access keys immediately cuts off the attacker’s ability to continue abusing API access. Reviewing IAM policies for excessive permissions further reduces the attack surface and prevents privilege misuse. ECIH explicitly states that compromised credentials must be revoked before implementing additional detective or preventive controls.

Option A may help limit access but does not address stolen credentials that could still be abused elsewhere. Option B improves future visibility but does not mitigate the active incident. Option C is unrelated, as there is no indication of a DDoS attack.

ECIH guidance prioritizes containment through credential revocation in cloud incidents involving unauthorized API usage. Therefore, rotating IAM keys and reviewing permissions is the most critical immediate mitigation step.

Yesware is a tool primarily known for its email tracking capabilities, which can be useful for sales, marketing, and customer relationship management. However, in the context of investigating email attacks and analyzing incidents to extract details such as sender identity, mail server, sender’s IP address, and location, a more appropriate tool would be one that specializes in analyzing and extracting detailed header information from emails, providing insights into the path an email took across the internet. While Yesware can provide data related to email interactions, it might not offer the depth of forensic analysis required for incident investigation. Tools like email header analyzers, which are designed specifically for dissecting and interpreting email headers, would be more fitting. In the absence of a direct match from the given options, the description might imply a broader interpretation of tools like Yesware in context but traditionally, tools specifically designed for email forensics would be sought after for this task.

Volatile data refers to information that is stored temporarily and is lost when a computer is turned off or restarted, such as RAM contents, including open sockets and open ports, the date and time of the system, and the state of the network interface. The creation dates of files, however, are considered non-volatile data because they are preserved on the hard drive and remain available after the system is restarted or turned off. Non-volatile data is stored on persistent storage mediums like hard drives, SSDs, and magnetic tapes, where it remains until it is deleted or overwritten.

ECIH insider threat guidance highlights Data Loss Prevention (DLP) as a core technical control for preventing unauthorized data exfiltration, regardless of motive.

Option C is correct because DLP systems monitor, detect, and block sensitive data transfers across endpoints, networks, and cloud services. Even trusted insiders with legitimate access can be prevented from exfiltrating data without authorization.

Options A and B are administrative controls that do not scale well. Option D addresses morale but not security enforcement.

By implementing DLP, NeuroNet can enforce data protection policies while maintaining productivity, aligning directly with ECIH best practices.

In a Linux environment, email servers such as Sendmail log events, including details about sent and received emails, in a specific log file. The correct directory and file for examining email logs, particularly for Sendmail and using Syslog for logging, is /Var/log/maillog. This file contains vital information for forensic and incident response purposes, including source and destination IP addresses, email addresses, timestamps, and other data relevant to the email traffic handled by the server. By analyzing this log, incident responders can gather evidence related to email-based incidents, trace the source of malicious emails, and understand the scope of an incident. It's crucial for individuals like Khai, who are tasked with examining logs, to know the correct log file locations and their contents to effectively validate and analyze email header information and other relevant data.

Public Key Infrastructure (PKI) is a framework used to manage digital certificates and public-key encryption. It enables secure electronic transfer of information for a range of network activities such as e-commerce, internet banking, and confidential email. PKI is fundamental to the management of encryption keys and digital certificates, ensuring the secure exchange of data over networks and verification of identity.

For memory dump analysis, tools like Scylla and OllyDumpEx are more suited. These tools are designed to analyze and extract information from memory dumps, which can be crucial for understanding the state of a system at the time of an incident. Scylla is used for reconstructing imports in dumped binaries, while OllyDumpEx is an OllyDbg plugin used for dumping process memory. Both tools are valuable for incident handlers like Rinni who are performing memory dump analysis to uncover evidence or understand the behavior of malicious software.

Email Dossier is a tool designed to perform detailed investigations on email messages to verify their authenticity and trace their origin. It can analyze email headers and provide information about the route an email has taken, the servers it passed through, and potentially malicious links or origins. For an incident handler like Stenley, tasked with verifying the validity of emails and containing malicious email threats, Email Dossier serves as a practical tool for analyzing and validating emails received by employees. By using this tool, Stenley can identify fraudulent or suspicious emails, thereby helping to protect the organization from phishing attacks, malware distribution, and other email-based threats.

Pharming is a cyber attack intended to redirect a website's traffic to another, bogus website. By poisoning a DNS server's cache, attackers can redirect users from the site they intended to visit to one that is malicious, without the user's knowledge or any action on their part, such as clicking a deceptive link. This technique is particularly insidious because it can affect well-intentioned users who type the correct URL into their browsers but are still redirected. War driving involves searching for wireless networks from a moving vehicle, skimming refers to stealing credit card information using a device placed on ATMs or point-of-sale terminals, and pretexting is a form of social engineering where the attacker lies to obtain privileged data.

ECIH email incident response guidance emphasizes email header analysis as the primary validation technique for suspected spoofing or impersonation attacks.

Option A is correct because headers reveal sender IPs, routing paths, and authentication results (SPF, DKIM, DMARC). This evidence directly confirms whether the email originated from a legitimate source.

Options B, C, and D are supplementary actions but do not provide authoritative validation.

According to the National Institute of Standards and Technology (NIST), which is a primary source for cloud computing standards and guidelines, the five main actors in cloud computing are Consumer, Provider, Carrier, Auditor, and Broker. These roles are defined as follows:

Consumer: The person or organization that uses cloud computing services.

Provider: The entity that provides the cloud services to consumers.

Carrier: The organization that offers connectivity and transport services to cloud providers and consumers.

Auditor: An independent party that assesses and verifies the cloud services, security controls, and operations.

Broker: An entity that manages the use, performance, and delivery of cloud services, and negotiates relationships between cloud providers and consumers.

These actors play critical roles in the ecosystem of cloud computing, ensuring the services are delivered and used securely, efficiently, and effectively.

This scenario demonstrates a preventive containment action during an email security incident. The ECIH Email Security Incident Handling module emphasizes that once phishing is identified, responders should immediately prevent further delivery to reduce organizational exposure.

Option A is correct because Lena removes malicious emails from the mail server’s delivery queue before users receive them. This action directly reduces risk by preventing additional users from clicking malicious links or submitting credentials. ECIH identifies email purging as a critical containment technique during active phishing campaigns.

Option B is an investigative action, not containment. Option C applies after delivery and compromise. Option D addresses already compromised accounts rather than preventing exposure.

By stopping malicious emails before delivery, Lena aligns with ECIH best practices for rapid containment of email-based threats.

The Sarbanes–Oxley Act (SOX) Title V, titled "Analyst Conflicts of Interest," contains measures specifically designed to restore investor confidence in the reporting of securities analysts. It addresses the issue of potential conflicts of interest for securities analysts who recommend stocks and other securities by requiring disclosure of certain relationships and financial interests between analysts and the companies they cover. This part of the SOX Act aims to ensure that investors receive unbiased and accurate information from analysts, thereby helping to restore trust in financial markets. Title V consists of only one section, making it unique compared to other titles within the Act that may encompass multiple sections or provisions.

Wireshark is a network protocol analyzer that allows users to capture and interactively browse the traffic running on a computer network. It is a crucial tool for incident responders like Eric who are developing incident-handling plans and need to analyze network traffic and patterns. Wireshark can provide detailed information about the network, including protocols used, source and destination of packets, and potential signs of malicious activity, making it invaluable for developing informed policies and procedures.

The EC-Council Incident Handler (ECIH) curriculum explains that certain advanced mobile malware strains embed themselves as background services configured to restart automatically upon reboot. In such cases, traditional antivirus scans may fail to fully remove the threat because the malicious service remains active.

Switching the mobile device to safe mode (or emergency mode) prevents third-party applications and background services from automatically launching during startup. This isolates the malicious process and prevents it from reinitializing, allowing responders to perform forensic analysis and removal without triggering additional payload execution or data exfiltration.

ECIH emphasizes that during malware eradication, responders must prevent the malware from executing while conducting cleanup procedures. Safe mode supports controlled analysis and minimizes risk during remediation.

Option B (lost device tracking) is a monitoring measure, not an eradication technique. Option C (revoking cloud permissions) is relevant to access control but does not remove embedded malware. Option D (network scans) supports broader investigation but does not directly eliminate the persistent mobile threat.

ECIH guidance for malware eradication includes isolating infected devices, disabling malicious processes, applying clean firmware or OS reinstallation if necessary, and ensuring persistence mechanisms are removed. Therefore, switching the phone to safe mode before cleanup is the most appropriate eradication step.

Thenetstat -ancommand is used to display network connections, routing tables, and a number of network interface statistics. It is particularly useful for identifying unusual volumes of traffic to and from a system, which can be indicative of a DoS/DDoS attack. The option-ashows all active connections and the TCP and UDP ports on which the computer is listening, and-ndisplays addresses and port numbers in numerical form. This can help the incident handling and response (IH&R) team to identify suspicious patterns, such as a large number of connections from a single source or to a specific port, which are common during DoS/DDoS attacks.

Nation-state attribution involves identifying a specific country or government as the sponsor behind a cyber-attack or intrusion. This type of threat attribution is focused on determining the involvement of state actors in cyber operations against specific targets, which often involves sophisticated, well-planned, and executed cyber campaigns. Alexis's efforts to identify and attribute the actors behind the attack to a specific nation-state fall under this category, as she seeks to uncover the geopolitical motives and the extent of state sponsorship behind the incident. Nation-state attribution requires analyzing a variety of indicators, including technical evidence, tactics, techniques, and procedures (TTPs), and contextual intelligence. This is distinct from campaign attribution, which focuses on linking attacks to a specific campaign or operation, true attribution, which aims at identifying the actual individuals behind an attack, and intrusion set attribution, which involves attributing a set of malicious activities to a particular threat actor or group.

Netcraft is a tool that provides internet security services, including the detection of phishing and spam emails. It offers a range of services that can help organizations identify fraudulent websites and phishing activities by analyzing web content and email messages for known phishing signatures and heuristics. This makes it a useful tool for incident handlers like Francis, who is tasked with detecting phishing and spam emails for client organizations. Other options listed, such as Nessus (a vulnerability scanner), BTCrack (a Bluetooth pin and link-key cracker), and Cain and Abel (a password recovery tool), do not specialize in detecting phishing or spam emails but serve different purposes in cybersecurity.

The EC-Council Incident Handler (ECIH) curriculum defines drive-by download attacks as web-based attacks where malicious code is automatically executed when a user visits a compromised website. These attacks often exploit browser or rendering engine vulnerabilities without requiring user interaction or explicit file downloads.

In this scenario, trusted informational websites were covertly modified to include obfuscated scripts that executed upon page rendering. The exploit chains targeted unpatched vulnerabilities and injected payloads directly into memory, avoiding file creation and traditional detection mechanisms. This behavior is characteristic of drive-by download attacks leveraging exploit kits.

Option A involves email-based delivery, which is not described. Option B relates to manipulating search engine rankings but does not inherently describe memory-based exploit execution. Option D involves malicious advertisements; however, the scenario specifically references compromised websites rather than third-party ad platforms.

ECIH emphasizes patch management, browser hardening, memory analysis, and exploit mitigation technologies to defend against drive-by downloads. Therefore, the most consistent technique is a drive-by download attack exploiting vulnerabilities.

The term that describes the combination of strategies and services intended to restore data, applications, and other resources to the public cloud or dedicated service providers is "Cloud recovery." This term encompasses disaster recovery efforts focused on ensuring that an organization's digital assets can be quickly and effectively restored or moved to cloud environments in the event of data loss, system failure, or a disaster. Cloud recovery strategies are part of a broader disaster recovery and business continuity planning, ensuring minimal downtime and data loss by leveraging cloud computing's scalability and flexibility. Mitigation, analysis, and eradication are terms associated with other aspects of incident response and risk management, not specifically with the restoration of resources to cloud environments.

ECIH identifies insider threats as best mitigated through continuous behavioral and activity monitoring, not physical or invasive measures.

Option B is correct because employee monitoring tools can analyze access patterns, file movements, abnormal data transfers, and deviations from normal behavior. These tools provide early warning of malicious insider activity while remaining compliant with legal and privacy frameworks when properly implemented.

Options A, C, and D are ineffective, intrusive, or legally problematic and are explicitly discouraged by ECIH.

Behavioral monitoring allows organizations to detect insider threats proactively rather than reactively, making Option B the most effective control.

Incident triage is the phase in the incident handling and response process where identified security incidents are analyzed, validated, categorized, and prioritized. This step is critical for determining the severity of incidents and deciding on the allocation of resources for effective response. It involves initial analysis to understand the nature of the incident, its impact, and urgency, which guides the subsequent response actions.

A negligent insider is an individual within an organization who, due to a lack of knowledge on security threats or in an attempt to increase workplace efficiency, inadvertently bypasses security procedures or makes errors that compromise security. This type of insider threat is not malicious in intent; rather, it stems from carelessness, oversight, or a lack of proper security training. Such insiders might click on phishing links, mishandle sensitive information, or use unsecured networks for work-related tasks, thereby exposing the organization to potential security breaches. This contrasts with compromised insiders (who are manipulated by external parties), professional insiders (who misuse their access for personal gain), and malicious insiders (who intentionally aim to harm the organization).

This scenario highlights violations of forensic readiness and safe malware handling, which are explicitly covered in the ECIH First Response and Malware Analysis modules. ECIH stresses that malware samples must never be handled on production or enterprise-connected systems, as this creates a high risk of accidental execution, lateral infection, and organizational impact.

Option A is correct because ECIH mandates that malicious code samples be stored in isolated, non-networked environments and renamed with non-executable extensions (for example, .malware, .bin, or .txt) to prevent accidental execution. This practice ensures operational safety and preserves forensic integrity.

Option B improves confidentiality but does not prevent accidental execution. Option C supports documentation but does not mitigate execution risk. Option D aids classification but does not address safe handling.

The described behavior—handling live malware on enterprise systems without isolation or renaming—directly contradicts ECIH best practices. Proper sample isolation, renaming, and access restriction are mandatory controls to prevent secondary incidents during investigations, making Option A the correct answer.

In the scenario described, Stanley's effort to present evidence in a clear and comprehensible manner to the members of a jury, with the intention of clarifying facts and aiding in obtaining expert opinion, aligns with the characteristic of admissibility. The admissibility of digital evidence pertains to its acceptability in a court of law, which hinges on the evidence being collected, handled, and presented in a manner that complies with legal standards and procedures. This includes ensuring the evidence is relevant, reliable, and not overly prejudicial. By preparing to present the evidence in a way that the jury can understand and use to confirm the investigation process, Stanley is focusing on ensuring that the evidence meets the criteria for admissibility in the legal proceedings. Completeness, believability, and authenticity are also important characteristics of digital evidence, but the context provided indicates that Stanley's primary focus is on meeting the legal requirements for the evidence to be considered valid in court.

The EC-Council Incident Handler (ECIH) curriculum emphasizes Identity and Access Management (IAM) as a foundational control in cloud security. In cloud environments, shared credentials and lack of role-based restrictions significantly increase the risk of misuse, unauthorized access, and privilege abuse.

The scenario clearly identifies two major violations: credential reuse across departments and absence of role-specific restrictions. ECIH highlights that cloud best practices require enforcing strict user access control using the Principle of Least Privilege (PoLP) and role-based access control (RBAC). Each user—including third-party contractors—must have unique credentials with clearly defined permissions aligned strictly with their job responsibilities.

Credential isolation ensures accountability and traceability, enabling effective logging, auditing, and forensic investigation. Without unique user tracking, organizations cannot accurately attribute actions, which weakens incident response and compliance efforts.

Option B (data anonymization) relates to data privacy but does not address access misuse. Option C (vulnerability scanning of mobile apps) addresses application security, not identity misuse. Option D (SSL encryption) protects data in transit but does not prevent unauthorized credential reuse or excessive access rights.

ECIH strongly recommends implementing multi-factor authentication (MFA), enforcing strong IAM policies, restricting third-party access, and continuously monitoring privileged accounts in cloud environments. Therefore, enforcement of strict user access control and credential isolation is the most appropriate preventive measure.

The correct flow of stages in an Incident Handling and Response (IH&R) process as outlined in the Incident Handler (ECIH v3) by EC-Council begins with Preparation. This phase involves getting ready for potential incidents by developing plans, policies, and procedures, and ensuring that tools and team training are up to date. Incident Recording is the next stage, where incidents are documented and reported. Incident Triage follows, prioritizing incidents based on their impact and urgency. Containment is next, aiming to limit the damage of the incident and prevent further spread. Eradication comes after containment, where the root cause of the incident is removed. Recovery is the stage where affected systems are restored to their operational status. Post-Incident Activities conclude the process, reviewing and learning from the incident to improve future response efforts.

Wireshark is a widely used network protocol analyzer that helps in capturing and interactively browsing the traffic on a network. It is an essential tool for incident responders like Eric who are developing incident-handling plans and procedures. By analyzing network traffic, Wireshark allows users to see what is happening on their network at a microscopic level, making it invaluable for troubleshooting network problems, analyzing security incidents, and understanding network behavior. Whois is used for querying databases that store registered users or assignees of an Internet resource. Burp Suite is a tool for testing web application security, and FaceNiff is used for session hijacking within a WiFi network, which makes Wireshark the best choice for analyzing network traffic.

Netstat (network statistics) is a command-line tool that displays network connections (both incoming and outgoing), routing tables, and a number of network interface (and network protocol) statistics. It is considered a volatile evidence collecting tool because it gathers information that exists in the system's memory, which is lost upon shutdown or reboot. This makes it invaluable for collecting evidence of active connections and processes that are present at the time of the incident response but does not persistently store data that can be recovered later. This contrasts with tools like FTK Imager or ProDiscover Forensics, which are used for acquiring digital evidence in a non-volatile manner, such as disk imaging, and HashTool, which is used for validating the integrity of collected digital evidence through hashing.

The scenario described is characteristic of a Trojan. A Trojan is a type of malware that disguises itself as legitimate software but performs malicious actions once installed. Unlike viruses, which can replicate themselves, or worms, which can spread across networks on their own, Trojans rely on the guise of legitimacy to trick users into initiating their execution. In this case, the user believed they were downloading and installing genuine software, but the reality was that the application contained a Trojan. The malicious code executed upon installation provided unauthorized remote access to the user's computer, which could be used by an attacker to control the system, steal data, install additional malware, or carry out other malicious activities.

Trojans can come in many forms and can be used to achieve a wide range of malicious objectives, making them a versatile and dangerous type of cyber threat. The deceptive nature of Trojans, exploiting the trust users have in what appears to be legitimate software, is what makes them particularly effective and widespread.

Ping sweeping is a technique used in network reconnaissance to identify which IP addresses in a range are active or live. By sending ICMP echo requests ("ping") to multiple hosts and observing which ones respond, an attacker or, in this case, a red team member like Allan, can determine which systems are up and potentially vulnerable to further exploration or attack. This method is foundational for mapping the network before deploying more targeted exploits or scans.

Explanation (preparation phase):

This is classic preparation work aimed at improving detection and response speed. Valid incident handling begins before incidents occur: ensuring telemetry exists, logs are collected centrally, alerts are actionable, and roles are defined so handoffs and escalation happen quickly. Reviewing firewall and IDS/IPS logging, centralizing alerts, and aligning the response team on responsibilities directly supports monitoring readiness and operational coordination.

(A) backup hardening is about recovery resilience and integrity of backups; nothing in the scenario references backup configurations or restore testing. (B) law enforcement coordination is a procedural/legal readiness task, not what is described. (C) vulnerability scanning is proactive identification of weaknesses; again, the actions here are about log visibility and alerting, not scanning.

Network monitoring readiness (D) best fits because it includes: ensuring the right data sources are logging, time synchronization, centralized collection (SIEM/log platform), and defined responsibilities for triage and escalation. This aligns with playbook-style preparation models that emphasize roles and monitoring visibility before incidents occur .

In this scenario, the inability to access the file server via Remote Desktop Protocol (RDP), despite the server being pingable and other services functioning normally, suggests a service-specific disruption rather than a complete system shutdown or broader network issue. This pattern is indicative of a denial-of-service (DoS) attack targeted at the file server's RDP service or network congestion that specifically affects RDP connectivity. A DoS attack aims to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connected to the Internet. The fact that other services (like email) are operational rules out broader system or admin account issues, pointing towards a specific problem with accessing the file server, most likely due to a denial-of-service condition.

The ECIH Forensic Readiness module defines chain of custody as a documented trail showing who collected, handled, transferred, and stored evidence. Maintaining this record is essential for legal admissibility.

Option C is correct because Liam’s actions—labeling, logging, photographing, and documenting custody transfers—directly establish and maintain chain of custody. ECIH stresses that without proper chain-of-custody documentation, evidence may be challenged or dismissed in legal proceedings.

Options A, B, and D are unrelated to evidence tracking.

Thus, Liam is demonstrating proper chain-of-custody management.

In the static data collection process, which is part of digital forensics and incident handling, the focus is on acquiring and examining digital evidence without altering the system or the data itself. This process includes evidence examination, where the data is analyzed; system preservation, where the current state of a system or data is maintained to ensure no alteration occurs; and evidence acquisition, which involves creating an exact binary copy of the digital evidence. Password protection, however, is not a part of the static data collection process. Instead, it relates to securing access to data or systems but does not directly involve the collection or preservation of static data for forensic purposes.

The EC-Council Incident Handler (ECIH) curriculum identifies email spoofing as a common technique in business email compromise (BEC) attacks. Attackers exploit weak or misconfigured DNS-based email authentication controls to forge sender identities.

Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) are DNS-based mechanisms that validate legitimate email senders and prevent spoofing. Proper configuration ensures that receiving mail servers can verify message authenticity and reject forged communications.

In this scenario, unsecured DNS entries enabled identity relay spoofing. Strengthening SPF, DKIM, and DMARC directly addresses the root cause and prevents recurring forged message injections. This is a clear eradication measure aimed at eliminating the exploitation pathway.

Options A and B relate to review and analysis phases. Option C supports threat intelligence sharing but does not remediate the internal DNS weakness.

Therefore, strengthening SPF, DKIM, and DMARC configurations is the appropriate eradication strategy.

In Wireshark, the filtericmp.type==8is used to detect ping sweep attempts. ICMP type 8 messages are echo requests, which are used in ping operations to check the availability of a network device. A ping sweep involves sending ICMP echo requests to multiple addresses to discover active devices on a network. By filtering for ICMP type 8 messages in Wireshark, Bran can identify these echo requests, helping to pinpoint ping sweep activities on the network.

This scenario reflects misuse of system resources, a category defined in ECIH network and endpoint incident classification.

Option C is correct because unauthorized software caused excessive CPU usage and system strain, violating acceptable use policies.

Options A, B, and D do not match the behavior described.

ECIH classifies such activity as a security incident because it impacts availability, performance, and risk exposure.

A Trojan, or Trojan horse, is a type of malware that disguises itself as a legitimate, harmless program or file to trick users into downloading and installing it. Once activated, a Trojan can perform a range of malicious activities, including giving attackers unauthorized access to the infected system. This can lead to the theft of sensitive information, such as credit card numbers and passwords, and can also allow the attacker to install additional malware, potentially leading to further damage, such as the erasure of data. Unlike viruses and worms, Trojans do not replicate themselves but rely on the deception of users to spread.

James's activities, including creating anonymous access to cloud services to carry out attacks such as password and key cracking, hosting malicious data, and conducting DDoS attacks, exemplify the abuse and nefarious use of cloud services. This threat involves exploiting cloud computing resources to conduct malicious activities, which can impact the cloud service provider as well as other users of the cloud services. This abuse ranges from using the cloud platform's resources for computationally intensive tasks like cracking passwords or encryption keys to conducting DDoS attacks that can disrupt services for legitimate users.

In incident response protocols, incidents are categorized based on their severity, impact, and the urgency of the response required. The categorization helps in prioritizing incident response activities and allocating resources accordingly. A CAT 1 (Category 1) incident is typically considered the highest priority, involving significant threats that require immediate response. Given the scenario where a malware incident in one of the largest social network companies must be reported within 1 hour of discovery/detection, this indicates a high-priority incident due to the potential widespread impact and the need for a rapid response to contain and mitigate the malware's spread. The urgency of the reporting timeframe suggests that the incident is considered critical, aligning with the characteristics of a CAT 1 incident, which necessitates immediate action to prevent significant damage or disruption to the company's operations and services.

Centralized logging and monitoring is a core best practice in cloud incident detection and response under ECIH. Cloud environments are distributed and dynamic, making visibility a major challenge.

Option C is correct because aggregating logs from multiple cloud platforms enables correlation, faster detection, and effective incident triage. ECIH emphasizes centralized visibility as essential for identifying cross-platform threats.

Options A and D are limited in scope. Option B does not address cloud-specific risks.

Hex encoding (also known as hexadecimal encoding) involves converting binary data into hexadecimal representation. In the context described, when a user submits a request with potentially malicious input (such as a single quote and other characters in an attempt to perform SQL injection), the encoding technique converts this input into a string of hexadecimal digits (ranging from 0 to 9 and A to F). This prevents the direct interpretation of the input as SQL commands by the database, thereby mitigating the risk of SQL injection attacks. This method is a form of input sanitization that helps ensure that user input cannot be used to manipulate database queries directly.

Forensic readiness refers to an organization's ability to maximize its capability to use digital evidence effectively in an investigation, while minimizing the cost of an investigation and disruption to its operations. It involves having policies, procedures, and technologies in place to collect, preserve, and analyze digital evidence efficiently, so when an incident occurs, the organization is prepared to handle it quickly and with minimal costs. Forensic readiness not only helps in reducing the time and resources spent on investigations but also ensures that the evidence is reliable and can be used in legal proceedings if necessary.

This scenario describes an active exploitation of a vulnerable application feature. The ECIH Web Application Incident Handling module emphasizes that when a specific feature is being abused, immediate containment requires removing or disabling that attack surface.

Option B is correct because disabling the vulnerable advanced search feature immediately stops further exploitation while allowing the team to analyze and remediate the flaw safely. ECIH warns against leaving known-vulnerable functionality active during investigation.

Options A and C improve authentication but do not stop exploitation of backend logic. Option D protects stored data but does not prevent further abuse.

Therefore, disabling the exploited feature is the best immediate action.

In IoT and OT environments, the ECIH curriculum emphasizes that containment is the highest first-response priority, especially when public safety and critical services are involved. The abnormal data transmission strongly suggests compromise, and allowing the device to remain connected risks lateral movement, data exfiltration, and operational disruption.

Option C is correct because immediate isolation of the affected IoT device prevents further unauthorized communication while preserving the system’s current state for forensic analysis. Isolation limits the blast radius without unnecessarily disrupting the entire infrastructure.

Option A introduces risk by changing system states during an active incident. Option B is preventive and not an incident response action. Option D is appropriate after containment but not before.

Thus, isolating the compromised device aligns with ECIH endpoint and IoT incident handling principles.

Eradication is the phase in the incident response process where the root cause of an incident is removed or eliminated, and all attack vectors are closed to prevent similar incidents in the future. This step follows the containment phase, where the immediate threat is isolated to prevent further damage, and precedes the recovery phase, where normal operations are restored. Eradication involves thoroughly removing malware, unauthorized access mechanisms, or any other elements used in the attack, and securing any vulnerabilities that were exploited. The goal is to ensure that the threat cannot re-emerge and that the systems are secure before they are returned to operational status.

The EC-Council Incident Handler (ECIH) curriculum describes Security Orchestration, Automation, and Response (SOAR) platforms as integrated systems that combine automated detection, case management, workflow execution, and coordinated response actions.

The scenario includes automated abnormal behavior detection, endpoint isolation, log correlation, automatic incident ticket creation, asset mapping, user activity analysis, and adaptive containment using predefined workflows with analyst oversight. These capabilities align directly with incident response automation and orchestration technologies.

ECIH emphasizes that modern IR programs integrate SIEM, endpoint detection and response (EDR), and orchestration platforms to streamline alert triage, automate containment steps, and reduce response time. Automation ensures rapid isolation of infected systems, while orchestration coordinates multiple tools and teams across departments.

Option A lacks automation. Option B (legacy antivirus) cannot perform coordinated isolation and workflow execution. Option C (backup system) supports recovery but not detection or containment.

Therefore, a coordinated system combining incident response automation with orchestration capabilities best supports the described workflow.

This scenario describes an evil twin attack, a well-documented wireless network threat covered in the ECIH Network Security Incidents module. An evil twin attack occurs when an attacker sets up a rogue wireless access point that mimics the SSID of a legitimate network. Unsuspecting users connect to the stronger or more accessible signal, allowing attackers to intercept credentials, inject malware, or perform man-in-the-middle attacks.

Option A is correct because the presence of an unauthorized access point broadcasting the same SSID and causing authentication failures is a defining indicator of an evil twin attack. Users may unknowingly connect to the malicious access point, leading to repeated disconnections from the legitimate network.

Option B would not involve a rogue access point. Option C focuses on identity spoofing at the MAC layer but does not explain SSID duplication. Option D involves IP address assignment issues, not SSID impersonation.

ECIH emphasizes that identifying rogue wireless infrastructure quickly is critical to containment. Detecting evil twin attacks allows responders to isolate the rogue device, protect credentials, and restore secure wireless operations.

ECIH forensic readiness guidance identifies the Windows Registry as a primary source for USB device artifacts. The Enum\USB registry key stores vendor IDs, product IDs, serial numbers, and connection history.

Option A is correct because it provides direct evidence of which USB devices were connected, when they were installed, and on which system—critical for insider investigations.

Option B cannot reliably identify physical USB usage. Option C contains driver installation data but is less comprehensive. Option D is irrelevant.

Registry analysis is a foundational forensic technique in ECIH, making Option A correct.

In Wireshark, to identify ICMP ping sweep attempts, the filtericmp.type == 8 or icmp.type ==0is used. This filter captures ICMP echo requests and echo replies, which are indicative of ping commands. Type 8 represents an echo request used when a source sends a ping, and type 0 represents an echo reply, which is the response from the target. By filtering for these ICMP types, Miko can detect a surge in ping requests across the network, which could indicate a ping sweep attempt—an exploratory activity often used by attackers to discover active hosts on a network by sending ping requests to multiple addresses.

The first step in securing an employee's account following an email hacking incident involves restoring access to the email services if necessary and immediately changing the password to prevent unauthorized access. This action ensures that the attacker is locked out of the account as quickly as possible. While enabling two-factor authentication, scanning links and attachments, and disabling automatic file sharing are important security measures, they come into play after ensuring that the compromised account is first secured by changing its password to halt any ongoing unauthorized access.

Email Dossier is a tool designed to assist in the investigation of email incidents by analyzing and validating email headers and providing detailed information about the origin, routing, and authenticity of an email. When Michael is tasked with handling an email incident and needs to check the validity of an email received from an unknown source, Email Dossier can be utilized to trace the email's path, assess its credibility, and identify potential red flags associated with phishing or other malicious email-based attacks.

This scenario demonstrates manual phishing email verification, which is a foundational detection technique taught in the ECIH Email Security module. Manual verification involves human inspection of email characteristics such as sender address anomalies, mismatched URLs, unusual tone, urgency, and contextual inconsistencies.

Option D is correct because Ethan manually inspects the email by hovering over links, reviewing sender formatting, and evaluating message tone. These actions are key indicators used to identify phishing without relying on automated tools.

Option A relates to encoding analysis, which is not described. Option B involves automated network-based detection. Option C focuses on shortened URLs, which are not present here.

ECIH emphasizes that while automated defenses are important, human verification remains critical, especially for targeted phishing attacks that bypass technical controls. Therefore, Option D correctly identifies the detection approach used.

This scenario exemplifies a classic malicious insider threat, where a trusted employee with legitimate access abuses their privileges. According to the EC-Council ECIH curriculum, traditional perimeter controls and static access restrictions are often ineffective against insiders because the actions appear legitimate at a surface level. Therefore, the primary emphasis must be on behavior-based detection.

Option D is correct because behavioral analytics enables organizations to establish baselines of normal employee behavior and identify deviations such as unusual access times, excessive data downloads, atypical system usage, or abnormal data transfer patterns. ECIH highlights behavioral monitoring as a critical control for detecting insider threats early, especially when access credentials are valid and authorized.

Option A may limit productivity and does not detect malicious intent. Option B is an administrative practice with limited security value. Option C improves awareness but does not detect deliberate malicious behavior.

By implementing behavioral analytics, ClobalTech can identify subtle indicators of insider misuse, respond earlier, and reduce the impact of long-term data exfiltration, aligning with ECIH best practices for insider threat mitigation.

The responsibility of first responders does not include shutting down or rebooting the victim’s computer as a measure to preserve temporary and fragile evidence. In fact, such actions can potentially alter or destroy volatile data that could be crucial for the investigation. The primary responsibilities of first responders include protecting and identifying the crime scene, and ensuring the preservation of evidence in its original state as much as possible, which may involve isolating affected systems from the network but not necessarily shutting them down or rebooting them without proper forensic readiness and consideration.

Omnipeek is a network analyzer tool that allows for the capture and analysis of data packets transmitted across a network. It is designed to provide deep insights into network traffic, enabling users to examine various aspects of the data packets, including network protocols, ports, devices, and potential issues in network transmission. This tool would be ideal for Chandler, who is targeting the Technote organization with the intent of intercepting and analyzing network traffic to obtain sensitive organizational information. Omnipeek's capabilities in packet analysis make it suitable for such activities, offering detailed visibility into the network's operation and data flows.

Process memory (RAM) is a type of digital evidence that is temporarily stored and requires a constant power supply to retain information. If the power supply is interrupted, the information stored in process memory is lost. This type of evidence can include data about running programs, user actions, system events, and more, making it crucial for forensic analysis, especially in identifying actions taken by both users and malware. Collecting data from process memory helps incident responders understand the state of the system at the time of an incident and can reveal valuable information that is not persisted elsewhere on the device.

This scenario represents a classic insider data exfiltration incident, where a legitimate user abuses authorized access to move sensitive information outside organizational boundaries. The ECIH Insider Threat module clearly identifies Data Loss Prevention (DLP) as the primary technical control for detecting and preventing such activity.

Option B is correct because DLP solutions are designed to monitor, classify, and control sensitive data in motion, at rest, and in use. DLP can detect when regulated or confidential data is sent via email, uploaded to cloud services, or copied to external destinations, and can block or alert on policy violations in real time. ECIH emphasizes that DLP is especially effective against low-and-slow insider leaks that bypass perimeter defenses.

Option A improves awareness but does not enforce controls. Option C is overly restrictive and does not prevent other exfiltration channels. Option D is blunt and easily bypassed while disrupting legitimate business use.

ECIH guidance stresses layered insider threat defenses combining policy, monitoring, and enforcement. DLP provides visibility and control without relying solely on user behavior, making it the most effective priority action.

This scenario involves a suspected malicious insider threat with potential external collusion, which significantly elevates legal, regulatory, and evidentiary requirements. The ECIH curriculum emphasizes that when insider activity is suspected—especially involving terminated employees and possible corporate espionage—organizations must prioritize forensic integrity, confidentiality, and lawful investigation.

Option B is correct because collaborating with external forensic experts and law enforcement ensures a neutral, legally defensible investigation. ECIH stresses that insider cases often require specialized forensic capabilities, evidence preservation, and legal authority that internal teams alone may not possess. Maintaining confidentiality protects the organization from reputational damage and legal exposure while facts are being established.

Option A ignores the insider dimension and risks repeat incidents. Option C bypasses legal safeguards and could be interpreted as obstruction or collusion. Option D is premature and exposes the organization to defamation and legal risk without substantiated evidence.

ECIH guidance is clear that complex insider incidents should be escalated appropriately with legal and forensic rigor. Therefore, Option B aligns best with recommended practice.

Shally has incorporated the Defense-in-depth strategy into the incident response plan for Texas Pvt. Ltd. Defense-in-depth is a layered security approach that involves implementing multiple security measures and controls throughout an information system. This strategy is designed to provide several defensive barriers to protect against threats and attacks, ensuring that if one layer is compromised, others still provide protection. The goal is to create a multi-faceted defense that addresses potential vulnerabilities in various areas, including physical security, network security, application security, and user education.

The correct sequence of steps performed by incident responders during the vulnerability assessment phase is as follows:

Perform OSINT information gathering to validate the vulnerabilities (4):Initially, Open Source Intelligence (OSINT) is used to gather information about the organization’s digital footprint and potential vulnerabilities.

Run vulnerability scans using tools (1):Next, specialized tools are employed to scan the organization's networks and systems for vulnerabilities.

Identify and prioritize vulnerabilities (2):The identified vulnerabilities are then analyzed and prioritized based on their severity and potential impact on the organization.

Examine and evaluate physical security (3):Physical security assessments are also crucial as they can impact the overall security posture and protection of digital assets.

Check for misconfigurations and human errors (6):This step involves looking for misconfigurations in systems and networks, as well as potential human errors that could lead to vulnerabilities.

Apply business and technology context to scanner results (5):The results from the scans are evaluated within the context of the business and its technology environment to accurately assess risks.

Create a vulnerability scan report (7):Finally, a comprehensive report is created, detailing the vulnerabilities, their severity, and recommended mitigation strategies.

This sequence ensures a thorough assessment, prioritizing vulnerabilities that pose the greatest risk and providing actionable insights for mitigation.

In the ECIH Incident Handling lifecycle, once a breach is detected, the IH&R team must focus on analysis and scoping to understand how the attack occurred, what systems were affected, and whether the attacker still has access.

Option D is correct because analyzing logs with Incident Response Automation and Orchestration (IRAO) tools allows rapid correlation of events, identification of attacker entry points, and determination of breach scope. ECIH stresses that zero-day incidents require deep forensic and timeline analysis to ensure complete containment and prevent recurrence.

Options A and C are important but depend on accurate breach understanding. Option B is premature without full incident context.

Therefore, log analysis and origin tracing is the correct primary focus.

When an attacker installs a fake AP (Access Point) within a company's network, especially behind a firewall, this constitutes the deployment of a Rogue Access Point. Rogue APs are unauthorized wireless access points installed within a network without the network administrator's knowledge or consent. They pose a significant security risk because they can be used to intercept sensitive information, bypass network security configurations, and provide a gateway for attackers to enter the network undetected. This type of attack circumvents the security measures put in place by a company, including firewalls, by creating an illicit entry point into the network that is under the control of the attacker.

The correct sequence of steps involved in forensic readiness planning, based on the activities described, is as follows:

Identify the potential evidence required for an incident.

Determine the source of the evidence.

Define a policy that determines the pathway to legally extract electronic evidence with minimal disruption.

Establish a policy for securely handling and storing the collected evidence.

Identify if the incident requires full or formal investigation.

Train the staff to handle the incident and preserve the evidence.

Create a special process for documenting the procedure.

This scenario involves an active malware incident affecting content integrity, which directly impacts public trust and organizational credibility. According to the ECIH malware response lifecycle, the first priority is containment, not correction or recovery.

Option B is correct because network segregation and isolation prevent the malware from continuing to spread, communicating with command-and-control infrastructure, or further manipulating content. Containment stabilizes the environment and preserves evidence for forensic analysis.

Option C focuses on correction rather than stopping the attack and may allow malware persistence. Option D risks restoring infected components and destroying forensic artifacts. Option A is a communication decision that should follow containment and validation.

ECIH explicitly warns against performing remediation or rollback actions before containment, as doing so may worsen impact or obscure root cause analysis. Isolating compromised systems is therefore the correct immediate response.

This scenario demonstrates preservation of volatile evidence, a critical first-response principle in the ECIH forensic readiness module. Volatile evidence includes data that exists only while a system is powered on, such as active sessions, running processes, open files, and on-screen information.

Option B is correct because David documents the live system state without interacting in a way that would alter evidence. Photographing the screen, recording visible activity, and documenting connections are all recommended ECIH practices when dealing with powered-on systems.

Option A is unrelated. Option C alters system state. Option D applies only to inactive devices.

ECIH stresses that mishandling active systems can destroy crucial evidence. David’s actions align precisely with first responder best practices, making Option B correct.

According to the EC-Council Incident Handler (ECIH) curriculum, an unauthorized access incident occurs when an attacker gains access to a system without proper authorization, often through credential compromise, brute-force attacks, or exploitation of weak authentication controls.

The scenario describes repeated failed login attempts followed by successful access and subsequent data exfiltration. This sequence—brute-force attempts leading to compromise and data transmission—clearly indicates unauthorized system access. The large outbound traffic spike to an unfamiliar IP further confirms potential data exfiltration following successful authentication bypass.

Option A is unrelated to wireless-specific attacks. Option C refers to policy misuse by authorized users. Option D (denial-of-service) focuses on service disruption rather than data theft or credential compromise.

ECIH recommends immediate isolation of affected systems, log preservation, credential resets, forensic analysis, and review of access controls following unauthorized access incidents. Maria’s actions align with these best practices.

Therefore, this incident is classified as an unauthorized access incident.

System characterization is the process of defining the boundaries of an IT system, which includes identifying the resources, information, and functionality that constitute the system. This process is crucial for understanding the scope of the system, the data it processes, and the technology it employs. By characterizing a system, incident handlers can better understand the system's normal operations and behaviors, which is essential for identifying anomalies that may indicate a security incident. System characterization involves documenting the hardware, software, network configuration, data flows, and other critical elements of the IT environment. This foundational knowledge supports effective incident handling by providing a baseline against which suspicious activities can be compared.

The ECIH incident validation phase emphasizes the importance of direct evidence when confirming unauthorized access. Log entries that show access to sensitive or restricted files provide concrete proof that an attacker successfully breached controls.

Option B is correct because access logs tied to critical resources confirm both authentication success and unauthorized activity. Failed logins or system performance issues alone do not confirm compromise.

Option A, C, and D are indirect indicators that may signal suspicious behavior but cannot independently confirm unauthorized access.

Therefore, verified log evidence is the strongest indicator, aligning with ECIH incident triage and validation principles.

In the scenario where your company sells Software as a Service (SaaS) and is hosted on the cloud using it as a Platform as a Service (PaaS), your company is responsible for eradicating malware in your customer's database. This is because, as the SaaS provider, your company manages the software and is responsible for its security and maintenance, including the databases that store customer data. While the PaaS provider is responsible for the underlying infrastructure, platform, and possibly some middleware security aspects, the application layer security, including data and application management, falls to the SaaS provider. Building management would not be involved in digital security matters, and while customers are responsible for their data, the actual software maintenance and security in a SaaS model are the provider's responsibility.

Unauthorized access to backend services in a cloud environment most commonly results from overly permissive identity and access management (IAM) configurations. The ECIH cloud incident handling guidance emphasizes that identity controls are the primary security boundary in cloud platforms.

Option A is correct because reviewing and tightening IAM roles immediately reduces the attack surface and revokes excessive privileges that may be exploited. This action directly addresses the root cause of unauthorized access.

Option D is a strong additional control but should be applied after correcting IAM misconfigurations. Option B improves future detection but does not contain the current incident. Option C is disruptive and unnecessary as a first response.

Therefore, IAM review and privilege tightening is the correct first measure, consistent with ECIH best practices.