Free EC Council Certified Incident Handler (ECIH v3) Practice Questions

A global manufacturing company detected unauthorized privilege escalation on one of its OT workstations connected to critical production systems. The IH & R team must respond without alerting the attacker or risking deletion of forensic artifacts. The attacker ' s persistence mechanisms and data exfiltration activity are not yet fully identified. The CISO instructs the team to implement a strategy that limits the threat ' s lateral movement without tipping off the adversary. Which of the following containment actions best aligns with this objective?

Lena, a SOC analyst, observes a pattern of unusual login attempts originating from multiple foreign IP addresses tied to shared drive links circulating within the organization. These links were embedded in emails appearing to come from the HR department and marked with urgent subject lines. Upon deeper inspection, Lena finds multiple similar messages still pending in the mail server’s delivery queue. To prevent widespread exposure, she takes immediate action to eliminate these messages before they reach employees ' inboxes. Which incident response action best describes Lena’s action?

You are talking to a colleague who Is deciding what information they should include in their organization’s logs to help with security auditing. Which of the following items should you tell them to NOT log?

Mike is an incident handler for PNP Infosystems Inc. One day, there was a ticket submitted regarding a critical incident and Mike was assigned to handle the incident. During the process of incident handling, at one stage, he performed incident analysis and validation to check whether the incident is a genuine incident or a false positive.

Identify the stage he is currently in.

Alexis works as an incident responder at XYZ organization. She was asked to identify and attribute the actors behind an attack that occurred recently. For this purpose, she is performing a type of threat attribution that deals with the identification of a specific person, society, or country sponsoring a well-planned and executed intrusion or attack on its target. Which of the following types of threat attributions is Alexis performing?

AlphaTech, a cloud-based storage company, recently suffered data leakage. Investigation revealed an employee sent sensitive client data to a personal email. AlphaTech wants to implement a solution to monitor and prevent such incidents. What should they prioritize?

A company utilizing multiple cloud services aims to enhance its posture against cloud security incidents. Among the following options, which constitutes the best practice for achieving this goal?

Rachel, a first responder, finds a smartphone in an executive ' s office that is powered ON and actively displaying a messaging app with potentially incriminating information. She avoids locking the screen or turning off the device, photographs the current display, and collects its charging cable. She then safely packages the device and ensures it is kept charged during transport. What principle is Rachel applying in her evidence handling approach?

Following a security alert, the incident response team at a legal consulting firm suspects that an employee used a USB storage device to exfiltrate confidential client data. To confirm which USB device was connected and gather timestamps and identifiers, which method is most effective?

David, an incident responder, investigates an email-based breach where the CFO ' s email account was compromised and used to send invoice modification requests to vendors. Logs reveal that the attacker accessed the account using valid credentials after the CFO clicked on a fake Microsoft 365 login prompt sent via email. Which technique did the attacker most likely use?