A Windows server in a DMZ is suspected of being compromised. The incident handler needs to preserve evidence while minimizing changes to the system. Which action should be taken FIRST?

Capture the contents of RAM using a trusted tool on a USB drive.

Disconnect the server from the network and then copy the hard drive.

Power off the server immediately to prevent further malicious activity.

Run a full antivirus scan to identify the malware.

A malware infection is detected on a server that hosts a critical application. The application cannot be offline for more than 30 minutes. The incident handler must contain the infection and preserve evidence. Which strategy best meets these constraints?

Disconnect the server from the network and wait for the malware to stop.

Take a memory dump, disconnect the server from the network, and restore the application from a backup on a new virtual machine.

Power off the server and perform a full forensic analysis on the hard drive.

Keep the server running and attempt to remove the malware manually.

A small company has just experienced a suspected data breach. The CEO wants to immediately notify all customers and the press. The incident handler advises against this. What is the primary reason for delaying external communication?

To wait for the attacker to reveal themselves.

To give the IT team time to delete all logs.

To avoid paying legal fees for breach notification.

To allow time to verify the scope and impact of the incident.

Which of the following should be documented during first response actions?

The estimated cost of the incident

The personal opinions of the responders

The exact time and date of each action taken

The names of all employees in the organization

What is the primary goal of the first response phase in incident handling?

To contain the incident and preserve evidence while minimizing damage

To identify the root cause of the incident and implement permanent fixes

To communicate the incident to external regulatory bodies

To restore all affected systems to full operational status

EC-CouncilCertified Incident Handler

Domain 2Objective 1

First Response ECIH Practice Questions (Page 1)

Part of the First Response and Malware Incidents domain, which makes up ~22% of our current practice bank.

47questions here

10free pages

7concepts

Questions 1–5

1application · medium
A Windows server in a DMZ is suspected of being compromised. The incident handler needs to preserve evidence while minimizing changes to the system. Which action should be taken FIRST?
Select an answer first
2expert · hard
A malware infection is detected on a server that hosts a critical application. The application cannot be offline for more than 30 minutes. The incident handler must contain the infection and preserve evidence. Which strategy best meets these constraints?
Select an answer first
3application · medium
A small company has just experienced a suspected data breach. The CEO wants to immediately notify all customers and the press. The incident handler advises against this. What is the primary reason for delaying external communication?
Select an answer first
4foundation · easy
Which of the following should be documented during first response actions?
Select an answer first
5foundation · easy
What is the primary goal of the first response phase in incident handling?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECIH” is a trademark of its owner, used for identification only.