A malware infection is detected on a server that also hosts a critical application. The application cannot be stopped without significant business impact. The incident responder must contain the malware. What is the BEST approach?

Disconnect the server from the network immediately.

Kill the malware process and hope it does not return.

Rebuild the server from a known good image.

Use application-level isolation to restrict the malware's access while keeping the application running.

Which of the following is a common indicator of a security incident that might be noticed during initial response?

A scheduled system reboot that occurs as planned

A normal user logging in during business hours

An unexpected increase in outbound network traffic

A software update being installed during a maintenance window

During initial triage, an incident responder finds that a single workstation is infected with a known malware variant, while a server on the same subnet is also showing suspicious outbound connections. What should the responder do FIRST?

Escalate the incident to management immediately.

Contain the infected workstation by disconnecting it from the network.

Assess the server's activity to determine if it is part of the same incident.

Rebuild the workstation from a known good image.

What is the immediate goal of system isolation during a malware incident?

To prevent the malware from spreading to other systems

To restore the system from backup

To identify the malware's origin

To delete the malware from the system

During an incident, the incident handler discovers that a malware infection has affected 5 out of 200 workstations. The infected workstations are in the finance department. What should the incident handler do FIRST?

Shut down the entire company network.

Ignore the infection because only 5 workstations are affected.

Immediately notify the press about the incident.

Isolate the finance department's network segment.

EC-CouncilCertified Incident Handler

Domain 2Objective 1

First Response ECIH Practice Questions (Page 2)

Part of the First Response and Malware Incidents domain, which makes up ~22% of our current practice bank.

47questions here

10free pages

7concepts

Questions 6–10

6expert · hard
A malware infection is detected on a server that also hosts a critical application. The application cannot be stopped without significant business impact. The incident responder must contain the malware. What is the BEST approach?
Select an answer first
7foundation · easy
Which of the following is a common indicator of a security incident that might be noticed during initial response?
Select an answer first
8application · medium
During initial triage, an incident responder finds that a single workstation is infected with a known malware variant, while a server on the same subnet is also showing suspicious outbound connections. What should the responder do FIRST?
Select an answer first
9foundation · easy
What is the immediate goal of system isolation during a malware incident?
Select an answer first
10application · medium
During an incident, the incident handler discovers that a malware infection has affected 5 out of 200 workstations. The infected workstations are in the finance department. What should the incident handler do FIRST?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECIH” is a trademark of its owner, used for identification only.