An incident responder is triaging multiple alerts. A critical server is showing signs of a ransomware infection, while a low-priority workstation has a minor malware infection. The responder has limited resources. What should be prioritized?

The critical server, because it has a higher impact on business operations.

Both equally, because they are both security incidents.

Neither, because the responder should wait for more information.

The workstation, because it is easier to fix.

An incident handler has confirmed a data breach involving customer credit card numbers. According to the organization's incident response plan, which party should be notified FIRST?

The incident response team leader and senior management.

The attacker to demand the data be returned.

All customers whose data may be affected.

What is the primary purpose of escalation in incident response?

To inform all employees about the incident details

To transfer the incident to law enforcement immediately

To involve higher-level management or specialized teams when the incident exceeds current capabilities

To increase the severity rating of the incident

An incident responder needs to collect evidence from a compromised Linux server. The server is still running. Which of the following should be collected FIRST?

A list of running processes and network connections.

A full disk image of the server.

The contents of /var/log/syslog.

The system's hostname and IP address.

A security analyst detects a possible malware infection on a single employee's laptop. The analyst has not yet confirmed the infection. According to best practices, what should the analyst do?

Immediately disconnect the laptop and reimage it.

Send a company-wide email warning about the malware.

Ignore the alert because it is only one laptop.

Report the finding to the incident response team for further investigation.

EC-CouncilCertified Incident Handler

Domain 2Objective 1

First Response ECIH Practice Questions (Page 3)

Part of the First Response and Malware Incidents domain, which makes up ~22% of our current practice bank.

47questions here

10free pages

7concepts

Questions 11–15

11expert · hard
An incident responder is triaging multiple alerts. A critical server is showing signs of a ransomware infection, while a low-priority workstation has a minor malware infection. The responder has limited resources. What should be prioritized?
Select an answer first
12application · medium
An incident handler has confirmed a data breach involving customer credit card numbers. According to the organization's incident response plan, which party should be notified FIRST?
Select an answer first
13foundation · easy
What is the primary purpose of escalation in incident response?
Select an answer first
14application · medium
An incident responder needs to collect evidence from a compromised Linux server. The server is still running. Which of the following should be collected FIRST?
Select an answer first
15application · medium
A security analyst detects a possible malware infection on a single employee's laptop. The analyst has not yet confirmed the infection. According to best practices, what should the analyst do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECIH” is a trademark of its owner, used for identification only.