According to organizational procedures, what should be communicated during an incident escalation?

A summary of the incident, actions taken, and current status

The complete forensic analysis report

Only the incident's impact on business operations

The names of all users who may be affected

An incident responder is collecting evidence from a compromised server. They need to ensure the evidence is admissible in court. What is the MOST important action to take?

Document every action taken and maintain a chain of custody.

Use a write blocker when imaging the hard drive.

Encrypt the evidence files to protect them from tampering.

Store the evidence on a secure server.

A network administrator notices a large amount of outbound traffic from a single workstation at 3:00 AM. The workstation is not typically used at that time. What should the administrator do FIRST?

Disconnect the workstation from the network.

Ignore the traffic because it may be a scheduled backup.

Rebuild the workstation from a known good image.

Investigate the traffic to determine if it is a security incident.

A system administrator notices that a server's event logs show multiple failed login attempts followed by a successful login from an unusual IP address. What should the administrator do FIRST?

Disconnect the server from the network.

Change the password of the compromised account.

Investigate the successful login to determine if it is a security incident.

Ignore the event because it may be a legitimate user.

Which action is an example of immediate containment during a malware incident?

Running a full antivirus scan on the system

Disconnecting the affected system from the network

Updating the system's operating system

EC-CouncilCertified Incident Handler

Domain 2Objective 1

First Response ECIH Practice Questions (Page 8)

Part of the First Response and Malware Incidents domain, which makes up ~22% of our current practice bank.

47questions here

10free pages

7concepts

Questions 36–40

36foundation · easy
According to organizational procedures, what should be communicated during an incident escalation?
Select an answer first
37application · medium
An incident responder is collecting evidence from a compromised server. They need to ensure the evidence is admissible in court. What is the MOST important action to take?
Select an answer first
38application · medium
A network administrator notices a large amount of outbound traffic from a single workstation at 3:00 AM. The workstation is not typically used at that time. What should the administrator do FIRST?
Select an answer first
39application · medium
A system administrator notices that a server's event logs show multiple failed login attempts followed by a successful login from an unusual IP address. What should the administrator do FIRST?
Select an answer first
40foundation · easy
Which action is an example of immediate containment during a malware incident?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECIH” is a trademark of its owner, used for identification only.