Your organization suffered a phishing attack that led to a data breach. You have completed containment and eradication. What should you include in the incident report to satisfy regulatory requirements?

The names of all employees who received the phishing email

A recommendation to purchase better antivirus software

Only the number of emails involved

The timeline of the incident, the data affected, and the response actions taken

After a malware outbreak via email attachments, you have contained the affected systems and identified the malicious emails in user mailboxes. What is the next step in the eradication phase?

Delete the malicious emails from all mailboxes and purge them from the mail server's deleted-items folder

Restore the mail server from the last backup

Run a full antivirus scan on the mail server

Notify users to delete the emails manually

A worm is spreading through email by sending itself to contacts in the address book. The incident response team needs to contain the outbreak. Which action is most effective?

Send a warning email to all users to not open attachments from infected users.

Disable the email accounts of infected users and block the worm's attachment hash at the gateway.

Run a full antivirus scan on all mail servers.

Disconnect the mail server from the internet.

A phishing email with a malicious link was sent to 200 employees. 15 clicked the link, and 3 entered credentials. The email gateway has already quarantined the original email, but the 15 affected workstations may have downloaded a payload. You must contain the incident while minimizing business disruption. Which action best balances containment and operational continuity?

Disable the email accounts of all 200 recipients

Isolate the 15 workstations from the network immediately

Reimage all 200 workstations to ensure no malware remains

Block the malicious URL at the firewall and continue monitoring

EC-CouncilCertified Incident Handler

Domain 3Objective 1

Handling and Responding to Email Security Incidents ECIH Practice Questions (Page 3)

Part of the Email and Network Security Incidents domain, which makes up ~21% of our current practice bank.

46questions here

10free pages

7concepts

Questions 11–15

11application · medium
Your organization suffered a phishing attack that led to a data breach. You have completed containment and eradication. What should you include in the incident report to satisfy regulatory requirements?
Select an answer first
12application · medium
After a malware outbreak via email attachments, you have contained the affected systems and identified the malicious emails in user mailboxes. What is the next step in the eradication phase?
Select an answer first
13application · medium
A worm is spreading through email by sending itself to contacts in the address book. The incident response team needs to contain the outbreak. Which action is most effective?
Select an answer first
14expert · hard
A phishing email with a malicious link was sent to 200 employees. 15 clicked the link, and 3 entered credentials. The email gateway has already quarantined the original email, but the 15 affected workstations may have downloaded a payload. You must contain the incident while minimizing business disruption. Which action best balances containment and operational continuity?
Select an answer first
15foundation · easy
During email triage, an incident handler receives a message that appears to come from the CEO, but the sender's display name is slightly altered and the domain is a lookalike. Which classification best describes this email-based security incident?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECIH” is a trademark of its owner, used for identification only.

Handling and Responding to Email Security Incidents ECIH Practice Questions (Page 3)

Questions 11–15

Your organization suffered a phishing attack that led to a data breach. You have completed containment and eradication. What should you include in the incident report to satisfy regulatory requirements?

After a malware outbreak via email attachments, you have contained the affected systems and identified the malicious emails in user mailboxes. What is the next step in the eradication phase?

A worm is spreading through email by sending itself to contacts in the address book. The incident response team needs to contain the outbreak. Which action is most effective?

During email triage, an incident handler receives a message that appears to come from the CEO, but the sender's display name is slightly altered and the domain is a lookalike. Which classification best describes this email-based security incident?

Keep studying — Email and Network Security Incidents