An employee reports an email with an attachment named 'Invoice_2024.exe'. The email claims to be from a known vendor. The employee did not open the attachment. How should you classify this incident?

Malware attachment delivery attempt

Spear-phishing credential harvesting

An employee receives an email with a PDF attachment that, when opened, triggers a PowerShell script. The email passed the spam filter. You need to prevent other users from opening similar attachments while you investigate. What is the most immediate containment action?

Disable PowerShell on all user workstations

Send a company-wide email warning about the phishing attempt

Block the attachment file hash at the email gateway

Delete the email from the recipient's mailbox only

A phishing campaign has compromised several mailboxes, and the incident response team has identified the malicious emails. The team needs to prevent further spread while preserving evidence. Which action best achieves this?

Run a mail flow rule to move all emails from the sender to the Junk folder.

Disable the affected user accounts and reset their passwords.

Permanently delete the malicious emails from all mailboxes and purge the trash folders.

Place the affected mailboxes on litigation hold and block the sender's address at the gateway.

A user reports receiving an email that appears to come from the company's CEO, asking for urgent gift card purchases. The email's display name is correct, but the sender address is an external domain. You need to determine whether this is a spoofing attempt. Which action is most appropriate?

This option is intentionally omitted to maintain exactly four options.

Inspect the email headers to compare the Return-Path and Received fields against the claimed sender domain.

Reply to the sender to verify their identity before taking any action.

Block the external domain at the email gateway immediately to prevent further emails.

A ransomware email with a malicious macro document was opened by 10 employees. The malware has encrypted files on their local drives and is attempting to spread to network shares. You need to contain the incident. Which action should you take FIRST?

Disconnect the 10 affected workstations from the network

Run a full antivirus scan on the file server

EC-CouncilCertified Incident Handler

Domain 3Objective 1

Handling and Responding to Email Security Incidents ECIH Practice Questions (Page 6)

Part of the Email and Network Security Incidents domain, which makes up ~21% of our current practice bank.

46questions here

10free pages

7concepts

Questions 26–30

26application · medium
An employee reports an email with an attachment named 'Invoice_2024.exe'. The email claims to be from a known vendor. The employee did not open the attachment. How should you classify this incident?
Select an answer first
27application · medium
An employee receives an email with a PDF attachment that, when opened, triggers a PowerShell script. The email passed the spam filter. You need to prevent other users from opening similar attachments while you investigate. What is the most immediate containment action?
Select an answer first
28application · medium
A phishing campaign has compromised several mailboxes, and the incident response team has identified the malicious emails. The team needs to prevent further spread while preserving evidence. Which action best achieves this?
Select an answer first
29application · medium
A user reports receiving an email that appears to come from the company's CEO, asking for urgent gift card purchases. The email's display name is correct, but the sender address is an external domain. You need to determine whether this is a spoofing attempt. Which action is most appropriate?
Select an answer first
30expert · hard
A ransomware email with a malicious macro document was opened by 10 employees. The malware has encrypted files on their local drives and is attempting to spread to network shares. You need to contain the incident. Which action should you take FIRST?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECIH” is a trademark of its owner, used for identification only.