After a malware outbreak via email attachments, the incident response team has contained the affected systems. What is the next step in the eradication phase?

Conduct a lessons-learned meeting to improve future response.

Notify the users that the incident is resolved and they can resume normal work.

Remove the malicious emails from all mailboxes and quarantine servers, and delete associated registry entries and temporary files.

Restore the mailboxes from backup taken before the incident.

During the eradication phase of an email security incident, what is the primary goal?

Restore email services to normal operation

Identify the source of the email

Remove all traces of the malicious email and associated malware from systems

A ransomware attack encrypted the email server and the backups. The incident response team has restored the server from an offline backup, but some mailboxes are missing emails from the last few days. The team needs to eradicate the ransomware completely and recover the missing emails. What is the most effective approach?

Ignore the missing emails and focus on preventing future attacks.

Disconnect the server from the network and declare the incident resolved.

Scan the restored server for ransomware indicators, remove any remnants, and restore the missing emails from the offline backup.

Reimage the server and restore the mailboxes from the online backup.

An email contains a shortened URL. What is the safest method to inspect the destination without exposing the system to potential malware?

Copy the link into a browser's address bar

Expand the URL using a URL expander service

Click the link to see where it goes

Send the link to a colleague to test

EC-CouncilCertified Incident Handler

Domain 3Objective 1

Handling and Responding to Email Security Incidents ECIH Practice Questions (Page 7)

Part of the Email and Network Security Incidents domain, which makes up ~21% of our current practice bank.

46questions here

10free pages

7concepts

Questions 31–35

31application · medium
After a malware outbreak via email attachments, the incident response team has contained the affected systems. What is the next step in the eradication phase?
Select an answer first
32foundation · easy
During the eradication phase of an email security incident, what is the primary goal?
Select an answer first
33expert · hard
A ransomware attack encrypted the email server and the backups. The incident response team has restored the server from an offline backup, but some mailboxes are missing emails from the last few days. The team needs to eradicate the ransomware completely and recover the missing emails. What is the most effective approach?
Select an answer first
34foundation · easy
An email contains a shortened URL. What is the safest method to inspect the destination without exposing the system to potential malware?
Select an answer first
35foundation · easy
Which field in an email header is most useful for tracing the original IP address of the sender?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECIH” is a trademark of its owner, used for identification only.

Handling and Responding to Email Security Incidents ECIH Practice Questions (Page 7)

Questions 31–35

After a malware outbreak via email attachments, the incident response team has contained the affected systems. What is the next step in the eradication phase?

During the eradication phase of an email security incident, what is the primary goal?

An email contains a shortened URL. What is the safest method to inspect the destination without exposing the system to potential malware?

Which field in an email header is most useful for tracing the original IP address of the sender?

Keep studying — Email and Network Security Incidents