An endpoint is exhibiting signs of compromise, but the antivirus software reports no threats. The system is running a critical application that cannot be interrupted. Which action is MOST appropriate to further investigate the potential compromise?

Disconnect the system from the network.

Perform a memory analysis and review system logs for anomalies.

Ignore the signs because antivirus found nothing.

Reimage the system immediately.

A company suffered a ransomware attack that encrypted files on several servers. The backups were also encrypted because the backup account was compromised. The company decides to pay the ransom to get the decryption key. After decryption, what should the incident handler do to prevent a similar incident?

Implement multi-factor authentication for backup accounts and test backup restoration regularly.

Increase the ransom payment budget.

Store backups on the same network as the servers.

Disable all backups to prevent future encryption.

An organization has identified a malware outbreak on several endpoints. The incident response team needs to contain the spread while preserving evidence. Which containment strategy is most appropriate?

Apply all pending operating system updates

Disconnect the affected endpoints from the network but keep them powered on

Power off the affected endpoints immediately

A company experienced a ransomware incident that started from a phishing email on a single endpoint. The incident was contained and eradicated. During the post-incident review, the team identifies that the endpoint lacked host-based intrusion detection and the user had local administrator rights. Which improvement should be prioritized to reduce the risk of a similar incident?

Increase the frequency of full disk backups.

Implement least-privilege access and deploy endpoint detection and response (EDR) on all endpoints.

Disable all inbound email attachments at the gateway.

Conduct a one-time security awareness training for all employees.

Following an endpoint incident, the incident response team conducts a post-incident review. What is the main goal of this review?

Determine the exact cost of the incident

Identify lessons learned and improve future response

Delete all evidence related to the incident

EC-CouncilCertified Incident Handler

Domain 5Objective 2

Handling and Responding to Endpoint Security Incidents ECIH Practice Questions (Page 10)

Part of the Insider Threats and Endpoint Incidents domain, which makes up ~20% of our current practice bank.

50questions here

10free pages

6concepts

Questions 46–50

46expert · hard
An endpoint is exhibiting signs of compromise, but the antivirus software reports no threats. The system is running a critical application that cannot be interrupted. Which action is MOST appropriate to further investigate the potential compromise?
Select an answer first
47expert · hard
A company suffered a ransomware attack that encrypted files on several servers. The backups were also encrypted because the backup account was compromised. The company decides to pay the ransom to get the decryption key. After decryption, what should the incident handler do to prevent a similar incident?
Select an answer first
48foundation · easy
An organization has identified a malware outbreak on several endpoints. The incident response team needs to contain the spread while preserving evidence. Which containment strategy is most appropriate?
Select an answer first
49application · medium
A company experienced a ransomware incident that started from a phishing email on a single endpoint. The incident was contained and eradicated. During the post-incident review, the team identifies that the endpoint lacked host-based intrusion detection and the user had local administrator rights. Which improvement should be prioritized to reduce the risk of a similar incident?
Select an answer first
50foundation · easy
Following an endpoint incident, the incident response team conducts a post-incident review. What is the main goal of this review?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to ECIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECIH” is a trademark of its owner, used for identification only.

Handling and Responding to Endpoint Security Incidents ECIH Practice Questions (Page 10)

Questions 46–50

An endpoint is exhibiting signs of compromise, but the antivirus software reports no threats. The system is running a critical application that cannot be interrupted. Which action is MOST appropriate to further investigate the potential compromise?

An organization has identified a malware outbreak on several endpoints. The incident response team needs to contain the spread while preserving evidence. Which containment strategy is most appropriate?

Following an endpoint incident, the incident response team conducts a post-incident review. What is the main goal of this review?

Keep studying — Insider Threats and Endpoint Incidents