A security analyst detects a suspicious process on a server that is communicating with an external command-and-control server. The server hosts a critical application that cannot be taken offline. What is the best containment strategy that balances risk and business continuity?

Disconnect the server from the network entirely.

Kill the suspicious process and continue monitoring.

Block the outbound connection to the C2 IP at the firewall and isolate the server on a separate VLAN.

Immediately shut down the server to stop the communication.

Following the eradication of malware from an endpoint, the system is restored to a secure operational state. Which action is essential during the recovery phase?

Restoring data from a known-good backup

Reconnecting the system to the network without verification

A zero-day vulnerability is being exploited on a critical endpoint. The vendor has not released a patch, and the endpoint cannot be taken offline. Which containment measure is MOST appropriate under these constraints?

Upgrade the endpoint's operating system.

Disconnect the endpoint from the network.

Apply a virtual patch or intrusion prevention system (IPS) rule to block the exploit traffic.

Wait for the vendor to release a patch.

An incident report must be shared with law enforcement, senior management, and the legal department. Each audience has different needs. What is the BEST way to structure the reporting?

Create separate reports tailored to each audience's level of technical detail and legal requirements.

Publish the report on the company's internal wiki for transparency.

Send the same detailed technical report to all parties.

Provide only a verbal summary to all parties.

After an endpoint incident, the security team wants to implement lessons learned. Which action best exemplifies this?

Updating endpoint detection rules based on the incident's IOCs

Rebuilding the affected endpoint

Changing the incident responder's job title

Deleting the incident report to avoid confusion

EC-CouncilCertified Incident Handler

Domain 5Objective 2

Handling and Responding to Endpoint Security Incidents ECIH Practice Questions (Page 2)

Part of the Insider Threats and Endpoint Incidents domain, which makes up ~20% of our current practice bank.

50questions here

10free pages

6concepts

Questions 6–10

6application · medium
A security analyst detects a suspicious process on a server that is communicating with an external command-and-control server. The server hosts a critical application that cannot be taken offline. What is the best containment strategy that balances risk and business continuity?
Select an answer first
7foundation · easy
Following the eradication of malware from an endpoint, the system is restored to a secure operational state. Which action is essential during the recovery phase?
Select an answer first
8expert · hard
A zero-day vulnerability is being exploited on a critical endpoint. The vendor has not released a patch, and the endpoint cannot be taken offline. Which containment measure is MOST appropriate under these constraints?
Select an answer first
9expert · hard
An incident report must be shared with law enforcement, senior management, and the legal department. Each audience has different needs. What is the BEST way to structure the reporting?
Select an answer first
10foundation · easy
After an endpoint incident, the security team wants to implement lessons learned. Which action best exemplifies this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECIH” is a trademark of its owner, used for identification only.