A forensic investigator needs to collect evidence from a compromised Linux server. The server is still running, and the incident handler wants to preserve the current state. Which action is the most forensically sound first step?

Create a bit-for-bit image of the hard drive using a write-blocker.

Shut down the server gracefully before imaging.

Copy the files in the /tmp directory to a USB drive.

Run the 'history' command to capture the attacker's commands.

Following a phishing incident that compromised a user's laptop, the incident response team has completed containment and eradication. What is the MOST important next step to prevent similar incidents?

Change the user's password and do nothing else.

Conduct a post-incident review to identify gaps and update security policies and training.

Reimage the laptop and return it to the user immediately.

Delete all emails from the user's mailbox.

After a malware infection is contained, the incident handler needs to eradicate the malware from an affected server. The malware has created multiple scheduled tasks and modified registry keys. Which eradication step should be performed FIRST?

Disable the scheduled tasks and remove the registry modifications.

Reboot the server to clear the malware from memory.

Run a full antivirus scan and quarantine all detected files.

Delete the malware executable files from disk.

After a ransomware incident, the organization decides to restore data from backups. However, some backups are also encrypted. What is the BEST approach to recovery?

Restore from the most recent clean backup and then verify the integrity of the restored data.

Reimage all systems and accept the data loss.

Pay the ransom to obtain the decryption key.

Attempt to decrypt the encrypted backups using a free decryption tool.

EC-CouncilCertified Incident Handler

Domain 5Objective 2

Handling and Responding to Endpoint Security Incidents ECIH Practice Questions (Page 7)

Part of the Insider Threats and Endpoint Incidents domain, which makes up ~20% of our current practice bank.

50questions here

10free pages

6concepts

Questions 31–35

31application · easy
An incident handler is collecting evidence from a compromised Windows machine. The machine is still running, and the handler needs to capture volatile data. Which of the following should be collected FIRST?
Select an answer first
32application · medium
A forensic investigator needs to collect evidence from a compromised Linux server. The server is still running, and the incident handler wants to preserve the current state. Which action is the most forensically sound first step?
Select an answer first
33application · medium
Following a phishing incident that compromised a user's laptop, the incident response team has completed containment and eradication. What is the MOST important next step to prevent similar incidents?
Select an answer first
34application · medium
After a malware infection is contained, the incident handler needs to eradicate the malware from an affected server. The malware has created multiple scheduled tasks and modified registry keys. Which eradication step should be performed FIRST?
Select an answer first
35expert · hard
After a ransomware incident, the organization decides to restore data from backups. However, some backups are also encrypted. What is the BEST approach to recovery?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECIH” is a trademark of its owner, used for identification only.