What is the primary goal of the containment phase in an insider threat response plan?

To identify the root cause of the incident

To collect evidence for legal proceedings

To limit the damage and prevent further unauthorized access

To restore systems to normal operation

During an insider threat investigation, the incident response team needs to collect the suspect's laptop as evidence. The laptop is currently powered on and the user is logged in. Which step should the team take to preserve digital evidence in a defensible manner?

Copy all user files to a network share and then return the laptop to the user

Photograph the screen, then shut down the laptop using the operating system's shutdown command

Immediately unplug the laptop from the power source to prevent remote wiping

Perform a live acquisition of volatile data, then create a forensic image of the hard drive

A company has experienced a data breach caused by a negligent employee who fell for a phishing email. To prevent similar incidents, which control would be MOST effective?

Implement security awareness training and phishing simulations

Increase password complexity requirements

Deploy a next-generation firewall

EC-CouncilCertified Incident Handler

Domain 5Objective 1

Handling and Responding to Insider Threats ECIH Practice Questions (Page 1)

Part of the Insider Threats and Endpoint Incidents domain, which makes up ~20% of our current practice bank.

46questions here

10free pages

7concepts

Questions 1–5

1foundation · easy
What is the primary goal of the containment phase in an insider threat response plan?
Select an answer first
2foundation · easy
An employee who accidentally clicks a phishing link and unknowingly provides their credentials to an attacker is best classified as which type of insider?
Select an answer first
3application · medium
During an insider threat investigation, the incident response team needs to collect the suspect's laptop as evidence. The laptop is currently powered on and the user is logged in. Which step should the team take to preserve digital evidence in a defensible manner?
Select an answer first
4application · medium
A company has experienced a data breach caused by a negligent employee who fell for a phishing email. To prevent similar incidents, which control would be MOST effective?
Select an answer first
5foundation · easy
Who should be notified first when an insider threat incident is suspected?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECIH” is a trademark of its owner, used for identification only.

Handling and Responding to Insider Threats ECIH Practice Questions (Page 1)

Questions 1–5

What is the primary goal of the containment phase in an insider threat response plan?

An employee who accidentally clicks a phishing link and unknowingly provides their credentials to an attacker is best classified as which type of insider?

During an insider threat investigation, the incident response team needs to collect the suspect's laptop as evidence. The laptop is currently powered on and the user is logged in. Which step should the team take to preserve digital evidence in a defensible manner?

A company has experienced a data breach caused by a negligent employee who fell for a phishing email. To prevent similar incidents, which control would be MOST effective?

Who should be notified first when an insider threat incident is suspected?

Keep studying — Insider Threats and Endpoint Incidents