A company's incident response plan defines phases as: Preparation, Detection, Containment, Eradication, Recovery, and Lessons Learned. During a ransomware attack, the team has isolated the infected systems and stopped the spread. According to the plan, what should the team do NEXT?

Proceed to eradication by removing the ransomware and remediating vulnerabilities.

Conduct a lessons-learned review immediately.

Begin recovery by restoring systems from backups.

Return the isolated systems to the network immediately.

What is the primary goal of a containment strategy during a malware incident?

To restore systems from backups immediately

To identify the root cause of the infection

To isolate infected systems and prevent the malware from spreading

To permanently delete all data on infected systems

EC-CouncilCertified Incident Handler

Domain 2Objective 2

Handling and Responding to Malware Incidents ECIH Practice Questions (Page 1)

Part of the First Response and Malware Incidents domain, which makes up ~22% of our current practice bank.

57questions here

12free pages

11concepts

Questions 1–5

1application · easy
A company's incident response plan defines phases as: Preparation, Detection, Containment, Eradication, Recovery, and Lessons Learned. During a ransomware attack, the team has isolated the infected systems and stopped the spread. According to the plan, what should the team do NEXT?
Select an answer first
2application · medium
Several employees in the finance department received emails with a ZIP attachment that, when opened, launches a PowerShell script. The script downloads a payload from a file-sharing site and establishes persistence via a scheduled task. Which classification best describes this malware?
Select an answer first
3foundation · easy
Which of the following is a common malware infection vector?
Select an answer first
4foundation · easy
What is the primary goal of a containment strategy during a malware incident?
Select an answer first
5foundation · easy
During which phase of malware incident response does the team focus on isolating infected systems to prevent the malware from spreading?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECIH” is a trademark of its owner, used for identification only.

Handling and Responding to Malware Incidents ECIH Practice Questions (Page 1)

Questions 1–5

A company's incident response plan defines phases as: Preparation, Detection, Containment, Eradication, Recovery, and Lessons Learned. During a ransomware attack, the team has isolated the infected systems and stopped the spread. According to the plan, what should the team do NEXT?

Several employees in the finance department received emails with a ZIP attachment that, when opened, launches a PowerShell script. The script downloads a payload from a file-sharing site and establishes persistence via a scheduled task. Which classification best describes this malware?

Which of the following is a common malware infection vector?

What is the primary goal of a containment strategy during a malware incident?

During which phase of malware incident response does the team focus on isolating infected systems to prevent the malware from spreading?

Keep studying — First Response and Malware Incidents