During a malware incident, the incident response team has successfully contained the infection and is now in the eradication phase. Which activity is part of the eradication phase?

Conducting a lessons-learned meeting

Monitoring network traffic for signs of reinfection

Removing the malware from all affected systems

What is the primary objective of the eradication phase in malware incident response?

To remove the malware and remediate the vulnerabilities that allowed the infection

To restore systems from backups

To isolate the infected systems from the network

To collect forensic evidence from the infected systems

Which of the following is a technique used to detect a potential malware infection on a system?

Deleting system logs to free up space

Monitoring for unusual network traffic patterns

Disabling the firewall to allow all traffic

Which of the following is a typical output of a post-incident review?

A new malware signature for antivirus products

A backup of all infected systems

A list of all employees who were involved in the incident

A report documenting lessons learned and recommended improvements

Which of the following is an example of static malware analysis?

Running the malware in a sandbox to observe its behavior

Monitoring network traffic generated by the malware

Observing changes to the file system while the malware runs

Examining the malware's file structure and strings without executing it

EC-CouncilCertified Incident Handler

Domain 2Objective 2

Handling and Responding to Malware Incidents ECIH Practice Questions (Page 10)

Part of the First Response and Malware Incidents domain, which makes up ~22% of our current practice bank.

57questions here

12free pages

11concepts

Questions 46–50

46application · medium
During a malware incident, the incident response team has successfully contained the infection and is now in the eradication phase. Which activity is part of the eradication phase?
Select an answer first
47foundation · easy
What is the primary objective of the eradication phase in malware incident response?
Select an answer first
48foundation · easy
Which of the following is a technique used to detect a potential malware infection on a system?
Select an answer first
49foundation · easy
Which of the following is a typical output of a post-incident review?
Select an answer first
50foundation · easy
Which of the following is an example of static malware analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECIH” is a trademark of its owner, used for identification only.