A company's help desk receives multiple reports from users that their files are being encrypted and a ransom note is displayed. The security team confirms that a ransomware variant is spreading through the network. Which statement BEST defines this as a malware incident?

An event that compromises the confidentiality, integrity, or availability of systems or data through malicious software.

An event that causes a temporary slowdown of network performance.

An event that requires the help desk to reset user passwords.

An event that triggers a security alert but does not affect business operations.

What is the purpose of maintaining a chain of custody for forensic evidence?

To determine the malware's origin

To speed up the analysis process

To document who handled the evidence and ensure it has not been tampered with

To encrypt the evidence for storage

A small business experiences a ransomware attack that encrypts files on several file servers. The company has no backups and the attacker demands payment. Which statement BEST describes the impact of this malware incident on the organization?

The organization can simply reinstall the operating system to recover all data

The organization may face significant data loss and operational disruption

The organization should immediately pay the ransom to recover data

The incident has no impact because the attacker only encrypted files

Which of the following is a key principle of forensic evidence collection during a malware incident?

Deleting suspicious files to prevent further infection

Preserving the integrity of evidence through proper handling and documentation

Using the infected system to analyze the malware in place

Collecting as much data as possible without regard to its relevance

EC-CouncilCertified Incident Handler

Domain 2Objective 2

Handling and Responding to Malware Incidents ECIH Practice Questions (Page 4)

Part of the First Response and Malware Incidents domain, which makes up ~22% of our current practice bank.

57questions here

12free pages

11concepts

Questions 16–20

16foundation · easy
A user downloads a file that appears to be a PDF but is actually an executable that installs a backdoor. Which type of malware is this?
Select an answer first
17application · medium
A company's help desk receives multiple reports from users that their files are being encrypted and a ransom note is displayed. The security team confirms that a ransomware variant is spreading through the network. Which statement BEST defines this as a malware incident?
Select an answer first
18foundation · easy
What is the purpose of maintaining a chain of custody for forensic evidence?
Select an answer first
19application · medium
A small business experiences a ransomware attack that encrypts files on several file servers. The company has no backups and the attacker demands payment. Which statement BEST describes the impact of this malware incident on the organization?
Select an answer first
20foundation · easy
Which of the following is a key principle of forensic evidence collection during a malware incident?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECIH” is a trademark of its owner, used for identification only.