After a malware incident has been fully contained and eradicated, the incident response team is conducting a post-incident review. Which activity is the PRIMARY focus of this phase?

Deleting all logs related to the incident to free up storage

Reimaging all affected systems from a clean image

Immediately returning all systems to normal operation

Identifying gaps in the incident response process and implementing improvements

Which of the following best defines a malware incident in the context of incident response?

Any event where malicious software is detected on or affects an organization's systems, potentially causing disruption, data loss, or unauthorized access.

Any alert generated by an antivirus product, regardless of whether the detection is a false positive.

A situation where an employee accidentally deletes important files without any malicious intent.

An event where an attacker physically gains access to a data center and installs unauthorized hardware.

After a malware infection, the incident response team has identified the malware as a rootkit that hides its files and processes. The team has a clean backup from before the infection, but the backup is 30 days old. The server has been reimaged with the latest OS and applications. What is the MOST reliable way to ensure the rootkit is completely eradicated?

Restore the entire backup including system files.

Reimage the server from a trusted source and then restore only verified clean data from the backup.

Run a rootkit removal tool on the reimaged server.

Use the backup to restore the server and then update all software.

A user reports that their workstation is running slowly and showing pop-up ads. The security team finds a process named 'svch0st.exe' in the user's profile directory and network connections to a known ad-serving domain. The file has a valid digital signature from a legitimate software vendor. What should the incident handler do FIRST?

Block the ad-serving domain at the firewall and continue monitoring.

Disable the digital signature verification for the process.

Quarantine the workstation and collect a memory image before terminating the process.

Delete the file and run a full antivirus scan on the workstation.

Which of the following is an example of a containment action?

Formatting the hard drive of the infected system

Disconnecting an infected workstation from the network

Running a full antivirus scan on the infected system

EC-CouncilCertified Incident Handler

Domain 2Objective 2

Handling and Responding to Malware Incidents ECIH Practice Questions (Page 6)

Part of the First Response and Malware Incidents domain, which makes up ~22% of our current practice bank.

57questions here

12free pages

11concepts

Questions 26–30

26application · medium
After a malware incident has been fully contained and eradicated, the incident response team is conducting a post-incident review. Which activity is the PRIMARY focus of this phase?
Select an answer first
27foundation · easy
Which of the following best defines a malware incident in the context of incident response?
Select an answer first
28expert · hard
After a malware infection, the incident response team has identified the malware as a rootkit that hides its files and processes. The team has a clean backup from before the infection, but the backup is 30 days old. The server has been reimaged with the latest OS and applications. What is the MOST reliable way to ensure the rootkit is completely eradicated?
Select an answer first
29application · medium
A user reports that their workstation is running slowly and showing pop-up ads. The security team finds a process named 'svch0st.exe' in the user's profile directory and network connections to a known ad-serving domain. The file has a valid digital signature from a legitimate software vendor. What should the incident handler do FIRST?
Select an answer first
30foundation · easy
Which of the following is an example of a containment action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECIH” is a trademark of its owner, used for identification only.

Handling and Responding to Malware Incidents ECIH Practice Questions (Page 6)

Questions 26–30

After a malware incident has been fully contained and eradicated, the incident response team is conducting a post-incident review. Which activity is the PRIMARY focus of this phase?

Which of the following best defines a malware incident in the context of incident response?

Which of the following is an example of a containment action?

Keep studying — First Response and Malware Incidents