During a network incident, a security analyst identifies a compromised internal server that is communicating with an external C2 server. The analyst needs to contain the incident while preserving evidence for forensic analysis. Which action BEST achieves this?

Power off the server immediately

Change the server's local administrator password

Disconnect the server from the network at the switch level

Block the C2 IP address in the firewall

A network administrator notices a sudden spike in outbound traffic from a single workstation to an external IP address on port 443, along with the workstation repeatedly attempting to resolve a domain name that is not in the organization's DNS records. Which classification best matches these symptoms?

Distributed denial-of-service attack

Command-and-control communication

During a network security incident, the incident response team needs to inform the organization's management about the incident's impact and the actions being taken. What is the most appropriate way to communicate this information?

Provide a concise status update that includes the impact, current actions, and next steps

Wait until the incident is fully resolved before communicating

Post the details on the company's public website

Share all technical details of the attack with management

A hospital's network is infected with ransomware that is spreading rapidly. The incident handler must contain the outbreak, but the hospital cannot afford to shut down its entire network because patient care depends on it. Which containment strategy is most appropriate?

Isolate the affected network segments while keeping critical patient-care systems operational.

Block all outbound traffic to the internet.

Shut down the entire network to stop the spread.

Disconnect all servers and workstations from the network.

An organization has limited incident response staff. Two incidents occur simultaneously: (1) a suspected data exfiltration from a finance server, and (2) a ransomware infection on a single user's workstation. The finance server is critical but the exfiltration appears slow. The workstation user is a CEO. What should the incident commander prioritize?

Both incidents equally, splitting the team

The ransomware, because it is more visible

The CEO's workstation, because of the executive's importance

The finance server exfiltration, because it involves sensitive data

EC-CouncilCertified Incident Handler

Domain 3Objective 2

Handling and Responding to Network Security Incidents ECIH Practice Questions (Page 10)

Part of the Email and Network Security Incidents domain, which makes up ~21% of our current practice bank.

53questions here

11free pages

8concepts

Questions 46–50

46application · medium
During a network incident, a security analyst identifies a compromised internal server that is communicating with an external C2 server. The analyst needs to contain the incident while preserving evidence for forensic analysis. Which action BEST achieves this?
Select an answer first
47foundation · easy
A network administrator notices a sudden spike in outbound traffic from a single workstation to an external IP address on port 443, along with the workstation repeatedly attempting to resolve a domain name that is not in the organization's DNS records. Which classification best matches these symptoms?
Select an answer first
48foundation · easy
During a network security incident, the incident response team needs to inform the organization's management about the incident's impact and the actions being taken. What is the most appropriate way to communicate this information?
Select an answer first
49expert · hard
A hospital's network is infected with ransomware that is spreading rapidly. The incident handler must contain the outbreak, but the hospital cannot afford to shut down its entire network because patient care depends on it. Which containment strategy is most appropriate?
Select an answer first
50expert · hard
An organization has limited incident response staff. Two incidents occur simultaneously: (1) a suspected data exfiltration from a finance server, and (2) a ransomware infection on a single user's workstation. The finance server is critical but the exfiltration appears slow. The workstation user is a CEO. What should the incident commander prioritize?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECIH” is a trademark of its owner, used for identification only.

Handling and Responding to Network Security Incidents ECIH Practice Questions (Page 10)

Questions 46–50

During a network incident, a security analyst identifies a compromised internal server that is communicating with an external C2 server. The analyst needs to contain the incident while preserving evidence for forensic analysis. Which action BEST achieves this?

During a network security incident, the incident response team needs to inform the organization's management about the incident's impact and the actions being taken. What is the most appropriate way to communicate this information?

A hospital's network is infected with ransomware that is spreading rapidly. The incident handler must contain the outbreak, but the hospital cannot afford to shut down its entire network because patient care depends on it. Which containment strategy is most appropriate?

Keep studying — Email and Network Security Incidents