In incident communication, what is the primary reason for establishing a single point of contact (SPOC) for external parties, such as law enforcement or the media?

To reduce the workload of the incident response team

To keep the incident details confidential from internal staff

To ensure consistent and controlled messaging

To speed up the incident response process

During a network incident, the incident handler collects packet captures, system logs, and memory dumps from affected hosts. The handler is preparing to document the incident. What is the most important documentation practice to follow?

Record the time, source, and method of collection for each piece of evidence.

Delete any logs that contain sensitive information to protect privacy.

Summarize the incident in a single paragraph for the final report.

Store all evidence in a shared folder accessible to all employees.

A manufacturing company detects an internal host communicating with an external C2 server. The host is part of a production line that cannot be taken offline without halting manufacturing. The incident handler needs to contain the threat while preserving the ability to continue production. Which containment strategy is most appropriate?

Disconnect the host from the network immediately.

Do nothing until the end of the production shift.

Block the C2 domain at the firewall and monitor the host for further activity.

Shut down the host and rebuild it from a clean image.

After a network breach, the incident response team has eradicated the malware and removed the attacker's access. However, the root cause was an unpatched vulnerability in a third-party application that cannot be patched immediately because it would break a critical business process. What is the BEST eradication approach?

Reinstall the application from a clean backup

Apply a virtual patch or compensating control to mitigate the vulnerability

Increase monitoring on the application and accept the risk

Disable the third-party application until the patch is available

In incident documentation, what is the primary purpose of recording the chain of custody for evidence?

To identify the attacker's identity

To track the cost of the incident

To determine the severity of the incident

To ensure the evidence is admissible in court

EC-CouncilCertified Incident Handler

Domain 3Objective 2

Handling and Responding to Network Security Incidents ECIH Practice Questions (Page 3)

Part of the Email and Network Security Incidents domain, which makes up ~21% of our current practice bank.

53questions here

11free pages

8concepts

Questions 11–15

11foundation · easy
In incident communication, what is the primary reason for establishing a single point of contact (SPOC) for external parties, such as law enforcement or the media?
Select an answer first
12application · medium
During a network incident, the incident handler collects packet captures, system logs, and memory dumps from affected hosts. The handler is preparing to document the incident. What is the most important documentation practice to follow?
Select an answer first
13application · medium
A manufacturing company detects an internal host communicating with an external C2 server. The host is part of a production line that cannot be taken offline without halting manufacturing. The incident handler needs to contain the threat while preserving the ability to continue production. Which containment strategy is most appropriate?
Select an answer first
14expert · hard
After a network breach, the incident response team has eradicated the malware and removed the attacker's access. However, the root cause was an unpatched vulnerability in a third-party application that cannot be patched immediately because it would break a critical business process. What is the BEST eradication approach?
Select an answer first
15foundation · easy
In incident documentation, what is the primary purpose of recording the chain of custody for evidence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECIH” is a trademark of its owner, used for identification only.

Handling and Responding to Network Security Incidents ECIH Practice Questions (Page 3)

Questions 11–15

In incident communication, what is the primary reason for establishing a single point of contact (SPOC) for external parties, such as law enforcement or the media?

During a network incident, the incident handler collects packet captures, system logs, and memory dumps from affected hosts. The handler is preparing to document the incident. What is the most important documentation practice to follow?

In incident documentation, what is the primary purpose of recording the chain of custody for evidence?

Keep studying — Email and Network Security Incidents