After a network security incident has been resolved, the incident response team conducts a post-incident review. What is the primary goal of this review?

To delete all evidence related to the incident

To determine the financial cost of the incident

To assign blame to individuals for the incident

To identify lessons learned and improve future incident response

A security analyst discovers that a malware infection is spreading from one subnet to another through a shared network share. Which immediate containment action is most effective in limiting the spread?

Increasing the logging level on the firewall

Running a full antivirus scan on all servers

Disabling the network share and isolating the affected subnet

Notifying all users to change their passwords

A hospital's network team is handling three simultaneous incidents: (1) a ransomware outbreak on the administrative network, (2) a suspected malware infection on a single nurse-station computer, and (3) a phishing email reported by one user that has not been clicked. Which incident should be triaged as the highest priority?

The ransomware outbreak, because it affects a large number of systems and likely impacts patient care operations.

The single nurse-station computer, because it is in a patient-care area.

All three equally, because each requires immediate attention.

The phishing email, because it was reported and could lead to credential theft.

A security analyst discovers that a network switch has been compromised and is forwarding traffic to an unknown destination. The analyst needs to contain the incident while preserving evidence. Which action is MOST appropriate?

Reboot the switch to clear its memory

Disconnect the switch from the network and preserve its configuration

Update the switch firmware immediately

Change the switch's management password

During incident triage, a security analyst discovers a worm that is actively propagating across the internal network, infecting multiple servers that host critical business applications. Which factor should be given the highest priority when determining the urgency of this incident?

The number of users who have reported the issue

The speed at which the worm is spreading

The cost of the antivirus software used

The time of day the incident was detected

EC-CouncilCertified Incident Handler

Domain 3Objective 2

Handling and Responding to Network Security Incidents ECIH Practice Questions (Page 5)

Part of the Email and Network Security Incidents domain, which makes up ~21% of our current practice bank.

53questions here

11free pages

8concepts

Questions 21–25

21foundation · easy
After a network security incident has been resolved, the incident response team conducts a post-incident review. What is the primary goal of this review?
Select an answer first
22foundation · easy
A security analyst discovers that a malware infection is spreading from one subnet to another through a shared network share. Which immediate containment action is most effective in limiting the spread?
Select an answer first
23application · medium
A hospital's network team is handling three simultaneous incidents: (1) a ransomware outbreak on the administrative network, (2) a suspected malware infection on a single nurse-station computer, and (3) a phishing email reported by one user that has not been clicked. Which incident should be triaged as the highest priority?
Select an answer first
24application · medium
A security analyst discovers that a network switch has been compromised and is forwarding traffic to an unknown destination. The analyst needs to contain the incident while preserving evidence. Which action is MOST appropriate?
Select an answer first
25foundation · easy
During incident triage, a security analyst discovers a worm that is actively propagating across the internal network, infecting multiple servers that host critical business applications. Which factor should be given the highest priority when determining the urgency of this incident?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECIH” is a trademark of its owner, used for identification only.