212-89 Exam Dumps - EC Council Certified Incident Handler (ECIH v3)

In the scenario described, Stanley aims to ensure that the digital evidence he collected is admissible in court. This means the evidence must be gathered, handled, and presented in a manner that complies with legal standards, ensuring it can be legally used in a trial. Admissibility is a crucial characteristic of digital evidence, as it must be relevant, authentic, and obtained without violating any laws or rights to privacy. The evidence must also be presented in a clear and comprehensible manner to be understood by the members of the jury, which further supports its admissibility in court.

In the context of digital evidence investigation, volatility refers to how quickly data can change or be lost when power is removed or systems are altered. Among the options provided, cache is the most volatile because it is temporary storage that is designed to speed up access to data and is frequently overwritten. Cache data resides in RAM and includes things like memory buffers, system and network information, and process execution data, which are lost upon reboot or power loss. This contrasts with disks, emails, and temp files, which are considered less volatile because they are stored on permanent or semi-permanent media and are less likely to be immediately lost or overwritten.

Netcraft is a tool that provides internet security services, including the detection of phishing and spam emails. It offers a range of services that can help organizations identify fraudulent websites and phishing activities by analyzing web content and email messages for known phishing signatures and heuristics. This makes it a useful tool for incident handlers like Francis, who is tasked with detecting phishing and spam emails for client organizations. Other options listed, such as Nessus (a vulnerability scanner), BTCrack (a Bluetooth pin and link-key cracker), and Cain and Abel (a password recovery tool), do not specialize in detecting phishing or spam emails but serve different purposes in cybersecurity.

In incident response protocols, incidents are categorized based on their severity, impact, and the urgency of the response required. The categorization helps in prioritizing incident response activities and allocating resources accordingly. A CAT 1 (Category 1) incident is typically considered the highest priority, involving significant threats that require immediate response. Given the scenario where a malware incident in one of the largest social network companies must be reported within 1 hour of discovery/detection, this indicates a high-priority incident due to the potential widespread impact and the need for a rapid response to contain and mitigate the malware's spread. The urgency of the reporting timeframe suggests that the incident is considered critical, aligning with the characteristics of a CAT 1 incident, which necessitates immediate action to prevent significant damage or disruption to the company's operations and services.

Comprehensive and Detailed Explanation (ECIH-aligned):

This scenario involves active mobile spyware infections, representing an immediate confidentiality risk. The ECIH Endpoint and Mobile Incident Handling guidance prioritizes containment when active compromise is detected.

Option C is correct because disconnecting infected devices immediately prevents further data leakage and lateral movement. Initiating forensic analysis allows responders to determine scope, data accessed, and persistence mechanisms. ECIH emphasizes that containment must precede long-term control improvements.

Option A is preventive and strategic but not immediate. Option B addresses future behavior. Option D mitigates credential risk but does not stop spyware activity.

Thus, immediate isolation and forensic analysis is the correct first response.

Comprehensive and Detailed Explanation (ECIH-aligned):

This scenario reflects misuse of system resources, a category defined in ECIH network and endpoint incident classification.

Option C is correct because unauthorized software caused excessive CPU usage and system strain, violating acceptable use policies.

Options A, B, and D do not match the behavior described.

ECIH classifies such activity as a security incident because it impacts availability, performance, and risk exposure.

The first step in securing an employee's account following an email hacking incident involves restoring access to the email services if necessary and immediately changing the password to prevent unauthorized access. This action ensures that the attacker is locked out of the account as quickly as possible. While enabling two-factor authentication, scanning links and attachments, and disabling automatic file sharing are important security measures, they come into play after ensuring that the compromised account is first secured by changing its password to halt any ongoing unauthorized access.

An Inappropriate Usage incident refers to instances where computing resources are misused or abused, often violating organizational policies or laws. While access-control attacks, reconnaissance attacks, and denial-of-service (DoS) attacks represent different types of external threats or methods of attack, an Insider Threat is an example of inappropriate usage. Insider threats come from individuals within the organization, such as employees or contractors, who misuse their access to harm the organization's interests. This can include stealing confidential information, intentionally disrupting systems, or other malicious activities that leverage their legitimate access to the organization's resources.