212-89 Exam Dumps - EC Council Certified Incident Handler (ECIH v3)

In the context of digital evidence investigation, volatility refers to how quickly data can change or be lost when power is removed or systems are altered. Among the options provided, cache is the most volatile because it is temporary storage that is designed to speed up access to data and is frequently overwritten. Cache data resides in RAM and includes things like memory buffers, system and network information, and process execution data, which are lost upon reboot or power loss. This contrasts with disks, emails, and temp files, which are considered less volatile because they are stored on permanent or semi-permanent media and are less likely to be immediately lost or overwritten.

Aaron is preserving trace-level physical evidence that may help establish attribution. ECIH first-response procedures emphasize securing and documenting the incident scene, preventing evidence contamination, recording the original location and condition of items, and preserving evidence before collection and transportation. Fingerprints, residue, and other physical traces can potentially associate a person with devices or media involved in an incident. Wearing gloves, limiting access, documenting positions, and protecting surfaces are therefore appropriate preservation measures. RAM acquisition concerns volatile digital information stored in powered systems and is not the activity described here. Digital chain of custody is important, but the scenario specifically concentrates on preventing contamination of physical traces rather than merely documenting possession of devices. Capturing live sessions is also unrelated. The responder is primarily protecting attribution-relevant physical evidence.

================

Explanation (OT/IoT incident handling):

For smart grid and IoT/OT environments, the first step is to activate the dedicated incident response process that prioritizes safety and continuity while isolating affected components. Immediate shutdown (A) can create operational and safety consequences and should be reserved for clear safety threats. Firmware updates (B) are risky during an active incident; updating can brick devices, change system states, and destroy evidence while not guaranteeing removal of compromise. Third-party engagement (D) can help, but it’s not the first operational step—your internal playbook must begin containment now.

(C) correctly focuses on isolating affected devices/segments, limiting lateral movement, and preserving operational stability. In practice, this can include network segmentation, blocking suspicious outbound communications, switching to manual controls where necessary, and capturing logs/telemetry before making changes. This aligns with common containment strategy: stop spread first, then analyze/eradicate, then recover with validated clean states.

The ECIH Forensic Readiness module defines chain of custody as a documented trail showing who collected, handled, transferred, and stored evidence. Maintaining this record is essential for legal admissibility.

Option C is correct because Liam’s actions—labeling, logging, photographing, and documenting custody transfers—directly establish and maintain chain of custody. ECIH stresses that without proper chain-of-custody documentation, evidence may be challenged or dismissed in legal proceedings.

Options A, B, and D are unrelated to evidence tracking.

Thus, Liam is demonstrating proper chain-of-custody management.

Shally has incorporated the Defense-in-depth strategy into the incident response plan for Texas Pvt. Ltd. Defense-in-depth is a layered security approach that involves implementing multiple security measures and controls throughout an information system. This strategy is designed to provide several defensive barriers to protect against threats and attacks, ensuring that if one layer is compromised, others still provide protection. The goal is to create a multi-faceted defense that addresses potential vulnerabilities in various areas, including physical security, network security, application security, and user education.

The immediate priority is containment. Because malware is actively modifying information inside the communication environment, segregating the affected networks limits further propagation, prevents additional manipulation, and separates compromised systems from trusted infrastructure. ECIH malware incident handling follows a structured process in which responders identify and validate the incident, contain malicious activity, eradicate the threat, and then recover affected services. Using the AI checker may help identify altered content, but correcting content while malware remains active does not eliminate the threat. Rolling back the upgrade before containment could restore vulnerable or infected components and may destroy useful forensic evidence. Public notification may become appropriate after impact assessment but does not stop the malware. Therefore, network segregation provides the most effective immediate action by limiting the malware ' s operational scope before eradication and recovery activities begin.

================

This question is based on the shared responsibility model, a fundamental concept in ECIH cloud incident handling. While customers manage applications, configurations, and data, the cloud service provider (CSP) controls the underlying infrastructure, including orchestration engines, schedulers, and runtime environments.

System-level telemetry such as hypervisor activity and orchestration logs cannot be accessed by customers. Only the CSP can provide this visibility. Therefore, Option C is correct.

The other options manage higher-level responsibilities but lack authority over infrastructure-layer components.