212-89 Exam Dumps - EC Council Certified Incident Handler (ECIH v3)

A permissive security policy is characterized by allowing all activities except those that are explicitly blocked. This approach starts with a default state of allowing access and functionality, with restrictions applied only to known dangerous services, attacks, or behaviors. Such a policy can lead to a wider attack surface because it assumes services and behaviors are safe unless proven otherwise.

A prudent policy would typically involve more conservative security measures, applying necessary restrictions to protect against identified and potential threats.

A paranoic policy would be at the extreme end of security measures, possibly blocking more than necessary to ensure the highest level of security, often at the expense of usability or functionality.

A promiscuous policy, in contrast, would be even more open than a permissive policy, essentially allowing nearly all traffic or actions with minimal restrictions, which is not what Rica observed.

This scenario requires decisive action across containment, analysis, and recovery, as defined in the ECIH incident handling lifecycle.

Option C is correct because isolating affected systems prevents further manipulation, forensic examination identifies scope and method, and restoring from a verified clean backup ensures data integrity. ECIH emphasizes verified restoration only after investigation begins.

Options A, B, and D are premature or speculative and risk misinformation.

When a corporate network ' s servers are sending huge amounts of traffic to a specific website, as detected by the network ' s Intrusion Prevention System (IPS), this behavior is indicative of a Botnet attack. A Botnet is a network of compromised computers, often referred to as " bots, " that are controlled remotely by an attacker, typically without the knowledge of the owners of the computers. The attacker can command these bots to execute distributed denial-of-service (DDoS) attacks, send spam, or conduct other malicious activities. In this scenario, the servers behaving as bots and targeting a website with large volumes of traffic suggests that they have been co-opted into a Botnet to potentially perform a DDoS attack on the website abc.xyz.

ECIH v3 forensic-readiness principles emphasize maintaining evidence integrity through forensic imaging, cryptographic hash verification, secure storage, and documented chain of custody. Creating a forensic image preserves a bit-for-bit representation of the original media while allowing investigators to work from a controlled copy. Calculating and verifying cryptographic hashes establishes that the forensic image has not changed between acquisition, storage, transport, and later examination. Encrypting the evidence media protects confidentiality, while a detailed transport log establishes accountability throughout custody transfers. Physical packaging and tamper-evident controls are important, but they do not independently demonstrate that the digital content remained unchanged. Uploading original evidence or performing unnecessary transfers can introduce additional handling risks. Therefore, verified forensic imaging combined with secure storage and detailed documentation provides the strongest evidence-integrity protection.

================

James is working on the post-incident activities stage of the Incident Handling and Response (IH & R) process. After containing the spread of the infection and removing the malware, the focus shifts to assessing the impact of the incident on the organization and preparing a detailed report. This phase involves analyzing the extent of the damage, determining the cost of the attack, evaluating how well the incident was managed, and identifying lessons learned to improve future response efforts. The objective is to restore systems to normal operation, ensure no remnants of the threat remain, and implement measures to prevent recurrence.