Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 212-89 (EC-Council Certified Incident Handler) Practice Test 4

Question 30

A case closure review must correct this incident-management failure: The SOC calls every ATT&CK technique observed in logs a separate incident and loses the attack narrative. What is the appropriate procedural remediation for the gap described?

  1. Close documented gaps with exercised procedures and retained results
  2. Group related detections into a single managed incident when supported by evidence
  3. Build a cohesive intrusion timeline with mapped ATT&CK techniques
  4. Train analysts to separate analytic technique tags from incident identifiers

Explanation

Correct Answer

C:

A technique map helps explain behavior without replacing incident evidence; the correction restores accountability or sequence for how technique mapping relates to incident grouping before case sign-off.

Incorrect Answers

A:

Corrective evidence supports defensible claims about operational readiness; that method could help with the gap between guidance adoption and operational evidence; the procedural correction decision here involves how technique mapping relates to incident grouping.

B:

Correlation improves coordinated containment and avoids fragmented response; the case needs procedural correction addressing how technique mapping relates to incident grouping; temporary protection does not complete correction.

D:

Consistent taxonomy prevents misleading case counts; for how technique mapping relates to incident grouping, future hardening is not current-state recovery; procedural correction remains necessary.

Question 31

To prevent the next similar event, analysts review this case: A team treats an ISO/IEC 27035 guideline as proof that its incident response controls were implemented. Which preventive change targets the exact pathway that failed?

  1. Link each guidance requirement to an accountable control and test frequency
  2. Schedule periodic review of external standard references and change notices
  3. Inspect playbook tests, incident records and assigned responsibilities
  4. Close documented gaps with exercised procedures and retained results

Explanation

Correct Answer

A:

Traceability makes standards mappings measurable; this turns the weakness behind the gap between guidance adoption and operational evidence into a measurable prevention requirement.

Incorrect Answers

B:

Document owners can update playbooks when authoritative guidance changes; this serves whether cited incident-response guidance is current, whereas the requested result is readiness improvement involving the gap between guidance adoption and operational evidence.

C:

Actual execution records demonstrate implementation where a citation to guidance alone does not; an investigation is not recurrence prevention in the decision about the gap between guidance adoption and operational evidence.

D:

Corrective evidence supports defensible claims about operational readiness; the case needs readiness improvement addressing the gap between guidance adoption and operational evidence; case recovery is not future-risk control.

Question 32

A documented handling problem requires corrective follow-through: An orchestration playbook automatically isolates every host with a single low-confidence malware alert. What corrective record or operational change resolves this process weakness?

  1. Require analyst approval before high-impact isolation on ambiguous alerts
  2. Rebuild the workflow with snapshots, approvals and tested rollback
  3. Use risk-based automation tiers and rollback controls
  4. Test revised triggers against representative benign and malicious alerts
  5. Verify each downstream control acknowledged and applied the block
  6. Review the playbook trigger thresholds and isolation execution logs

Explanation

Correct Answer

D:

Simulation checks that the updated workflow reduces false containment; the affected handling process should be validated against the risk of excessive automated containment after the change.

Incorrect Answers

A:

A human gate limits business disruption while preserving rapid automated evidence gathering; when judging the risk of excessive automated containment, temporary protection does not complete correction; this is instead immediate response coordination.

B:

Sequenced response preserves investigation value before cleanup; that method could help with whether destructive automation has preservation safeguards; the procedural correction decision here involves the risk of excessive automated containment.

C:

Different thresholds for enrichment and disruptive action make orchestration safer; the requirement concerns the risk of excessive automated containment, so future hardening is not current-state recovery.

E:

Execution evidence distinguishes a submitted workflow from actual protection; that method could help with where manual coordination delays indicator response; the procedural correction decision here involves the risk of excessive automated containment.

F:

Comparing alert confidence to actions shows whether automation exceeded agreed risk tolerance; the case needs procedural correction addressing the risk of excessive automated containment; verification is not the corrective step.

Question 33

An incident-process audit asks for a defensible finding about this case: A compromised application host is still exchanging data with a known command server while forensic acquisition is scheduled. Which recorded evidence or practical test establishes the stated response-process issue?

  1. Apply egress allowlisting and alert on rare outbound destinations
  2. Block the malicious egress path while retaining appropriate forensic access
  3. Compare application transactions against known-good reconciliation results
  4. Correlate egress flows with process connections to confirm active command traffic

Explanation

Correct Answer

D:

Both data sources link the suspicious endpoint to ongoing outbound communication; this provides an auditable basis for the disputed finding: which action limits ongoing exfiltration.

Incorrect Answers

A:

Reducing unneeded paths limits future command-and-control options; the goal is process validation for which action limits ongoing exfiltration. Prevention is not incident verification.

B:

Selective isolation stops active communication without deliberately wiping the system; immediate protection does not substantiate findings in the decision about which action limits ongoing exfiltration.

C:

Boot success does not prove that business data and dependent workflows remain correct; it is meant to address what recovery validation must include, not process validation for which action limits ongoing exfiltration.

Question 34

An incident-process audit asks for a defensible finding about this case: A restored server passes a boot test but its business transactions fail integrity checks. Which assessment task resolves the central procedural uncertainty?

  1. Compare incident command approvals with each outbound statement
  2. Add integrity checks and business-owner sign-off to restoration testing
  3. Keep the server in a restricted validation segment until data integrity passes
  4. Compare application transactions against known-good reconciliation results

Explanation

Correct Answer

D:

Boot success does not prove that business data and dependent workflows remain correct; the review establishes what recovery validation must include so that responsibility and next decisions rest on a recorded result.

Incorrect Answers

A:

Missing authorization reveals why accounts of the event diverged; the activity targets what made external incident messaging inconsistent; process validation here concerns what recovery validation must include.

B:

A functional recovery gate catches failures missed by infrastructure checks; when judging what recovery validation must include, prevention is not incident verification; this is instead readiness improvement.

C:

Controlled access prevents unreliable service from affecting production users; for what recovery validation must include, immediate protection does not substantiate findings; process validation remains necessary.

Question 35

A case closure review must correct this incident-management failure: A service provider receives an alert but its contract lacks clear escalation and evidence-retention responsibilities. What documented correction must be verified before the procedural case closes?

  1. Reconcile all prior messages and artifacts into the case timeline
  2. Record shared responsibilities and preserve both parties' case artifacts
  3. Include notification SLAs, evidence access and rehearsal requirements in agreements
  4. Invoke emergency vendor contacts and establish a joint incident coordinator

Explanation

Correct Answer

B:

A unified timeline supports investigation despite separate infrastructures; procedural closure should resolve whether third-party handoffs are executable in the incident record, not just remove a visible symptom.

Incorrect Answers

A:

A complete record prevents decisions and evidence references from being lost; the relevant condition for that step is how incident recording supports traceability, which is not shown for whether third-party handoffs are executable.

C:

Specific obligations reduce dependency ambiguity during incidents; future hardening is not current-state recovery in the decision about whether third-party handoffs are executable.

D:

Named decision makers enable immediate scope and evidence coordination; the case needs procedural correction addressing whether third-party handoffs are executable; temporary protection does not complete correction.

Question 36

The response coordinator tests a weakness described in these records: A team treats an ISO/IEC 27035 guideline as proof that its incident response controls were implemented. Which recorded evidence or practical test establishes the stated response-process issue?

  1. Link each guidance requirement to an accountable control and test frequency
  2. Inspect playbook tests, incident records and assigned responsibilities
  3. Check the publication revision and supersession notice in NIST CSRC
  4. Commission a control effectiveness review rather than declaring compliance

Explanation

Correct Answer

B:

Actual execution records demonstrate implementation where a citation to guidance alone does not; this provides an auditable basis for the disputed finding: the gap between guidance adoption and operational evidence.

Incorrect Answers

A:

Traceability makes standards mappings measurable; the goal is process validation for the gap between guidance adoption and operational evidence. Prevention is not incident verification.

C:

NIST finalized Revision 3 in April 2025, replacing the 2012 guide; the activity targets whether cited incident-response guidance is current; process validation here concerns the gap between guidance adoption and operational evidence.

D:

Independent evaluation reveals untested steps before they are relied upon; when judging the gap between guidance adoption and operational evidence, immediate protection does not substantiate findings; this is instead immediate response coordination.

Question 37

A documented handling problem requires corrective follow-through: An incident spans EU customer records and an offshore vendor, but the runbook assumes one universal disclosure deadline. Choose THREE actions that separately diagnose the incident-handling deficiency, stabilize the response process and correct it before closure. (Choose THREE.)

  1. Record the assessed obligations and evidence behind each deadline
  2. Map affected data subjects, controllers, processors and relevant jurisdictions
  3. Establish data minimization and third-party sharing controls in playbooks
  4. Engage the designated privacy lead for jurisdiction-specific deadlines
  5. Maintain a reviewed jurisdiction-and-contract notification register
  6. Embed jurisdiction-specific privacy triggers in the response notification matrix

Explanation

Correct Answers

A:

A documented analysis supports consistent and timely communication; within the combined response for which legal requirements govern notification timing, this supplies procedural correction: the affected handling process should be validated against which legal requirements govern notification timing after the change.

B:

Obligations can differ by role, event, and applicable law; within the combined response for which legal requirements govern notification timing, this supplies process validation: this provides an auditable basis for the disputed finding: which legal requirements govern notification timing.

D:

Correct routing prevents imposing a generic timeline on every legal regime; within the combined response for which legal requirements govern notification timing, this supplies immediate response coordination: this protective or assignment decision directly addresses which legal requirements govern notification timing while response governance is still active.

Incorrect Answers

C:

Preauthorized paths prevent ad hoc disclosure during emergencies; the relevant condition for that step is what authorization governs external evidence sharing, which is not shown for which legal requirements govern notification timing.

E:

Legal and vendor requirements can be checked rapidly during an incident; when judging which legal requirements govern notification timing, future hardening is not current-state recovery; this is instead readiness improvement.

F:

Preplanned legal routing minimizes missed deadlines and unauthorized statements; it is meant to address whether notification requirements are factually triggered, not procedural correction for which legal requirements govern notification timing.

Question 38

The organization needs to repair the response procedure after: A monitoring alert is copied into email threads but never receives an incident identifier or accountable owner. Which follow-up would repair the reported response-management failure?

  1. Track detection and control fixes to evidence-backed completion
  2. Require intake forms with time, source, severity, affected assets and owner
  3. Reconcile all prior messages and artifacts into the case timeline
  4. Open a central incident record and assign an authorized handler

Explanation

Correct Answer

C:

A complete record prevents decisions and evidence references from being lost; the correction restores accountability or sequence for how incident recording supports traceability before case sign-off.

Incorrect Answers

A:

Measured remediation converts the review into preventive change; the other incident centers on what post-incident learning is missing, not this procedural correction question about how incident recording supports traceability.

B:

Consistent minimum fields improve triage and handoff; the requirement concerns how incident recording supports traceability, so future hardening is not current-state recovery.

D:

A single case record makes containment and escalation attributable; temporary protection does not complete correction in the decision about how incident recording supports traceability.

Question 39

A case closure review must correct this incident-management failure: A team deletes suspicious files immediately after receiving a legal request to preserve material from the affected server. What documented correction must be verified before the procedural case closes?

  1. Record the final validated scope, disposition and decision rationale
  2. Halt destructive steps and secure remaining evidence with documented custody
  3. Recover deleted artifacts from approved sources and document irretrievable gaps
  4. Add evidence-preservation decision points before eradication steps

Explanation

Correct Answer

C:

Transparent reconstruction distinguishes recovered data from missing original evidence; procedural closure should resolve why evidence collection must precede destructive remediation in the incident record, not just remove a visible symptom.

Incorrect Answers

A:

Closure requires corroborating evidence and documented review; this serves what triage must establish before closure, whereas the requested result is procedural correction involving why evidence collection must precede destructive remediation.

B:

Preservation protects evidentiary value while investigators assess what remains; the goal is procedural correction for why evidence collection must precede destructive remediation. Temporary protection does not complete correction.

D:

A documented hold gate prevents remediation from destroying needed artifacts; the case needs procedural correction addressing why evidence collection must precede destructive remediation; future hardening is not current-state recovery.

Question 40

A case commander must regain control of an open handling problem: An alert involving payment-card data was categorized low because only one host was affected. The manager needs a check that verifies the issue AND an immediate controlled assignment or safeguard. Which TWO case-specific steps fulfill those distinct roles? (Choose TWO.)

  1. Review affected data classification together with host criticality and exposure
  2. Escalate under the high-impact data-exposure criteria
  3. Reclassify affected cases using the agreed business-impact scale
  4. Include data sensitivity and regulatory triggers in triage scoring
  5. Reassess scope and record the corrected severity and response deadlines

Explanation

Correct Answers

A:

Business sensitivity can outweigh the number of visibly impacted machines; within the combined response for whether incident priority reflects business impact, this supplies process validation: this provides an auditable basis for the disputed finding: whether incident priority reflects business impact.

B:

Severity-based routing brings in the correct legal and technical decision makers early; within the combined response for whether incident priority reflects business impact, this supplies immediate response coordination: this protective or assignment decision directly addresses whether incident priority reflects business impact while response governance is still active.

Incorrect Answers

C:

Consistent severity supports defensible reporting across teams; the relevant condition for that step is how to normalize severity across organizational units, which is not shown for whether incident priority reflects business impact.

D:

Impact criteria prevent host-count-only severity mistakes; prevention cannot replace immediate action in the decision about whether incident priority reflects business impact.

E:

An impact-driven case update fixes the prioritization error before closure; the case needs immediate response coordination addressing whether incident priority reflects business impact; corrective follow-through follows initial protection.

EC-Council Certified Incident Handler (212-89) Practice Tests