212-89 Exam Preparation Material | EC Council Certified Incident Handler (ECIH v2)

Explanation:
Comprehensive and Detailed Explanation (ECIH-aligned):
The described symptoms―numerous incomplete TCP connections consuming server resources―are characteristic of a SYN flood attack, a denial-of-service technique targeting the transport layer. In such attacks, attackers send SYN packets without completing the TCP handshake, leaving servers overwhelmed with half-open connections.
ECIH network incident handling guidance emphasizes rapid identification and containment of DoS conditions to preserve service availability. By configuring the router to validate connection requests (for example, using SYN cookies or proxy validation), illegitimate handshake attempts are filtered before reaching the server.
Option A involves payload inspection, which is irrelevant here.
Option B relates to authentication attacks, which require completed connections.
Option D is a detection activity, not mitigation.
Therefore, the purpose of Sophia’s action was to block SYN flood attempts, making Option C correct.

Explanation:
By classifying and encrypting customer Personally Identifiable Information (PHI), you are specifically guarding against the risk of Sensitive Data Exposure. This OWASP security risk involves the accidental or unlawful exposure of protected data to unauthorized individuals. Encryption serves as a critical defense mechanism by ensuring that, even if data is accessed without authorization, it remains unintelligible and useless to the attacker without the decryption keys. Data classification further supports this by identifying which data is sensitive and requires such protections, ensuring that appropriate security controls are applied to prevent exposure.
Reference: OWASP Top 10, a widely respected document that outlines the most critical web application security risks, identifies Sensitive Data Exposure as a key risk area. Incident Handler (ECIH v3) courses and study guides often refer to the OWASP Top 10 to explain common web security risks and appropriate countermeasures, including the importance of encrypting sensitive data.

Explanation:
Comprehensive and Detailed Explanation (ECIH-aligned):
This incident involves malware actively impacting medical devices, posing patient safety risks. According to ECIH malware incident handling principles, the first priority is containment and eradication at the endpoint level.
Option D is correct because deploying endpoint protection directly detects and halts malware execution on the MRI machines, stopping both manipulation of results and further malicious activity. Endpoint containment is essential before network-level or recovery actions.
Option B addresses communication but does not stop local manipulation.
Option C alters system state without containment.
Option A is a regulatory step that follows validation.
ECIH emphasizes that in critical infrastructure and healthcare environments, immediate endpoint containment is essential to protect safety and data integrity.

Explanation:
Comprehensive and Detailed Explanation (ECIH-aligned):
Advanced persistent threats require coordinated, intelligence-driven response. ECIH emphasizes that APT investigations generate massive volumes of telemetry across endpoints, networks, and cloud platforms.
Option D is correct because Incident Response Automation and Orchestration (IRAO) tools correlate disparate data sources, automate enrichment, and accelerate threat hunting. This enables responders to identify hidden persistence mechanisms and attacker TTPs efficiently.
Options A, B, and C are important but not immediate investigative actions.
ECIH explicitly recommends orchestration platforms for complex, multi-vector incidents such as APTs.

Explanation:
Live data acquisition is the process of collecting volatile data from a system that is still running. Volatile data includes information stored in system memory (RAM), cache, and system and network configuration settings that are lost when the system is powered off. This method is essential for capturing data that can provide insights into the state of the system at the time of an incident, including active network connections, running processes, and the contents of memory. Marley must employ live data acquisition to ensure that this crucial and ephemeral data is not lost, which can be pivotal in understanding and responding to the incident effectively.
Reference: The concept of live data acquisition is discussed in the ECIH v3 certification program by EC-Council, which emphasizes its importance in the context of incident handling and response for capturing volatile information that could be critical to the investigation.