EC-Council ECIH QUESTIONS AND ANSWERS |
VERIFIED AND WELL DETAILED ANSWERS | PLUS
RATIONALES | GUARANTEED PASS | LATEST EXAM
UPDATE | EXAM PREP | STUDY GUIDE | PRACTICE
TEST
,Domain 1: Introduction to Incident Handling and Response (Q1–Q15)
Q1. What is the primary objective of incident handling?
A) To punish the attacker
B) To restore normal operations securely and minimize impact
C) To identify the attacker's identity
D) To unplug all network cables
Answer: B
Rationale: Incident handling focuses on containment, eradication, recovery, and lessons learned. Attribution and
punishment are secondary (and often impossible), while restoring secure operations is the core goal.
Q2. Which of the following BEST defines an "event"?
A) A confirmed data breach
B) Any observable occurrence in a system or network
,C) A violation of security policy
D) A malware infection
Answer: B
Rationale: An event is any observable occurrence. An incident is an event (or series of events) that actually or
potentially jeopardizes confidentiality, integrity, or availability.
Q3. What is the difference between an event and an incident?
A) They are the same thing
B) An incident is any logged event; an event is a breach
C) An incident is an event that negatively impacts or threatens to impact security
D) An event only occurs on endpoints
Answer: C
Rationale: All incidents are events, but not all events are incidents. An incident has a negative security impact.
Q4. Which phase of the incident handling lifecycle comes immediately after "Identification"?
A) Eradication
, B) Containment
C) Recovery
D) Lessons Learned
Answer: B
Rationale: The typical ECIH lifecycle: Preparation → Identification → Containment → Eradication → Recovery
→ Lessons Learned (Post-Incident).
Q5. What is the FIRST step in the incident handling process?
A) Containment
B) Preparation
C) Eradication
D) Notification
Answer: B
Rationale: Preparation establishes policies, tools, communication plans, and team readiness before an incident
occurs.
VERIFIED AND WELL DETAILED ANSWERS | PLUS
RATIONALES | GUARANTEED PASS | LATEST EXAM
UPDATE | EXAM PREP | STUDY GUIDE | PRACTICE
TEST
,Domain 1: Introduction to Incident Handling and Response (Q1–Q15)
Q1. What is the primary objective of incident handling?
A) To punish the attacker
B) To restore normal operations securely and minimize impact
C) To identify the attacker's identity
D) To unplug all network cables
Answer: B
Rationale: Incident handling focuses on containment, eradication, recovery, and lessons learned. Attribution and
punishment are secondary (and often impossible), while restoring secure operations is the core goal.
Q2. Which of the following BEST defines an "event"?
A) A confirmed data breach
B) Any observable occurrence in a system or network
,C) A violation of security policy
D) A malware infection
Answer: B
Rationale: An event is any observable occurrence. An incident is an event (or series of events) that actually or
potentially jeopardizes confidentiality, integrity, or availability.
Q3. What is the difference between an event and an incident?
A) They are the same thing
B) An incident is any logged event; an event is a breach
C) An incident is an event that negatively impacts or threatens to impact security
D) An event only occurs on endpoints
Answer: C
Rationale: All incidents are events, but not all events are incidents. An incident has a negative security impact.
Q4. Which phase of the incident handling lifecycle comes immediately after "Identification"?
A) Eradication
, B) Containment
C) Recovery
D) Lessons Learned
Answer: B
Rationale: The typical ECIH lifecycle: Preparation → Identification → Containment → Eradication → Recovery
→ Lessons Learned (Post-Incident).
Q5. What is the FIRST step in the incident handling process?
A) Containment
B) Preparation
C) Eradication
D) Notification
Answer: B
Rationale: Preparation establishes policies, tools, communication plans, and team readiness before an incident
occurs.
