212-89 Exam Dumps : EC Council Certified Incident Handler (ECIH v3)

Michael's activities, which involve analyzing file systems, slack spaces, and metadata of storage units to find hidden malware and evidence of malice, indicate that he is handling a storage-related cloud security incident. This type of incident pertains to unauthorized access, alteration, or exfiltration of data stored in cloud environments. By focusing on the storage aspects such as file systems and metadata, Michael is looking for signs of compromise that specifically affect the storage of data, which is indicative of a storage-related security incident in the cloud.

Comprehensive and Detailed Explanation (ECIH-aligned):

This scenario clearly aligns with the eradication phase of the ECIH malware incident handling lifecycle. After detection and containment, eradication focuses on completely removing malicious artifacts and ensuring the threat cannot re-emerge.

Option D is correct because Liam’s actions—malware removal, account disabling, system restoration, and IOC documentation—are all aimed at fully eliminating the malware and attacker footholds. ECIH emphasizes that eradication must address malware binaries, persistence mechanisms, compromised credentials, and residual indicators.

Option B (forensic preservation) would avoid system changes, which Liam does not do. Option A is a training activity unrelated to response. Option C is infrastructure improvement, not incident handling.

ECIH explicitly states that failure to eradicate all traces often leads to reinfection or continued attacker access. Liam’s comprehensive approach ensures the environment is returned to a trusted state and prepares detection systems for future prevention.

Comprehensive and Detailed Explanation (ECIH-aligned):

The ECIH Network Security Incident Handling module emphasizes maintaining availability while mitigating denial-of-service attacks. The objective is not simply to stop traffic, but to distinguish malicious traffic from legitimate user requests.

Option D is correct because rate limiting and challenge-response mechanisms (such as CAPTCHA or SYN cookies) allow legitimate traffic to continue while throttling or blocking malicious requests. This approach minimizes service disruption while effectively containing the attack.

Option A may increase costs and still fail against large-scale DDoS attacks. Option B can unintentionally block legitimate users. Option C contradicts ECIH guidance by unnecessarily impacting availability.

ECIH stresses proportional and intelligent mitigation strategies that preserve business continuity. Therefore, implementing rate limiting and challenge-response mechanisms is the preferred strategy.