212-89 Exam Dumps : EC Council Certified Incident Handler (ECIH v3)

This incident highlights a failure in endpoint and mobile device preparation, a core area in the ECIH curriculum. Mobile devices often store or provide access to sensitive enterprise data, and when lost or stolen, they represent a high-risk exposure point. ECIH emphasizes that organizations must implement centralized mobile device management (MDM/EMM) controls as part of incident readiness.

Option D is correct because configuring remote wipe functionality allows an organization to immediately remove sensitive data from a lost or stolen device, even when physical access is no longer possible. Remote wipe is a critical containment capability that prevents data leakage, credential misuse, and unauthorized access to internal systems.

Option A strengthens authentication but does not help once the device is lost. Option B secures communications but does not address local data exposure. Option C improves application-level security but does not allow device-level containment.

ECIH stresses that preparation controls must support rapid containment actions. Without remote wipe capability, the response team is effectively powerless to protect data on a lost mobile device. Therefore, Option D is the correct and most effective preparation step.

An Intrusion Prevention System (IPS) device placed inline is best suited to block attacks on a network actively. Being inline allows the IPS to analyze and take action on the traffic as it passes through the device, effectively preventing malicious traffic from reaching its target. The IPS can detect and block a wide range of attacks in real-time by using various detection methods, such as signature-based detection, anomaly detection, and policy-based detection. Unlike Host-based Intrusion Prevention Systems (HIPS), web proxies, or load balancers, an inline IPS is specifically designed to inspect and act on incoming and outgoing network traffic to prevent attacks before they reach network devices or applications.

The responsibility of first responders does not include shutting down or rebooting the victim’s computer as a measure to preserve temporary and fragile evidence. In fact, such actions can potentially alter or destroy volatile data that could be crucial for the investigation. The primary responsibilities of first responders include protecting and identifying the crime scene, and ensuring the preservation of evidence in its original state as much as possible, which may involve isolating affected systems from the network but not necessarily shutting them down or rebooting them without proper forensic readiness and consideration.