212-89 Exam Dumps : EC Council Certified Incident Handler (ECIH v3)

ECIH cloud incident handling guidance emphasizes that containment must be immediate and within the organization’s control. Modifying cloud security groups allows responders to restrict network access instantly, preventing further data exfiltration.

Option D is correct because it is actionable without CSP dependency and directly limits attacker movement. Option A may take time. Option B is investigative. Option C is regulatory and premature.

Containment through security group modification is therefore the most critical first step.

The described symptoms—numerous incomplete TCP connections consuming server resources—are characteristic of a SYN flood attack, a denial-of-service technique targeting the transport layer. In such attacks, attackers send SYN packets without completing the TCP handshake, leaving servers overwhelmed with half-open connections.

ECIH network incident handling guidance emphasizes rapid identification and containment of DoS conditions to preserve service availability. By configuring the router to validate connection requests (for example, using SYN cookies or proxy validation), illegitimate handshake attempts are filtered before reaching the server.

Option A involves payload inspection, which is irrelevant here. Option B relates to authentication attacks, which require completed connections. Option D is a detection activity, not mitigation.

Therefore, the purpose of Sophia’s action was to block SYN flood attempts, making Option C correct.

The EC-Council Incident Handler (ECIH) curriculum emphasizes Identity and Access Management (IAM) as a foundational control in cloud security. In cloud environments, shared credentials and lack of role-based restrictions significantly increase the risk of misuse, unauthorized access, and privilege abuse.

The scenario clearly identifies two major violations: credential reuse across departments and absence of role-specific restrictions. ECIH highlights that cloud best practices require enforcing strict user access control using the Principle of Least Privilege (PoLP) and role-based access control (RBAC). Each user—including third-party contractors—must have unique credentials with clearly defined permissions aligned strictly with their job responsibilities.

Credential isolation ensures accountability and traceability, enabling effective logging, auditing, and forensic investigation. Without unique user tracking, organizations cannot accurately attribute actions, which weakens incident response and compliance efforts.

Option B (data anonymization) relates to data privacy but does not address access misuse. Option C (vulnerability scanning of mobile apps) addresses application security, not identity misuse. Option D (SSL encryption) protects data in transit but does not prevent unauthorized credential reuse or excessive access rights.

ECIH strongly recommends implementing multi-factor authentication (MFA), enforcing strong IAM policies, restricting third-party access, and continuously monitoring privileged accounts in cloud environments. Therefore, enforcement of strict user access control and credential isolation is the most appropriate preventive measure.