212-89 Exam Dumps : EC Council Certified Incident Handler (ECIH v3)

Disabling security options such as two-factor authentication (2FA) and CAPTCHA is not a countermeasure to eradicate cloud security incidents. In fact, it is contrary to best security practices. 2FA adds an additional layer of security by requiring two forms of verification before granting access to an account or system. CAPTCHA helps prevent automated attacks by ensuring that the entity accessing the service is human. Both are important security measures that protect against unauthorized access and automated attacks, thereby enhancing cloud security.

This scenario focuses on physical forensic evidence preservation, a key concept in the ECIH First Response module. Trace-level indicators such as fingerprints, residues, and physical media can provide attribution in insider investigations.

Option A is correct because Aaron’s actions prevent contamination or destruction of physical trace evidence that may later link the incident to a specific individual. ECIH stresses that digital investigations often involve physical evidence, especially in insider cases.

Options B–D focus on digital evidence, which is not the primary concern described here.

Proper preservation of physical trace evidence supports attribution, legal proceedings, and disciplinary action, aligning fully with ECIH forensic readiness principles.

The Microsoft Baseline Security Analyzer (MBSA) is a tool designed to assess a computer or network's security state by checking for missing security updates and common security misconfigurations. In the scenario with Finn, who is working in the eradication phase of an incident response process, the use of MBSA makes sense. The tool's ability to detect missing security patches and recommend the installation of the latest patches is crucial for eliminating vulnerabilities in the Windows operating system that could be the root cause of the incident.

MBSA scans the system for missing security updates, misconfigurations, and other vulnerabilities and provides detailed reports and recommendations for remediation. This step is vital in the eradication phase, where the goal is to remove the root causes of the incident and secure the system against future attacks. By ensuring that all necessary patches are applied, Finn is addressing any security gaps that could be exploited by attackers.