Certified Incident Handler (ECIH)

Last checked October 22, 2026 against the official EC-Council exam page.

1. Question 1Incident Handling and Response Process

   An analyst receives an alert that a workstation is beaconing to an unknown external address. What is the correct first step in the incident handling process?

   1. AReimage the workstation immediately so that any malware is removed without delay
   2. BValidate the alert and confirm that it is a true positive before escalating the incident
   3. CNotify the entire company by email so that every user can watch for the threat
   4. DDelete the alert from the queue because outbound connections are common in normal traffic
   Show answer and explanationHide answer

   Correct answer: B

   Validating the alert separates true incidents from false positives and sets the response in motion. Reimaging before analysis destroys evidence, company-wide notices are premature, and deleting the alert ignores a real indicator.

2. Question 2Malware Incidents

   A ransomware incident has encrypted files on a file server. Which first containment action is most appropriate?

   1. ATurn off the server's logging so that the encryption process runs without interruption
   2. BPay the ransom immediately to recover the files as quickly as the attackers request
   3. CIsolate the affected systems from the network to stop encryption from spreading further
   4. DInstall the latest software updates on every system without first isolating the infected ones
   Show answer and explanationHide answer

   Correct answer: C

   Isolating affected systems stops encryption from spreading and protects other data. Paying the ransom is unreliable and discouraged, disabling logging destroys evidence, and patching infected systems first can spread the malware.

3. Question 3Network Incidents

   Which evidence most clearly points to a denial-of-service attack rather than a legitimate traffic spike?

   1. ALogins from employees returning from lunch breaks at the usual time of day across the office
   2. BA steady increase in visitors over several weeks after a successful product launch campaign
   3. CTraffic that peaks at the same time as the company's monthly newsletter is sent to subscribers
   4. DTraffic from many unrelated sources targeting one service at a volume that exhausts its resources
   Show answer and explanationHide answer

   Correct answer: D

   A flood from many unrelated sources aimed at one service, which exhausts its resources, is characteristic of a distributed denial-of-service attack. Launch growth, newsletter peaks and routine logins have expected causes.

4. Question 4Email Security Incidents

   Which sign most strongly indicates that a user's mailbox has been compromised and used to send phishing emails?

   1. AUnexpected inbox rules that forward messages to an external address without the user's knowledge
   2. BA new email signature that the user chose to add to their messages for professional branding
   3. CA meeting invitation sent by a colleague who is known to the user and expected that day
   4. DA newsletter subscription confirmation that arrived after the user signed up for it themselves
   Show answer and explanationHide answer

   Correct answer: A

   Unexpected forwarding rules to an external address are a common sign of mailbox compromise used for data theft and further phishing. The other items are normal, expected email activity.

5. Question 5Web Application Incidents

   A web server log shows many requests containing the text union select in the URL parameters. Which attack does this most likely indicate?

   1. AAn update check from a browser that is requesting its latest version information
   2. BA normal user browsing the product catalogue with the search function as intended
   3. CSQL injection attempts against a database-backed page
   4. DA health check from the load balancer that confirms the web server is responding
   Show answer and explanationHide answer

   Correct answer: C

   The keywords union select are a classic signature of SQL injection probing. The other requests are normal browsing, update checks or health checks.