Free Certified Incident Handler (ECIH) practice test: 30 questions with answers

Validating the alert separates true incidents from false positives and sets the response in motion. Reimaging before analysis destroys evidence, company-wide notices are premature, and deleting the alert ignores a real indicator.

Containment limits spread and keeps evidence intact for investigation. Eradication removes the threat, recovery restores service, and lessons learned happens after the incident has been closed.

Preparation builds the policy, team, tools and communication plans before an incident happens. Imaging, restoring and reporting all occur after an incident is under way or closed.

A bit-for-bit image with a hash and a documented chain of custody preserves integrity and admissibility. Drag-and-drop copying, opening files on the compromised system and abrupt shutdown each change or lose evidence.

Post-incident activity reviews the incident, records lessons and improves controls and procedures. Rapid reconnection, deleting records and blaming individuals each undermine learning and governance.

Isolating affected systems stops encryption from spreading and protects other data. Paying the ransom is unreliable and discouraged, disabling logging destroys evidence, and patching infected systems first can spread the malware.

A new scheduled task or run key that starts an unknown executable is a common persistence mechanism. Approved installs, vendor updates and display settings are normal behaviours.

An isolated sandbox lets the analyst observe behaviour safely without risking production systems. Running the file on production, emailing it to staff and public uploads each expose the environment or leak the sample.

Unexpected connections, unusual processes and disabled security tools are common malware indicators. Scheduled patches and a user's own wallpaper choice are normal activity.

A domain tied to a malware family is an indicator of compromise, which can be searched for across logs and endpoints. The other interpretations are wrong, and whitelisting without review would be dangerous.

A flood from many unrelated sources aimed at one service, which exhausts its resources, is characteristic of a distributed denial-of-service attack. Launch growth, newsletter peaks and routine logins have expected causes.

Correlating the connection with endpoint and proxy logs identifies which process and user created it, which guides containment. Blanket blocking, assumptions and restarts without records each lose important information.

Authentication and network flow logs show which accounts connected to which hosts and when, which reveals lateral movement. Printer, badge and coffee logs have no direct link to host-to-host activity.

Blocking network access while preserving state and revoking credentials and command-and-control destinations are effective containment steps. Watching without limits leaves the threat active, renaming changes nothing, and shutting the network down is disproportionate.

Unexpected forwarding rules to an external address are a common sign of mailbox compromise used for data theft and further phishing. The other items are normal, expected email activity.

Blocking the domain, removing the message and resetting credentials contain the phishing campaign and limit account misuse. Forwarding it to everyone spreads the link further, waiting for confessions delays action, and ignoring reports misses compromises that filters let through.

Not opening the attachment and collecting headers protects the user and supports analysis, and verifying the sender and checking gateway logs establishes scope. Opening it, forwarding it personally and deleting without records each cause harm or lose evidence.

SPF, DKIM and DMARC validate senders and define how failures are handled, which counters domain spoofing. Retrieval protocols, subject lines and recipient lists do not authenticate the sender.

The keywords union select are a classic signature of SQL injection probing. The other requests are normal browsing, update checks or health checks.

Output encoding stops injected content being run as script, and a content security policy limits script sources. Disabling HTTPS, allowing raw HTML and exposing tokens in URLs each increase the risk.

Parameterised queries separate user input from SQL structure, which directly prevents injection. Hiding names, showing detailed errors and allowing unlimited input each help attackers or fail to stop the injection.

Tokens in URLs leak through browser history, logs, referrer headers and shared links, which allows session hijacking. Speed, invisibility and spellchecking are not the risk.

Removing public access stops further exposure while preserving access logs to determine who accessed the data. Downloading to a laptop, deleting the bucket and publicising it each cause additional harm or lose evidence.

Control plane audit logs record administrative API calls, including resource creation and deletion, with the identity that made them. Debug, printer and cache logs do not record those administrative actions.

Revoking and rotating exposed keys stops misuse, and audit log review shows what was done with them. Asking the attacker, waiting and emailing keys each prolong or widen the exposure.

Public access settings are a leading cause of storage exposure. Encryption, role-based restriction and logging reduce exposure rather than causing it.

Large downloads of confidential data shortly before resignation are a recognised insider theft pattern. Late work, training and routine password resets are expected behaviours.

Privileged access management with recording and approval limits misuse and makes actions attributable. Shared passwords, self-granted access and removed logging each make misuse easier and harder to detect.

Data loss prevention rules flag large uploads to unsanctioned services, which surfaces exfiltration. Public indexing, deleting logs and unrestricted personal storage each remove detection or increase exposure.

Involving HR and legal, preserving logs and limiting access follows policy and protects the investigation and the employee's rights. Confrontation, unrestricted access and public naming each risk the evidence and fairness.