HikeLetter | PMP Training & Certification Online Course | Project Management Learning

Overview

Course Description

Duration: 3 hours
Official exam questions: 100 multiple-choice questions
Passing score: Approximately 60%–78%, depending on the exam form
Remote-proctored exam voucher: Listed at $392.80 in the EC-Council store; prices may vary.

Course Questions

10 Questions

A monitoring alert suggests an active compromise. According to a structured incident response process, what should the team do before taking disruptive containment actions?

A. Ignore the alert until the next review B. Validate and assess the incident while following the response plan C. Delete all related logs D. Publicly identify the suspected attacker

Which activity best improves an organization's readiness to respond to security incidents?

A. Define roles, playbooks, communications, logging, and response tools in advance B. Wait to assign responsibilities until an incident occurs C. Disable endpoint telemetry D. Keep response contacts only in one employee's mailbox

Two alerts arrive: one is a confirmed ransomware outbreak on critical servers, and the other is a blocked scan against a test host. Which should receive priority?

A. The blocked scan because it arrived first B. The ransomware outbreak due to impact and urgency C. Both should be ignored D. The test host alert regardless of context

Ransomware is spreading across file shares. What is an appropriate immediate containment action?

A. Isolate affected systems or network segments under the incident plan B. Delete backups C. Disable all security logging D. Reconnect infected endpoints to test recovery

A responder needs to investigate a compromised endpoint. Which action supports evidence integrity?

A. Document actions and preserve relevant logs and forensic artifacts B. Reinstall the operating system before collecting anything C. Use a shared account and leave no notes D. Modify timestamps to align systems

An endpoint detection tool identifies a suspected trojan communicating with an external host. What should the responder do?

A. Investigate and contain the host using approved procedures, then analyze indicators B. Disable EDR across the enterprise C. Publish the host's IP address on social media D. Delete all logs immediately

Several employees report a credential-harvesting email. Which response is most effective?

A. Collect the message and headers, block confirmed indicators, and assess credential exposure B. Forward it to all employees without warning C. Delete mail logs D. Assume no one clicked because only a few reported it

An administrator's credentials are confirmed stolen and used from an unusual location. What should the team prioritize?

A. Revoke active sessions, reset credentials securely, and investigate privileged activity B. Keep the account active to observe without controls C. Share the password with the team D. Disable audit logs

A host is generating unusual outbound traffic to a known malicious domain. What is a sound response?

A. Correlate network telemetry, validate the indicator, and block or isolate according to risk B. Assume all outbound traffic is harmless C. Turn off DNS logging D. Delete the firewall configuration

An application server shows signs of SQL injection followed by suspicious database queries. What should responders do?

A. Preserve relevant web/application/database logs and contain the vulnerable path B. Erase the database before documenting findings C. Disable backups D. Make the database publicly accessible for testing

₹2999.00 ₹999.00

Enroll Now

Certified Incident Handler (ECIH) v3