ECCouncil Updated 212-89 Exam Questions and Answers by angel

The originating IP trace was the key investigative element. ECIH email-security incident analysis emphasizes examining message headers to determine the actual infrastructure through which an email originated and traveled. In this scenario, the team extracted the sending IP address from the header, identified that its geographic and organizational origin was inconsistent with the supposed executive sender, and then used WHOIS information to investigate ownership. Those steps constitute tracing the originating IP and directly provided evidence that the message was suspicious. DKIM verification can help determine whether a message has a valid cryptographic signature for a sending domain, but no DKIM analysis is described. Bounce-back analysis relates to delivery failures, while spam-filter logs may provide detection information but were not responsible for the attribution finding. Therefore, originating IP tracing is correct.

================

The described activity—ICMP echo requests sent sequentially across many IP addresses—is a classic ping sweep, a reconnaissance technique used to identify live hosts on a network. ECIH network incident handling identifies reconnaissance as an early-stage attack activity that often precedes exploitation.

Option B is correct because ping sweeps use ICMP echo requests to determine which hosts respond, allowing attackers to map the network. This aligns exactly with the observed traffic.

Option A involves DNS manipulation. Option C involves probing TCP/UDP ports rather than ICMP. Option D describes a denial-of-service technique, not reconnaissance.

Recognizing reconnaissance activity early allows defenders to implement controls before exploitation occurs, aligning with ECIH detection and prevention guidance.

Threat correlation is a method used by incident responders to analyze and associate various indicators of compromise (IoCs) and alerts to identify genuine threats. By correlating data from multiple sources and applying intelligence to distinguish between unrelated events and coordinated attack patterns, responders can significantly reduce the rate of false-positive alerts. This enables teams to prioritize their efforts on the most critical and likely threats, thereby reducing potential risks and corporate liabilities. Effective threat correlation involves the use of sophisticated security information and event management (SIEM) systems, threat intelligence platforms, and analytical techniques to identify relationships between seemingly disparate security events and alerts.

Advanced persistent threats require coordinated, intelligence-driven response. ECIH emphasizes that APT investigations generate massive volumes of telemetry across endpoints, networks, and cloud platforms.

Option D is correct because Incident Response Automation and Orchestration (IRAO) tools correlate disparate data sources, automate enrichment, and accelerate threat hunting. This enables responders to identify hidden persistence mechanisms and attacker TTPs efficiently.

Options A, B, and C are important but not immediate investigative actions.

ECIH explicitly recommends orchestration platforms for complex, multi-vector incidents such as APTs.