ECCouncil Updated 212-89 Exam Questions and Answers by keira

Cross-site request forgery (CSRF or XSRF) is an attack that tricks the victim ' s browser into executing unauthorized actions on a website where they are currently authenticated. In this scenario, the attacker exploits the trust that a site has in the user ' s browser, effectively forcing the browser to perform actions without the user ' s knowledge or consent. For example, if the user is logged into their bank ' s website, an attacker could craft a malicious request to transfer funds without the user ' s direct interaction. CSRF attacks rely on authenticated sessions and typically target state-changing requests to compromise user or application data.

Once malware is identified, ECIH guidance requires responders to analyze before eradication to understand scope, infection vectors, persistence mechanisms, and data impact. This ensures effective removal and prevents reinfection.

Option C is correct because forensic analysis allows investigators to determine how the malware entered the system, what data was accessed, and whether additional components are compromised. Without this understanding, containment and recovery efforts may be incomplete or ineffective.

Option A is a containment step but does not address root cause. Option B is a notification step that must be supported by verified facts. Option D protects future data but does not address the active malware.

Therefore, forensic analysis is the ideal primary action following detection, as emphasized in the ECIH malware handling process.

In the ECIH Incident Handling lifecycle, once a breach is detected, the IH & R team must focus on analysis and scoping to understand how the attack occurred, what systems were affected, and whether the attacker still has access.

Option D is correct because analyzing logs with Incident Response Automation and Orchestration (IRAO) tools allows rapid correlation of events, identification of attacker entry points, and determination of breach scope. ECIH stresses that zero-day incidents require deep forensic and timeline analysis to ensure complete containment and prevent recurrence.

Options A and C are important but depend on accurate breach understanding. Option B is premature without full incident context.

Therefore, log analysis and origin tracing is the correct primary focus.