ECCouncil Updated 212-89 Exam Questions and Answers by lorena

Whaling is a targeted phishing technique involving senior executives or other high-value organizational identities. In this case, the attacker impersonates the CEO and uses authority, urgency, and a fraudulent wire-transfer request to manipulate employees responsible for financial transactions. ECIH v3 email-security incident handling highlights executive impersonation and business-email-compromise patterns as high-risk social-engineering attacks because successful deception can lead directly to financial loss. Domain spoofing and falsified sender details reinforce the impersonation attempt. Credential stuffing uses previously compromised username-password combinations against accounts, spimming refers to spam distributed through instant messaging, and mail bombing attempts to overwhelm a mailbox or server with excessive messages. Jason ' s header analysis, identity verification, IP blocking, financial notification, and organization-wide warning are appropriate response measures for an executive-targeted whaling incident.

================

This scenario highlights violations of forensic readiness and safe malware handling, which are explicitly covered in the ECIH First Response and Malware Analysis modules. ECIH stresses that malware samples must never be handled on production or enterprise-connected systems, as this creates a high risk of accidental execution, lateral infection, and organizational impact.

Option A is correct because ECIH mandates that malicious code samples be stored in isolated, non-networked environments and renamed with non-executable extensions (for example, .malware, .bin, or .txt) to prevent accidental execution. This practice ensures operational safety and preserves forensic integrity.

Option B improves confidentiality but does not prevent accidental execution. Option C supports documentation but does not mitigate execution risk. Option D aids classification but does not address safe handling.

The described behavior—handling live malware on enterprise systems without isolation or renaming—directly contradicts ECIH best practices. Proper sample isolation, renaming, and access restriction are mandatory controls to prevent secondary incidents during investigations, making Option A the correct answer.

URL encoding, also known as percent-encoding, is a mechanism for encoding information in a Uniform Resource Identifier (URI) under certain circumstances. This technique involves replacing unsafe ASCII characters with a " % " followed by two hexadecimal digits that represent the character ' s ASCII code. This is necessary for embedding characters that are not allowed in URLs directly, such as spaces and symbols, or characters that have special meanings within URLs, ensuring that the URL is correctly interpreted by web browsers and servers.

Incapsula is a cloud-based application delivery platform that offers a comprehensive security solution, including protection against Distributed Denial of Service (DDoS) attacks. By providing DDoS mitigation services, Incapsula helps protect websites and online services from being overwhelmed by traffic intended to make the resource unavailable to its intended users. The platform filters out malicious traffic and allows legitimate traffic through, thus ensuring that the organization ' s online resources remain available even under attack.