ECCouncil Updated 212-89 Exam Questions and Answers by kiyaan

Volatile memory contains critical artifacts such as encryption keys, running processes, and network connections. The ECIH Forensic Readiness module emphasizes that volatile evidence must be captured immediately before it is lost.

Option C is correct because capturing memory first preserves irreplaceable evidence, followed by securing the scene to prevent contamination. Powering down systems before memory capture would destroy volatile data.

Options A and D are incomplete without prioritization. Option B is incorrect due to evidence loss.

Thus, immediate memory capture followed by scene security is the correct action.

The vulnerable advanced-search feature has been identified as the active attack vector, so immediate containment requires removing that functionality from exposure. Disabling the feature and reverting to the previously stable version prevents continued exploitation while responders investigate the vulnerability, preserve relevant logs, determine the scope of compromise, and develop a validated remediation. Multi-factor authentication strengthens account security but does not correct a vulnerability in backend search processing. Re-authentication similarly does not prevent exploitation by an already authenticated user or malicious request. Stronger database encryption protects stored information but does not stop application-layer abuse that occurs through vulnerable business logic. ECIH incident handling emphasizes containing the exploited component before eradication and recovery. Therefore, temporarily disabling the vulnerable feature is the most direct and appropriate immediate response.

================

Large cloud environments generate extensive telemetry from identity services, workloads, APIs, network controls, applications, and third-party security systems. ECIH v3 emphasizes rapid correlation and prioritization during incident triage so responders can distinguish meaningful indicators from routine event noise. An Incident Response Automation and Orchestration tool can aggregate information from multiple sources, correlate related alerts, enrich indicators, prioritize incidents according to severity, and automate repeatable investigative workflows. Automatically isolating all instances without validating scope could cause unnecessary customer disruption. Ignoring third-party security telemetry would reduce visibility and could omit important evidence. Broad client notification is a governance or communication activity that should follow appropriate validation and impact assessment. Therefore, cloud-focused incident-response automation and orchestration provides the strongest method for efficiently triaging large volumes of distributed security data.

================

A Trojan attack involves a type of malicious code or software that appears legitimate but can take control of your computer. Trojans often disguise themselves as legitimate software or are hidden within legitimate software that has been tampered with. They differ from viruses and worms because they do not replicate. However, once activated, Trojans can enable cyber-criminals to spy on you, steal your sensitive data, and gain backdoor access to your system. This can include unauthorized actions such as deleting files, monitoring user activities, or installing additional malicious software.