ECCouncil Updated 212-89 Exam Questions and Answers by kiyaan

This scenario highlights violations of forensic readiness and safe malware handling, which are explicitly covered in the ECIH First Response and Malware Analysis modules. ECIH stresses that malware samples must never be handled on production or enterprise-connected systems, as this creates a high risk of accidental execution, lateral infection, and organizational impact.

Option A is correct because ECIH mandates that malicious code samples be stored in isolated, non-networked environments and renamed with non-executable extensions (for example, .malware, .bin, or .txt) to prevent accidental execution. This practice ensures operational safety and preserves forensic integrity.

Option B improves confidentiality but does not prevent accidental execution. Option C supports documentation but does not mitigate execution risk. Option D aids classification but does not address safe handling.

The described behavior—handling live malware on enterprise systems without isolation or renaming—directly contradicts ECIH best practices. Proper sample isolation, renaming, and access restriction are mandatory controls to prevent secondary incidents during investigations, making Option A the correct answer.

This scenario describes a persistent phishing campaign leveraging spoofed domains and variant-based delivery mechanisms. According to the EC-Council Incident Handler (ECIH) curriculum under Email Security Incident Handling and Eradication, once detection and containment measures (such as blocking malicious IP addresses and purging emails) have been implemented, the eradication phase must focus on eliminating root causes and recurring technical vectors.

The key phrase in the question is “eliminate recurring delivery mechanisms and close technical loopholes.” ECIH emphasizes that phishing campaigns frequently evolve by modifying URLs, sender domains, encoding techniques, and payload structures to bypass simple IP blocking controls. Therefore, security teams must analyze decoded message components, extract malicious URLs, and generate URL-based deny-lists at the secure email gateway, web proxy, and firewall layers.

Creating email-specific URL deny-lists directly disrupts the attack infrastructure and prevents repeated access to malicious domains—even when attackers use variant IP addresses or modified content. This is a technical eradication control aligned with eliminating delivery vectors.

Options B and C (training and simulations) are preventive awareness measures and fall under the preparation or post-incident improvement phase—not eradication. Option A (WHOIS masking) is unrelated to preventing phishing delivery.

ECIH guidance stresses strengthening email filtering rules, updating domain and URL blacklists, implementing SPF/DKIM/DMARC validation, and hardening secure email gateways as core eradication techniques. Therefore, option D best aligns with the eradication objective.

This incident involves adaptive malware embedded within an AI system, actively evolving its behavior. The ECIH malware incident handling methodology prioritizes containment and eradication of the threat before recovery actions. Restoring data without removing the malware risks immediate reinfection and continued manipulation.

Option B is correct because deploying the AI-security module directly targets the malware’s adaptive mechanisms, allowing responders to detect, contain, and eradicate the malicious logic within the AI environment. ECIH emphasizes using appropriate, context-aware security controls that match the technology stack involved in the incident. For AI-driven environments, specialized tools are necessary to counter threats that traditional controls may not detect.

Option A is premature and unsafe prior to eradication. Option C disrupts business operations without resolving the threat. Option D is a communication step that should follow containment and validation.

Therefore, neutralizing the evolved malware using the AI-security module is the correct primary step.

Logging User IDs (D) can pose privacy concerns and may conflict with regulations such as the General Data Protection Regulation (GDPR), which emphasizes the protection of personal data and privacy. Therefore, while logging details such as Timestamps, Session IDs, and Source IP addresses are essential for security auditing to track when events occur, who is initiating sessions, and from where, care must be taken with User IDs. The handling of personally identifiable information (PII) must comply with privacy laws and organizational policies to safeguard individual privacy rights.