ECCouncil Updated 212-89 Exam Questions and Answers by dalton

The primary objective of endpoint incident handling, as outlined in the ECIH curriculum, is rapid containment and eradication of threats to preserve business operations. Advanced malware that bypasses traditional defenses requires coordinated response capabilities to prevent widespread compromise.

Option D is correct because endpoint IH & R enables organizations to quickly isolate infected systems, remove malicious components, and restore trusted states, thereby maintaining operational continuity. ECIH emphasizes speed and coordination as critical success factors in endpoint response.

Option A is secondary. Option B is a compliance outcome, not a response objective. Option C is a consequence, not the primary driver.

Therefore, the most critical reason is to ensure rapid containment and eradication, making Option D correct.

This incident involves adaptive malware embedded within an AI system, actively evolving its behavior. The ECIH malware incident handling methodology prioritizes containment and eradication of the threat before recovery actions. Restoring data without removing the malware risks immediate reinfection and continued manipulation.

Option B is correct because deploying the AI-security module directly targets the malware’s adaptive mechanisms, allowing responders to detect, contain, and eradicate the malicious logic within the AI environment. ECIH emphasizes using appropriate, context-aware security controls that match the technology stack involved in the incident. For AI-driven environments, specialized tools are necessary to counter threats that traditional controls may not detect.

Option A is premature and unsafe prior to eradication. Option C disrupts business operations without resolving the threat. Option D is a communication step that should follow containment and validation.

Therefore, neutralizing the evolved malware using the AI-security module is the correct primary step.

Explanation (aligned to IH & R lifecycle):

This question is about triage/validation—determining whether what you see is truly an incident and establishing priority. The most appropriate first move is to use endpoint telemetry and behavioral analytics (A) to validate maliciousness (e.g., suspicious parent/child process chains, token manipulation, credential dumping patterns, anomalous privilege escalation, and data transfer behaviors). This supports fast, evidence-based classification and reduces unnecessary disruption. Option (C) is containment and may be required after validation or for clearly high-confidence cases, but immediately disconnecting multiple endpoints can destroy volatile evidence, break business operations, and reduce your ability to trace lateral movement patterns across hosts. Option (B) is a broad preventive change that can create outage risk and is not a validation method. Option (D) can be helpful, but it is slower and not the primary “detect and validate” action for an internal team facing active anomalies.

A disciplined approach is: validate via behavioral tooling + logs, scope affected endpoints, determine severity, then execute containment proportional to confirmed risk. That sequencing mirrors standard incident handling flow (identify → validate/triage → contain → eradicate → recover → lessons learned). When time matters, the highest-value action is the one that converts ambiguous signals into confident incident classification quickly—behavioral validation does that best.

This incident is a textbook example of whaling, a specialized form of phishing that targets senior executives or impersonates them to exploit authority and trust. According to the ECIH Email Security module, whaling attacks often focus on financial fraud, such as wire transfer requests or invoice manipulation, and are designed to bypass normal controls through urgency and executive impersonation.

Option A is correct because the attacker impersonated the CEO and targeted employees responsible for financial actions. The minor domain alteration and authoritative language are classic whaling indicators.

Option B refers to overwhelming inboxes with large volumes of mail. Option C involves automated credential testing. Option D targets mobile messaging platforms.

Jason’s response—header analysis, identity verification, firewall blocking, financial alerting, and organization-wide notification—aligns with ECIH best practices for handling executive impersonation attacks. Recognizing the attack type correctly is critical for appropriate escalation and mitigation, making Option A the correct answer.