ECCouncil Updated 212-89 Exam Questions and Answers by md

Explanation (aligned to IH&R lifecycle):

This question is about triage/validation—determining whether what you see is truly an incident and establishing priority. The most appropriate first move is to use endpoint telemetry and behavioral analytics (A) to validate maliciousness (e.g., suspicious parent/child process chains, token manipulation, credential dumping patterns, anomalous privilege escalation, and data transfer behaviors). This supports fast, evidence-based classification and reduces unnecessary disruption. Option (C) is containment and may be required after validation or for clearly high-confidence cases, but immediately disconnecting multiple endpoints can destroy volatile evidence, break business operations, and reduce your ability to trace lateral movement patterns across hosts. Option (B) is a broad preventive change that can create outage risk and is not a validation method. Option (D) can be helpful, but it is slower and not the primary “detect and validate” action for an internal team facing active anomalies.

A disciplined approach is: validate via behavioral tooling + logs, scope affected endpoints, determine severity, then execute containment proportional to confirmed risk. That sequencing mirrors standard incident handling flow (identify → validate/triage → contain → eradicate → recover → lessons learned). When time matters, the highest-value action is the one that converts ambiguous signals into confident incident classification quickly—behavioral validation does that best.

When Joseph, the IH&R team lead, alerted service providers, developers, and manufacturers about the affected resources, he was engaged in the Containment stage of the Incident Handling and Response (IH&R) process. Containment involves taking steps to limit the spread or impact of an incident and to isolate affected systems to prevent further damage. Alerting relevant stakeholders, including service providers and developers, is part of containment efforts to ensure that the threat does not escalate and that measures are taken to protect unaffected resources. This stage precedes eradication and recovery, focusing on immediate response actions to secure the environment.

A permissive security policy is characterized by allowing all activities except those that are explicitly blocked. This approach starts with a default state of allowing access and functionality, with restrictions applied only to known dangerous services, attacks, or behaviors. Such a policy can lead to a wider attack surface because it assumes services and behaviors are safe unless proven otherwise.

A prudent policy would typically involve more conservative security measures, applying necessary restrictions to protect against identified and potential threats.

A paranoic policy would be at the extreme end of security measures, possibly blocking more than necessary to ensure the highest level of security, often at the expense of usability or functionality.

A promiscuous policy, in contrast, would be even more open than a permissive policy, essentially allowing nearly all traffic or actions with minimal restrictions, which is not what Rica observed.

Comprehensive and Detailed Explanation (ECIH-aligned):

ISO/IEC 27001 Annex A.16 focuses on information security incident management, including reporting, assessment, response, and learning. The ECIH curriculum aligns closely with these requirements, emphasizing structured procedures and continuous improvement.

Option C is correct because it directly addresses the identified gaps: clear escalation channels, consistent outcome tracking, and incorporation of lessons learned. ECIH stresses that post-incident activities—often overlooked—are essential for improving readiness and preventing recurrence.

Option A supports preparedness but does not address systemic process gaps. Option B improves visibility but not governance. Option D is a technical control unrelated to incident learning and escalation.

Thus, implementing structured incident escalation and post-incident knowledge integration is the priority action for compliance and resilience.