Free EC-Council Certified Incident Handler Practice Questions

Sample Practice Questions

Try these 10 sample questions from the EC-Council Certified Incident Handler practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An attacker has obtained privileged credentials for a hosted service, placing tenant data at imminent risk, but no data theft has yet been confirmed. Under NIST's incident definition, which assessment is appropriate?

   1. A.Wait for confirmed theft before treating the occurrence as an incident.
   2. B.An imminent unauthorized threat to confidentiality can qualify as an incident.Correct answer: B
   3. C.Treat the occurrence only as a vulnerability until service availability changes.
   4. D.Declare an incident only after the attacker uses the credentials to change data.

   Explanation: NIST defines an incident as an occurrence that "actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability" of information or a system. B applies because imminent unauthorized risk is sufficient; confirmed theft, an availability change, or a completed integrity change is not required. A, C and D each impose an unsupported requirement for realized harm.

   Reference: NIST SP 800-61r3: Incident Response Recommendations and Considerations — Section 1, cybersecurity incident definition

2. 2A law-enforcement first responder encounters an electronic crime scene with an unresolved threat to people present. Under the NIJ guide, what is the primary consideration?

   1. A.Preserving the original disk's evidentiary integrity before securing people.
   2. B.Officer safety and the safety of everyone at the scene.Correct answer: B
   3. C.Capturing volatile computer memory before securing people.
   4. D.Completing contemporaneous custody records before securing people.

   Explanation: The source states, "The first responder’s primary consideration should be officer safety and the safety of everyone at the crime scene." A: Evidence integrity matters but does not outrank immediate safety. B: NIJ expressly makes safety the primary consideration. C: Volatile acquisition is subordinate to unresolved danger to people. D: Records matter but do not supersede immediate scene safety.

   Reference: NIJ: Electronic Crime Scene Investigation, A Guide for First Responders — Chapter 3, p.15, initial scene priorities

3. 3A team is preparing an environment for actively executing malware samples during analysis. Which design does NIST recommend to reduce damage to production systems?

   1. A.Execute samples on an analyst's ordinary production workstation with extra logging.
   2. B.Place samples on an isolated test system.Correct answer: B
   3. C.Use the production server with the largest remaining memory capacity.
   4. D.Run samples from the production file share so other responders can observe them.

   Explanation: NIST describes acquiring a sample and "placing the malware on an isolated test system." B separates active execution from production. A, C and D expose production resources; additional logging, spare memory or shared observation does not provide isolation.

   Reference: NIST SP 800-83r1: Guide to Malware Incident Prevention and Handling for Desktops and Laptops — Section 4.2.4, malware test-system preparation

4. 4An email imitates IT support and links to a counterfeit sign-in page that collects employees' passwords. No executable is downloaded. Which phishing objective does this most directly illustrate?

   1. A.Credential theft for access to protected resources.Correct answer: A
   2. B.Malware installation through an executable attachment.
   3. C.Resource exhaustion through excessive email delivery.
   4. D.Destruction of stored messages through mailbox rules.

   Explanation: The joint guidance describes phishing that lures victims into "providing their login credentials." A matches the counterfeit login page. B requires malware execution, C concerns volume, and D concerns deletion; none describes the stated password collection.

   Reference: CISA, NSA, FBI and MS-ISAC: Phishing Guidance — Phishing to obtain login credentials, Definition

5. 5A network sensor must directly drop malicious traffic before it reaches a protected segment. Which deployment mode should be prepared?

   1. A.Passive monitoring of a mirrored copy.
   2. B.Offline review of archived flows.
   3. C.Inline placement in the traffic path.Correct answer: C
   4. D.Passive packet capture from an optical tap.

   Explanation: NIST states, "An inline sensor is deployed so that the network traffic it is monitoring must pass through it," C places the sensor on the forwarding path. A, B and D observe copies or past traffic and cannot directly withhold the original packets.

   Reference: NIST SP 800-94: Guide to Intrusion Detection and Prevention Systems — Section 4.2.2, Inline

6. 6A team is preparing web application event logs for incident reconstruction. Which information model does OWASP require for each event?

   1. A.Only timestamp, severity and message length.
   2. B.When, where, who and what.Correct answer: B
   3. C.Only HTTP status, response size and elapsed time.
   4. D.Only the source subnet and destination port.

   Explanation: The source states, "The application logs must record "when, where, who and what" for each event." A: Omits actor and full event context. B: Matches the specified event-context model. C: HTTP telemetry alone omits identity and broader event context. D: Network endpoints alone do not identify the complete application event.

   Reference: OWASP Logging Cheat Sheet — Event attributes

7. 7Why must cloud incident plans distinguish IaaS from PaaS and SaaS?

   1. A.The same guest-OS acquisition procedure is available in every service model.
   2. B.Security responsibilities and available response controls vary by service model.Correct answer: B
   3. C.Moving infrastructure to a provider transfers all customer identity-response duties.
   4. D.The service-model label alone settles every partner's contractual response duty.

   Explanation: The source states, "Workload responsibilities vary" A: SaaS/PaaS may not expose guest operating systems to the customer. B: Matches the documented shared-responsibility differences. C: Customers retain data/identity responsibilities. D: The operating model can include additional agreements and parties.

   Reference: Microsoft: Shared responsibility in the cloud — Introduction

8. 8An employee knows the security policy but carelessly ignores required protective steps, without intending harm. Which insider category best describes this conduct?

   1. A.Accidental insider action.
   2. B.External reconnaissance only.
   3. C.Negligent insider action.Correct answer: C
   4. D.Collusive insider action.

   Explanation: CISA states, "generally familiar with security and/or IT policies but fail to comply" C distinguishes careless noncompliance from an unknowing error. A lacks the stated disregard of known policy; B is external; D requires collaboration with an outside actor.

   Reference: CISA Insider Threat Mitigation Guide — Types of insider threats, Negligent

9. 9Which telemetry can directly reveal application activity that an ordinary network sensor cannot inspect inside an encrypted session?

   1. A.The TLS handshake's certificate metadata alone.
   2. B.Endpoint-agent observations of the decrypted activity.Correct answer: B
   3. C.Aggregated network flow byte counts alone.
   4. D.DNS resolver query logs alone.

   Explanation: The source states, "network-based IDPS sensors cannot analyze the activity within encrypted network communications, but host-based IDPS agents installed on endpoints can see the unencrypted activity." A: Certificate metadata does not reveal the full application activity. B: The endpoint processes the unencrypted activity locally. C: Flow counts provide metadata rather than plaintext application behavior. D: DNS names do not disclose the encrypted application exchange.

   Reference: NIST SP 800-94: Guide to Intrusion Detection and Prevention Systems — 7.1.3, Agent locations

10. 10Ransomware both prevents users from using their systems and copies their files to an attacker. Which pair of information-security properties is directly threatened by these two actions?

    1. A.Availability and confidentialityCorrect answer: A
    2. B.Integrity and nonrepudiation
    3. C.Authenticity and accountability
    4. D.Confidentiality and nonrepudiation

    Explanation: NIST gives an incident example of "Deploying ransomware to prevent the use of computer systems and cause multiple data breaches by copying files from those systems". Preventing use harms availability; copying data to an attacker threatens confidentiality. A identifies both. B substitutes integrity and nonrepudiation, C substitutes identity and auditability, and D omits availability.

    Reference: NIST SP 800-61r3: Incident Response Recommendations and Considerations — Section 1, examples of incidents, ransomware