EC Council Certified Incident Handler (ECIH v2) Exam (212-89) - EC-Council Exam Questions

DigitalSoft, a major software development firm, recently discovered unauthorized access to its codebase. The culprit was a disgruntled employee who had been overlooked for a promotion. The company wants to prevent such insider threats in the future. What is the most effective measure it can implement?

Which of the following best describes an email issued as an attack medium, in which several messages are sent to a mailbox to cause overflow?

A large insurance enterprise recently completed an internal phishing simulation to evaluate its incident reporting workflow. Upon reviewing the ticketing system logs, the IR lead discovered that several phishing-related reports submitted by employees had been mistakenly logged as routine IT
service requests. This misrouting prevented timely review by the IH&R team, delaying appropriate
follow-up actions. The root cause was traced to frontline support staff misinterpreting subtle incident indicators as generic technical issues. Recognizing the potential risk this poses to early issue detection, the Chief Information Security Officer directed an overhaul of the alert-handling procedures. This included refining the reporting workflow, embedding clearer triage rules within the ticketing platform, and initiating refresher training to strengthen tier-one decision-making when handling ambiguous user reports. Which IR concern is being addressed through this corrective action?

Which of the following GPG18 and Forensic readiness planning (SPF) principles states that “organizations should adopt a scenario based Forensic Readiness Planning approach that learns from experience gained within the business”?

Which of the following is an Inappropriate usage incident?