ECCouncil 312-39 Exam With Confidence Using Practice Dumps

“Neutralizing handlers” is the best match because it focuses on disrupting the botnet’s command-and-control layer that coordinates the attack. In classic botnet terminology, handlers (or C2 nodes) issue instructions to compromised hosts. If you can block, sinkhole, or otherwise disrupt communication to those controlling nodes, you reduce the adversary’s ability to direct traffic and sustain the DDoS. Rate limiting is a useful mitigation to reduce immediate impact on your services, but it does not sever attacker control; it is more a resilience measure than eradication. “Blocking potential attacks” is too generic and describes a broad defensive posture rather than a specific botnet-focused eradication action. “Disabling botnets” is an outcome, but it is not a precise operational strategy in the way “neutralizing handlers” is; disabling a botnet often requires a combination of takedowns, sinkholing, upstream provider coordination, and endpoint remediation—activities that are commonly operationalized by targeting the handler/C2 infrastructure. From a SOC standpoint, this also aligns with coordinated response: implement network blocks, collaborate with ISP/CDN, and use threat intel to identify additional C2 endpoints while continuing service-level mitigations.

To monitor and visualize Tor traffic hitting the network, John would need data sources that can provide detailed information about the source IP addresses of incoming traffic, as well as the capability to resolve these IP addresses to more identifiable information such as hostnames or geographical locations. DHCP logs, or other log sources capable of maintaining detailed IP address records and facilitating IP-to-Name resolution, would be suitable for this purpose. This data would allow John to create a dashboard in the SIEM system that maps the source IP addresses of Tor traffic to their corresponding locations or identities, providing insights into where the Tor traffic is originating. While web server logs (options B, C, and D) can provide IP addresses, they might not offer the same level of detail or resolution capabilities as DHCP logs or similar network-level logs for this specific use case.

A forensic analyst is the role best suited to perform in-depth evidence gathering and analysis required to reconstruct timelines, determine scope, and establish root cause for a data leak. This work includes preserving evidence (ensuring integrity), collecting endpoint and server artifacts, reviewing authentication and repository access logs, correlating commit history with identity and device telemetry, and building a defensible chain of events for leadership and potential legal/regulatory review. The SOC manager coordinates resources and priorities but typically does not perform hands-on forensic reconstruction. A subject matter expert may provide domain expertise (e.g., on Git workflows, cloud platforms, or database systems), but forensic rigor and evidence handling are the core requirement here. A threat intelligence analyst focuses on external adversary information, campaigns, and indicators; they can assist with context but are not the primary role for internal evidence reconstruction. Because the CISO needs timeline, extent, and root cause—deliverables that depend on digital evidence handling and forensic methodology—the forensic analyst is the critical assignment.