212-89 Exam Dumps : EC Council Certified Incident Handler (ECIH v3)

This scenario reflects a suspected cloud workload compromise. The ECIH Cloud Incident Handling module stresses that responders must balance containment, evidence preservation, and service continuity.

Option D is correct because creating snapshots preserves forensic evidence while isolating instances using network ACLs or security groups immediately halts malicious communication. This approach aligns with ECIH guidance to preserve evidence before destructive actions while still containing the threat.

Option B destroys evidence and hinders investigation. Option C alters system state and may trigger attacker countermeasures. Option A delays containment.

ECIH explicitly warns against terminating or rebooting compromised cloud assets before evidence capture. Snapshot-and-isolate is therefore the most effective immediate containment step.

A multi-vector cloud attack affects multiple security domains simultaneously. DDoS may target network and edge services, phishing can compromise cloud identities, and malware may infect workloads or endpoints. Effective response therefore requires coordinated containment and investigation across identity services, applications, compute resources, networking, security controls, and potentially multiple cloud platforms. ECIH cloud incident handling emphasizes the complexity created by distributed architectures, shared responsibility, and fragmented visibility. Differentiating malicious from legitimate traffic is important for DDoS mitigation but addresses only one component of the attack. Communicating with the cloud service provider is also necessary where provider-controlled infrastructure is involved, but it forms only part of the wider response. Regulatory compliance remains important throughout the process but does not replace operational coordination. Coordinated cross-service response is therefore the central challenge.

================

The EC-Council Incident Handler (ECIH) curriculum identifies email spoofing as a common technique in business email compromise (BEC) attacks. Attackers exploit weak or misconfigured DNS-based email authentication controls to forge sender identities.

Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) are DNS-based mechanisms that validate legitimate email senders and prevent spoofing. Proper configuration ensures that receiving mail servers can verify message authenticity and reject forged communications.

In this scenario, unsecured DNS entries enabled identity relay spoofing. Strengthening SPF, DKIM, and DMARC directly addresses the root cause and prevents recurring forged message injections. This is a clear eradication measure aimed at eliminating the exploitation pathway.

Options A and B relate to review and analysis phases. Option C supports threat intelligence sharing but does not remediate the internal DNS weakness.

Therefore, strengthening SPF, DKIM, and DMARC configurations is the appropriate eradication strategy.