212-89 Exam Dumps : EC Council Certified Incident Handler (ECIH v3)

The ECIH Email Security Incident Handling module emphasizes email header analysis as a primary method for identifying spoofed or malicious emails. One of the most critical header elements is the originating IP address, which reveals where the email actually came from.

Option D is correct because tracing the originating IP and validating it through WHOIS provided definitive evidence that the email did not originate from a legitimate organizational source. This technique allows responders to distinguish between legitimate executive communications and impersonation attempts.

Option A is reactive and unreliable. Option B provides detection context but not attribution. Option C validates domain authentication but does not always reveal spoofing when credentials are compromised.

ECIH highlights that IP tracing combined with WHOIS analysis is a powerful verification method during executive impersonation investigations, making Option D correct.

A side channel attack, as described in the scenario, involves an attacker using indirect methods to gather information from a system. In this case, Alice is exploiting the shared physical resources, specifically the processor cache, of a virtual machine host to steal data from another virtual machine on the same host. This type of attack does not directly breach the system through conventional means like breaking encryption but instead takes advantage of the information leaked by the physical implementation of the system, such as timing information, power consumption, electromagnetic leaks, or, as in this case, shared resource utilization, to infer the secret data.

Generation-based fuzz testing is a strategy where new test data is generated from scratch based on a predefined model that specifies the structure, type, and format of the input data. This approach is systematic and relies on a deep understanding of the format and protocol of the input data to create test cases that are both valid and potentially revealing of vulnerabilities. This contrasts with mutation-based fuzz testing, where existing data samples are modified (mutated) to produce new test cases, and log-based and protocol-based fuzz testing, which use different approaches to test software robustness and security.