212-89 Exam Dumps : EC Council Certified Incident Handler (ECIH v3)

In the scenario where your company sells Software as a Service (SaaS) and is hosted on the cloud using it as a Platform as a Service (PaaS), your company is responsible for eradicating malware in your customer's database. This is because, as the SaaS provider, your company manages the software and is responsible for its security and maintenance, including the databases that store customer data. While the PaaS provider is responsible for the underlying infrastructure, platform, and possibly some middleware security aspects, the application layer security, including data and application management, falls to the SaaS provider. Building management would not be involved in digital security matters, and while customers are responsible for their data, the actual software maintenance and security in a SaaS model are the provider's responsibility.

Ping sweeping is a technique used in network reconnaissance to identify which IP addresses in a range are active or live. By sending ICMP echo requests ("ping") to multiple hosts and observing which ones respond, an attacker or, in this case, a red team member like Allan, can determine which systems are up and potentially vulnerable to further exploration or attack. This method is foundational for mapping the network before deploying more targeted exploits or scans.

This scenario focuses on physical forensic evidence preservation, a key concept in the ECIH First Response module. Trace-level indicators such as fingerprints, residues, and physical media can provide attribution in insider investigations.

Option A is correct because Aaron’s actions prevent contamination or destruction of physical trace evidence that may later link the incident to a specific individual. ECIH stresses that digital investigations often involve physical evidence, especially in insider cases.

Options B–D focus on digital evidence, which is not the primary concern described here.

Proper preservation of physical trace evidence supports attribution, legal proceedings, and disciplinary action, aligning fully with ECIH forensic readiness principles.