212-89 Exam Dumps : EC Council Certified Incident Handler (ECIH v3)

A side channel attack, as described in the scenario, involves an attacker using indirect methods to gather information from a system. In this case, Alice is exploiting the shared physical resources, specifically the processor cache, of a virtual machine host to steal data from another virtual machine on the same host. This type of attack does not directly breach the system through conventional means like breaking encryption but instead takes advantage of the information leaked by the physical implementation of the system, such as timing information, power consumption, electromagnetic leaks, or, as in this case, shared resource utilization, to infer the secret data.

ECIH cloud incident handling guidance emphasizes that containment must be immediate and within the organization’s control. Modifying cloud security groups allows responders to restrict network access instantly, preventing further data exfiltration.

Option D is correct because it is actionable without CSP dependency and directly limits attacker movement. Option A may take time. Option B is investigative. Option C is regulatory and premature.

Containment through security group modification is therefore the most critical first step.

This scenario reflects inappropriate resource usage, a category of network and system misuse defined in the ECIH Network Security Incident module. Excessive outbound traffic during non-business hours combined with high CPU and memory utilization indicates unauthorized or improper use of system resources.

Option A is correct because the behavior suggests activities such as cryptomining, data exfiltration, or unauthorized processing. These activities strain system resources and often occur outside normal working hours to avoid detection.

Option B would not necessarily cause sustained resource strain. Option C focuses on physical changes. Option D relates to permission enforcement, not usage behavior.

ECIH categorizes inappropriate usage as a security incident when system resources are misused in ways that violate policy or threaten availability, making Option A correct.