Download Latest 212-89 Questions

Restoring web application services with the help of existing backups, as performed by Robert, falls under the Recovery stage of the Incident Handling and Response (IH & R) process. The Recovery stage involves actions taken to return the organization to normal operations after an incident, which includes restoring systems to their operational state using backups, patching vulnerabilities, and ensuring that all systems are clean and secure before being brought back online. This step is crucial for resuming business operations and mitigating the impact of the incident.

Yesware is a tool primarily known for its email tracking capabilities, which can be useful for sales, marketing, and customer relationship management. However, in the context of investigating email attacks and analyzing incidents to extract details such as sender identity, mail server, sender’s IP address, and location, a more appropriate tool would be one that specializes in analyzing and extracting detailed header information from emails, providing insights into the path an email took across the internet. While Yesware can provide data related to email interactions, it might not offer the depth of forensic analysis required for incident investigation. Tools like email header analyzers, which are designed specifically for dissecting and interpreting email headers, would be more fitting. In the absence of a direct match from the given options, the description might imply a broader interpretation of tools like Yesware in context but traditionally, tools specifically designed for email forensics would be sought after for this task.

ECIH incident handling principles prioritize immediate containment when an attacker maintains active access and data exfiltration is occurring. The primary server is the most critical compromised asset because unauthorized remote connections and data tunnels are actively transferring confidential information. Isolating the server and terminating remote access immediately limits further data loss and prevents the attacker from expanding control. Reinstalling IoT firmware belongs to eradication and recovery and should occur only after the affected environment is contained and examined. Using the AI system to trace activity may assist investigation, but delaying containment allows continued exfiltration. A company-wide shutdown would be excessively disruptive and could unnecessarily affect unaffected systems. Targeted isolation of the compromised server therefore provides the most proportionate and effective first-response action.

================

Once malware is identified, ECIH guidance requires responders to analyze before eradication to understand scope, infection vectors, persistence mechanisms, and data impact. This ensures effective removal and prevents reinfection.

Option C is correct because forensic analysis allows investigators to determine how the malware entered the system, what data was accessed, and whether additional components are compromised. Without this understanding, containment and recovery efforts may be incomplete or ineffective.

Option A is a containment step but does not address root cause. Option B is a notification step that must be supported by verified facts. Option D protects future data but does not address the active malware.

Therefore, forensic analysis is the ideal primary action following detection, as emphasized in the ECIH malware handling process.