This scenario reflects a suspected cloud workload compromise. The ECIH Cloud Incident Handling module stresses that responders must balance containment, evidence preservation, and service continuity.

Option D is correct because creating snapshots preserves forensic evidence while isolating instances using network ACLs or security groups immediately halts malicious communication. This approach aligns with ECIH guidance to preserve evidence before destructive actions while still containing the threat.

Option B destroys evidence and hinders investigation. Option C alters system state and may trigger attacker countermeasures. Option A delays containment.

ECIH explicitly warns against terminating or rebooting compromised cloud assets before evidence capture. Snapshot-and-isolate is therefore the most effective immediate containment step.

In the incident handling and response (IH & R) process, backing up the data on affected systems is a critical step that usually falls under the Containment phase. The Containment phase is crucial for limiting the scope and severity of an incident, ensuring that it does not spread further or affect additional systems. Backing up affected systems during containment is essential for several reasons: it preserves a snapshot of the system in its current state for forensic analysis, ensures that data is not lost if the system needs to be wiped or altered during the response process, and helps in the recovery process if data is corrupted or lost.

By performing a complete backup of the infected system during the Containment phase, Alice ensures that there is a reliable copy of all data and system states before any major actions, such as eradication or deeper forensic analysis, are taken. This step is also preparatory for the potential use of the backup in analyzing how the incident occurred and in restoring system functionality after the incident is resolved.

Access point monitoring is the technique that helps incident handlers to detect man-in-the-middle (MitM) attacks by continuously observing and managing the wireless access points (APs) within a network. This includes identifying unauthorized or new APs attempting to connect to the network or mimic existing APs, even if they present similar IP and MAC addresses to legitimate access points. Through access point monitoring, incident handlers can quickly identify and mitigate spoofed APs, thus preventing MitM attacks that exploit wireless networks by intercepting and manipulating communications.

The GPG18 and Forensic readiness planning (SPF) principles outline various guidelines to enhance an organization ' s readiness for forensic investigation and response. Principle 5, which suggests that organizations should adopt a scenario-based Forensic Readiness Planning approach that learns from experience gained within the business, emphasizes the importance of being prepared for a wide range of potential incidents by leveraging lessons learned from past experiences. This approach helps in continuously improving forensic readiness and response capabilities by adapting to the evolving threat landscape and organizational changes.

In the context of digital evidence investigation, volatility refers to how quickly data can change or be lost when power is removed or systems are altered. Among the options provided, cache is the most volatile because it is temporary storage that is designed to speed up access to data and is frequently overwritten. Cache data resides in RAM and includes things like memory buffers, system and network information, and process execution data, which are lost upon reboot or power loss. This contrasts with disks, emails, and temp files, which are considered less volatile because they are stored on permanent or semi-permanent media and are less likely to be immediately lost or overwritten.

A Trojan, or Trojan horse, is a type of malware that disguises itself as a legitimate, harmless program or file to trick users into downloading and installing it. Once activated, a Trojan can perform a range of malicious activities, including giving attackers unauthorized access to the infected system. This can lead to the theft of sensitive information, such as credit card numbers and passwords, and can also allow the attacker to install additional malware, potentially leading to further damage, such as the erasure of data. Unlike viruses and worms, Trojans do not replicate themselves but rely on the deception of users to spread.

When a corporate network ' s servers are sending huge amounts of traffic to a specific website, as detected by the network ' s Intrusion Prevention System (IPS), this behavior is indicative of a Botnet attack. A Botnet is a network of compromised computers, often referred to as " bots, " that are controlled remotely by an attacker, typically without the knowledge of the owners of the computers. The attacker can command these bots to execute distributed denial-of-service (DDoS) attacks, send spam, or conduct other malicious activities. In this scenario, the servers behaving as bots and targeting a website with large volumes of traffic suggests that they have been co-opted into a Botnet to potentially perform a DDoS attack on the website abc.xyz.

The ECIH Incident Handling lifecycle prioritizes containment during first response when active compromise threatens data integrity and operational continuity. In this scenario, the risk extends beyond data theft to potential manipulation of examination materials.

Option C is correct because isolating the affected academic systems immediately prevents further unauthorized access and preserves the integrity of examination content. Containment ensures that attackers cannot alter or leak sensitive academic materials while investigations proceed.

Option A supports investigation but does not stop ongoing risk. Option B is a contingency plan, not a response action. Option D is premature and does not address system compromise.

According to ECIH, first responders must act decisively to prevent further damage before moving into analysis and recovery, making Option C correct.

The scenario described is characteristic of a Trojan. A Trojan is a type of malware that disguises itself as legitimate software but performs malicious actions once installed. Unlike viruses, which can replicate themselves, or worms, which can spread across networks on their own, Trojans rely on the guise of legitimacy to trick users into initiating their execution. In this case, the user believed they were downloading and installing genuine software, but the reality was that the application contained a Trojan. The malicious code executed upon installation provided unauthorized remote access to the user ' s computer, which could be used by an attacker to control the system, steal data, install additional malware, or carry out other malicious activities.

Trojans can come in many forms and can be used to achieve a wide range of malicious objectives, making them a versatile and dangerous type of cyber threat. The deceptive nature of Trojans, exploiting the trust users have in what appears to be legitimate software, is what makes them particularly effective and widespread.

Post-incident recovery should not merely restore the previous environment; it should also strengthen resilience against recurrence. A Content Delivery Network distributes content and traffic across geographically dispersed infrastructure, increasing capacity and reducing dependence on a single origin server. Blackhole routing can be used during severe DDoS events to discard malicious traffic and prevent overloaded infrastructure from affecting broader network services. Together, these measures provide meaningful defenses against volumetric denial-of-service attacks and support continued availability. Removing antivirus reduces security protection, while creating guest accounts unnecessarily expands the attack surface. Increasing FTP access similarly introduces additional exposure and provides no DDoS resilience. ECIH recovery activities emphasize implementing corrective and preventive measures based on lessons learned from the incident. Therefore, CDN deployment combined with appropriate traffic-routing controls is the strongest post-recovery option.

================