Public Key Infrastructure (PKI) is a framework used to manage digital certificates and public-key encryption. It enables secure electronic transfer of information for a range of network activities such as e-commerce, internet banking, and confidential email. PKI is fundamental to the management of encryption keys and digital certificates, ensuring the secure exchange of data over networks and verification of identity.

Once malware is identified, ECIH guidance requires responders to analyze before eradication to understand scope, infection vectors, persistence mechanisms, and data impact. This ensures effective removal and prevents reinfection.

Option C is correct because forensic analysis allows investigators to determine how the malware entered the system, what data was accessed, and whether additional components are compromised. Without this understanding, containment and recovery efforts may be incomplete or ineffective.

Option A is a containment step but does not address root cause. Option B is a notification step that must be supported by verified facts. Option D protects future data but does not address the active malware.

Therefore, forensic analysis is the ideal primary action following detection, as emphasized in the ECIH malware handling process.

The correct sequence of steps involved in forensic readiness planning, based on the activities described, is as follows:

Identify the potential evidence required for an incident.

Determine the source of the evidence.

Define a policy that determines the pathway to legally extract electronic evidence with minimal disruption.

Establish a policy for securely handling and storing the collected evidence.

Identify if the incident requires full or formal investigation.

Train the staff to handle the incident and preserve the evidence.

Create a special process for documenting the procedure.

A high-interaction honeypot is a deception and intelligence-gathering mechanism designed to attract attackers and provide a realistic environment in which their behavior can be observed. ECIH uses honeypots as part of proactive detection and threat-intelligence activities because they can reveal reconnaissance techniques, exploit attempts, credential attacks, payload delivery, and post-compromise behavior. Zoe is intentionally exposing controlled services, recording activity, and analyzing patterns to understand attacker tactics, techniques, and procedures. This intelligence can later improve IDS rules, signatures, segmentation, and incident-response playbooks. Sandboxing is primarily used to execute suspicious files safely and analyze malware behavior. ACLs are traffic-control mechanisms for filtering connections, while backup testing concerns recovery preparedness. Therefore, the principal purpose of Zoe ' s high-interaction honeypot is to deceive attackers and study their behavior.

================

In the ECIH Incident Handling lifecycle, once a breach is detected, the IH & R team must focus on analysis and scoping to understand how the attack occurred, what systems were affected, and whether the attacker still has access.

Option D is correct because analyzing logs with Incident Response Automation and Orchestration (IRAO) tools allows rapid correlation of events, identification of attacker entry points, and determination of breach scope. ECIH stresses that zero-day incidents require deep forensic and timeline analysis to ensure complete containment and prevent recurrence.

Options A and C are important but depend on accurate breach understanding. Option B is premature without full incident context.

Therefore, log analysis and origin tracing is the correct primary focus.

This scenario describes a SYN flood attack, a classic protocol-level Denial-of-Service technique covered in the ECIH Network Security Incidents module. In a SYN flood, attackers send a large volume of TCP SYN packets but never complete the three-way handshake, leaving the server waiting for responses and exhausting connection resources.

Option D is correct because incomplete TCP handshakes, half-open connections, and resource exhaustion are defining characteristics of SYN flood attacks. The presence of multiple source IPs further suggests a distributed attack.

Option A involves taking over an existing session, not exhausting resources. Option B applies to UDP-based amplification attacks. Option C affects DNS resolution, not TCP handshakes.

ECIH stresses that early identification of SYN floods allows defenders to deploy SYN cookies, rate limiting, and upstream filtering. Recognizing handshake anomalies is therefore critical in protecting service availability.

Insider threats are among the most difficult risks to detect because insiders often operate within legitimate access boundaries. The ECIH Insider Threat module emphasizes that behavioral analytics is the most effective approach for identifying sophisticated, low-and-slow insider activity.

Option B is correct because behavioral analytics correlates user actions over time to detect anomalies such as unusual transaction patterns, abnormal access times, or deviations from job role norms. This allows detection of malicious behavior that traditional rule-based monitoring may miss.

Options A, C, and D are invasive, unethical, and often illegal, and they contradict ECIH guidance on lawful, proportional monitoring.

ECIH stresses that insider threat programs must balance security, privacy, and legality while providing meaningful detection. Behavioral analytics meets these requirements and provides actionable insights, making Option B the correct answer.

Unauthorized access to cloud backend services should immediately trigger examination of identity and access controls because excessive or improperly assigned permissions are a common source of cloud compromise. Reviewing IAM roles allows the responder to determine which principals can access the backend, identify over-privileged or compromised identities, revoke unnecessary privileges, and enforce least privilege. Security Command Center improves ongoing detection but does not directly correct the permissions enabling current unauthorized access. VPC Service Controls can provide an additional service perimeter but should complement rather than replace correct IAM authorization. Migrating the application to another project is disruptive and could reproduce the same access-control weakness if the underlying configuration is not fixed. ECIH cloud incident handling emphasizes addressing the compromised access path and reducing unauthorized privileges before implementing broader defensive improvements.

================

A robust EDR capability provides continuous endpoint visibility, behavioral detection, investigation, and rapid containment, making it central to responding to targeted endpoint attacks. During a high-risk product launch, attackers may attempt credential theft, malware execution, intellectual-property exfiltration, or persistence on developer systems and test servers. EDR can correlate endpoint events, detect abnormal processes and communications, isolate compromised hosts, and support automated response before an intrusion expands. Encryption protects information confidentiality but does not detect active endpoint compromise. Security-awareness training reduces social-engineering risk but cannot identify every malicious endpoint behavior. A crisis-management team supports coordination but still requires technical telemetry and containment capabilities. Therefore, EDR with automated response provides the strongest operational capability for detecting and responding quickly to endpoint incidents during the critical launch period.

================

ECIH recognizes that containment strategies must consider operational impact, evidence preservation, and attacker behavior. In this OT environment, the organization specifically needs to restrict lateral movement without revealing that defenders have detected the attacker. Selectively disabling services associated with the attack while continuing passive monitoring provides controlled, low-profile containment. It can restrict the adversary ' s movement while allowing responders to observe persistence mechanisms, communications, and attempted exfiltration and preserve valuable forensic evidence. A system-wide shutdown would be highly disruptive to production and immediately alert the attacker. Restoring from backup is a recovery action and could destroy evidence or reintroduce compromise before the threat is understood. An organization-wide credential-change announcement would likewise expose the response effort. Therefore, selective service restriction combined with passive monitoring best satisfies the required stealth-containment objective.

================