~/eccouncil-ecih · study ▊

practice sheet · all objectives switch to smart practice →

Certified Incident Handler (E|CIH)

0/31 checked

Q_01 domain/d1 · medium single discuss →

During a tabletop exercise, a security manager wants to build the incident response program around Module 01 topics of the ECIH curriculum. Which of the following belongs specifically to the 'Introduction to Incident Handling and Response' module rather than to the later process module?

A Explaining the process of preserving, packaging, and transporting evidence
B Explaining various attack and defense frameworks such as the Cyber Kill Chain and MITRE ATT&CK
C Describing evidence gathering and forensics analysis
D Understanding the process of containment

Q_02 domain/d1 · medium single discuss →

A newly hired analyst reads that the ECIH program is 'method-driven' and provides a 'holistic approach' to organizational IH&R. Which statement BEST captures the scope this approach is intended to cover according to the source material?

A It covers only the detection and containment phases of incidents
B It focuses exclusively on forensic analysis and prosecution
C It covers everything from preparing/planning the incident response process to recovering organizational assets from the impact of incidents
D It is limited to preventing threats before any incident occurs

Q_03 domain/d1 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_04 domain/d1 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_05 domain/d1 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_06 domain/d2 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_07 domain/d2 · medium multi

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_08 domain/d2 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_09 domain/d2 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_10 domain/d2 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_11 domain/d3 · medium multi

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_12 domain/d3 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_13 domain/d3 · medium multi

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_14 domain/d3 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_15 domain/d4 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_16 domain/d4 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_17 domain/d5 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_18 domain/d5 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_19 domain/d5 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_20 domain/d6 · medium multi

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_21 domain/d6 · medium multi

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_22 domain/d6 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_23 domain/d6 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_24 domain/d7 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_25 domain/d7 · medium multi

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_26 domain/d7 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_27 domain/d8 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_28 domain/d8 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_29 domain/d9 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_30 domain/d10 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_31 domain/d10 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

29 questions locked

unlock all 29 questions