Exam 212-89 Topic 6 Question 2 Discussion
Actual exam question for EC-COUNCIL's 212-89 exam
Question #: 2
Topic #: 6
Question #: 2
Topic #: 6
SpaceTech Innovations, specializing in space exploration software, encountered malware that camouflaged itself within proprietary algorithms. This stealthy malware intermittently transmitted blueprints to an unknown receiver. With a state-of-the-art code analyzer and a network traffic analyzer at hand, what's the ideal first step?
Suggested Answer: B Vote an answer
This incident involves active data exfiltration, which ECIH malware handling guidance identifies as a critical containment priority. When malware is actively transmitting sensitive data, stopping the leak takes precedence over deep analysis.
Option B is correct because using the network traffic analyzer to identify and halt outbound malicious communication immediately prevents further data loss. ECIH stresses that containment actions must first stop harm before eradication and recovery.
Option A supports eradication but does not immediately stop exfiltration. Option C is premature. Option D is unreliable and risks reinfection.
Therefore, halting malicious transmissions is the ideal first step.
Option B is correct because using the network traffic analyzer to identify and halt outbound malicious communication immediately prevents further data loss. ECIH stresses that containment actions must first stop harm before eradication and recovery.
Option A supports eradication but does not immediately stop exfiltration. Option C is premature. Option D is unreliable and risks reinfection.
Therefore, halting malicious transmissions is the ideal first step.
by Nina at Aug 16, 2026, 01:00 AM
0
0
0
10
Comments
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Report Comment
Commenting
You can sign-up / login (it's free).