Discuss EC-Council 212-89 Exam Topic 5 Question 90

A cybersecurity analyst at a technology firm discovers suspicious activity on a network segment dedicated to research and development. The initial indicators suggest a possible compromise of several endpoints with potential intellectual property theft. Given the sensitive nature of the data involved, what is the most effective method for the analyst to detect and validate the security incident?

DConduct a network-wide vulnerability scan.
Comprehensive and Detailed Explanation (ECIH-aligned):
The ECIH Endpoint Security module stresses that modern endpoint incidents require advanced detection capabilities beyond traditional antivirus or manual inspection. Intellectual property theft often involves stealthy techniques that evade basic controls.
Option C is correct because an Endpoint Detection and Response (EDR) solution provides deep visibility into endpoint behavior, including process execution, memory activity, file changes, and lateral movement. EDR enables analysts to detect, investigate, and validate incidents efficiently across multiple endpoints.
Option B is slow and error-prone. Option A is premature without validation. Option D identifies vulnerabilities, not active compromise.
ECIH highlights EDR as a cornerstone technology for endpoint incident detection and validation, especially in high-value environments such as R&D networks.

CDeploy an endpoint detection and response (EDR) solution to identify and investigate suspicious activities.

BIsolate the affected network segment and manually inspect each endpoint.

AImmediately notify law enforcement and regulatory bodies.

Suggested Answer: C

Get Premium 212-89 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

25 comments · newest first

Ozell 4 months ago

Yes, but I’d prioritize isolating affected endpoints first to prevent further damage.

Valda 4 months ago

What about endpoint detection tools? They can catch anomalies quickly.

Farrah 4 months ago

Agreed! Analyzing logs can reveal unauthorized access patterns.

Isidra 6 months ago

I think monitoring network traffic is key. It shows real-time data flow.

Thomasena 6 months ago

I think validating with user activity logs is also important!

Leatha 6 months ago

Wait, are we sure it’s a compromise? Could be a false alarm.

Reita 6 months ago

What about endpoint detection tools? They could help too.

Nieves 6 months ago

Totally agree, monitoring traffic is key!

Johnetta 6 months ago

They should start with a thorough network traffic analysis.

Phung 7 months ago

Haha, just unplug the whole network. That'll stop the breach, right?

Felicitas 7 months ago

Network traffic monitoring and analysis. Might catch the attacker in the act.

Dominga 7 months ago

Forensic analysis of the affected endpoints. Can't miss any crucial evidence.

Mitsue 7 months ago

Incident response plan, for sure. Gotta act fast to contain the breach.

Salome 7 months ago

I feel like we should also consider using endpoint detection and response (EDR) solutions to get a clearer picture of the compromise.

Beckie 7 months ago

This sounds similar to a practice question we did on incident response. I think the key is to prioritize the endpoints involved first.

Mollie 8 months ago

I'm not entirely sure, but I think correlating logs from different endpoints could provide more context about the suspicious activity.

Desmond 8 months ago

I remember we discussed using network traffic analysis tools to spot anomalies. That might help in validating the incident.

Jesus 9 months ago

Hmm, not sure where I'd start on this one. Validating the security incident seems crucial, so I guess I'd focus on gathering as much data as possible from the affected systems and the network.

Vinnie 9 months ago

Alright, let's see. Detecting and validating the incident - that's the key here. I'd probably start with network monitoring and traffic analysis to try to identify the source and scope of the compromise.

Thaddeus 9 months ago

Oof, this is a sensitive one with intellectual property at risk. I'd recommend a thorough investigation, maybe even bringing in some specialized incident response expertise to ensure we handle this properly.

Bea 9 months ago

Okay, so we need to validate the security incident and detect the potential compromise. I think I'd focus on collecting forensic data from the affected endpoints to analyze for signs of intrusion.

Lonny 9 months ago

Hmm, this seems like a tricky one. I'd start by reviewing the network logs and endpoint activity in detail to look for any anomalies or unusual behavior.

Luisa 3 months ago

↳ replying to Lonny

Don't forget to isolate the affected systems to prevent further damage!

Felicidad 3 months ago

↳ replying to Lonny

Maybe also run a vulnerability scan on those endpoints?

Billye 4 months ago

↳ replying to Lonny

I agree, checking the logs is crucial.

EC-Council 212-89 Exam - Topic 5 Question 90 Discussion