Certified Incident Handler (CIH) Practice Ecam

What technique did James employ after containing a virus incident?

1. Malware Blacklisting

2. Data Encryption

3. System Recovery

4. Network Mapping

The correct answer is: Malware Blacklisting

In the context of incident handling, after containing a virus incident, employing a technique like malware blacklisting is crucial for preventing further infection and ensuring the security of the system. Malware blacklisting involves identifying and blocking known malware signatures, which helps to mitigate the risk of previously identified threats re-infecting the system or spreading to other devices. By implementing blacklisting, James would be able to maintain a more secure environment by restricting the execution of these malicious software applications. While data encryption, system recovery, and network mapping are important components of cybersecurity and incident response, they serve different purposes. Data encryption protects the confidentiality of data rather than specifically addressing the immediate threat of malware. System recovery focuses on restoring systems to operational status after an attack, and network mapping helps to understand the network layout and potential vulnerabilities but does not directly prevent malware re-infection. Thus, blacklisting is the most appropriate technique employed in this scenario for the purpose of directly managing the aftermath of a virus incident.