Advanced persistent threats require coordinated, intelligence-driven response. ECIH emphasizes that APT investigations generate massive volumes of telemetry across endpoints, networks, and cloud platforms.
Option D is correct because Incident Response Automation and Orchestration (IRAO) tools correlate disparate data sources, automate enrichment, and accelerate threat hunting. This enables responders to identify hidden persistence mechanisms and attacker TTPs efficiently.
Options A, B, and C are important but not immediate investigative actions.
ECIH explicitly recommends orchestration platforms for complex, multi-vector incidents such as APTs.

When Joseph, the IH&R team lead, alerted service providers, developers, and manufacturers about the affected resources, he was engaged in the Containment stage of the Incident Handling and Response (IH&R) process. Containment involves taking steps to limit the spread or impact of an incident and to isolate affected systems to prevent further damage. Alerting relevant stakeholders, including service providers and developers, is part of containment efforts to ensure that the threat does not escalate and that measures are taken to protect unaffected resources. This stage precedes eradication and recovery, focusing on immediate response actions to secure the environment.
References:The ECIH v3 certification program outlines the IH&R process stages, explaining the roles and actions involved in containment, including communication with external and internal stakeholders to manage and mitigate the incident's effects.

Pharming is a cyber attack intended to redirect a website's traffic to another, bogus website. By poisoning a DNS server's cache, attackers can redirect users from the site they intended to visit to one that is malicious, without the user's knowledge or any action on their part, such as clicking a deceptive link. This technique is particularly insidious because it can affect well-intentioned users who type the correct URL into their browsers but are still redirected. War driving involves searching for wireless networks from a moving vehicle, skimming refers to stealing credit card information using a device placed on ATMs or point-of-sale terminals, and pretexting is a form of social engineering where the attacker lies to obtain privileged data.
References:The Incident Handler (ECIH v3) certification program covers a variety of cyber attacks and techniques, including DNS poisoning and pharming, explaining how attackers exploit vulnerabilities to redirect users to fraudulent sites.

The root cause of this incident is unvalidated input poisoning the AI training process, resulting in malicious output. ECIH web application security principles emphasize that input validation is the primary control against injection and manipulation attacks.
Option B is correct because strict validation ensures that malicious or untrusted data cannot influence training or response generation. This addresses the vulnerability at its source.
Option A adds friction but does not stop poisoning. Option C is disruptive and not efficient. Option D limits functionality without fixing the underlying issue.
ECIH stresses fixing vulnerabilities at the root rather than applying superficial controls, making Option B correct.

Omnipeek is a network analyzer tool that allows for the capture and analysis of data packets transmitted across a network. It is designed to provide deep insights into network traffic, enabling users to examine various aspects of the data packets, including network protocols, ports, devices, and potential issues in network transmission. This tool would be ideal for Chandler, who is targeting the Technote organization with the intent of intercepting and analyzing network traffic to obtain sensitive organizational information.
Omnipeek's capabilities in packet analysis make it suitable for such activities, offering detailed visibility into the network's operation and data flows.
References:The ECIH v3 certification program includes discussions on network monitoring and analysis tools, including packet sniffers like Omnipeek, and their role in both cybersecurity defense and offensive activities like hacking.