In the ECIH Incident Handling lifecycle, once a breach is detected, the IH&R team must focus on analysis and scoping to understand how the attack occurred, what systems were affected, and whether the attacker still has access.
Option D is correct because analyzing logs with Incident Response Automation and Orchestration (IRAO) tools allows rapid correlation of events, identification of attacker entry points, and determination of breach scope. ECIH stresses that zero-day incidents require deep forensic and timeline analysis to ensure complete containment and prevent recurrence.
Options A and C are important but depend on accurate breach understanding. Option B is premature without full incident context.
Therefore, log analysis and origin tracing is the correct primary focus.

Fragmentation is a technique used by attackers to evade detection by Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS). By breaking down packets into smaller fragments, attackers can make it more difficult for these security systems to detect malicious payloads or signature-based patterns associated with known attacks. This method exploits the fact that some IDS/IPS solutions may not properly reassemble packet fragments for analysis, thereby allowing malicious fragments to pass through undetected.
References:In its coverage of network security mechanisms and evasion techniques, the ECIH v3 certification details how attackers exploit vulnerabilities in the implementation of IDS and IPS systems, including the use of packet fragmentation.

The EC-Council Incident Handler (ECIH) curriculum emphasizes that recovery must not only restore functionality but also eliminate residual security weaknesses that could enable reinfection or continued compromise. In operational technology (OT) and industrial environments, identity validation, certificate trust, and strict access control between interconnected systems are critical.
The scenario highlights two major issues: excessive permissions between authentication servers and automation modules, and anomalies in authentication tokens with unidentified fingerprints. These findings indicate compromised trust relationships and over-privileged system communications.
ECIH recovery guidance stresses revalidating authentication mechanisms, enforcing the Principle of Least Privilege, reviewing trust relationships, and ensuring certificate integrity before declaring systems fully restored. Implementing granular role-based access controls (RBAC) and validating trusted device certificates directly addresses both excessive permissions and authentication anomalies.
Option A improves detection but does not correct trust misconfigurations. Option B (red-team simulation) is useful but secondary to securing authentication controls. Option C (system reboot) does not resolve permission or certificate validation issues.
Therefore, enforcing granular role-based access policies and validating trusted device certificates is the most critical secure restoration action.

Explanation (preparation phase):
This is classic preparation work aimed at improving detection and response speed. Valid incident handling begins before incidents occur: ensuring telemetry exists, logs are collected centrally, alerts are actionable, and roles are defined so handoffs and escalation happen quickly. Reviewing firewall and IDS/IPS logging, centralizing alerts, and aligning the response team on responsibilities directly supports monitoring readiness and operational coordination.
(A) backup hardening is about recovery resilience and integrity of backups; nothing in the scenario references backup configurations or restore testing. (B) law enforcement coordination is a procedural/legal readiness task, not what is described. (C) vulnerability scanning is proactive identification of weaknesses; again, the actions here are about log visibility and alerting, not scanning.
Network monitoring readiness (D) best fits because it includes: ensuring the right data sources are logging, time synchronization, centralized collection (SIEM/log platform), and defined responsibilities for triage and escalation. This aligns with playbook-style preparation models that emphasize roles and monitoring visibility before incidents occur .