Whaling is a specific type of phishing attack that targets high-profile executives or individuals within an organization, often with the intent to steal sensitive information or gain access to their accounts for financial fraud. The term "whaling" is used because it targets the "big fish" of an organization. Given that Sam identified the targets of the attack as high-profile executives, the described scenario is indicative of a whaling attack.
References:The ECIH v3 curriculum includes a section on different types of phishing attacks, including whaling, emphasizing the strategies attackers use to target individuals based on their roles within an organization.

Public Key Infrastructure (PKI) is a framework used to manage digital certificates and public-key encryption.
It enables secure electronic transfer of information for a range of network activities such as e-commerce, internet banking, and confidential email. PKI is fundamental to the management of encryption keys and digital certificates, ensuring the secure exchange of data over networks and verification of identity.
References:The ECIH v3 program covers the importance of PKI in cloud security controls, emphasizing its role in establishing and maintaining a secure cloud computing environment.

This scenario describes an active malware infection with confirmed command-and-control (C2) communication, which represents an immediate and severe risk to sensitive financial data. According to the EC-Council ECIH malware incident handling process, the first priority in such cases is containment, specifically stopping ongoing malicious activity and preventing further data exfiltration.
Option A is correct because disconnecting the affected servers from the network immediately severs the attacker's control channel and halts outbound data leakage. ECIH emphasizes that when C2 traffic is observed, responders must act decisively to isolate compromised systems before pursuing deeper forensic analysis or remediation. Containment minimizes damage and reduces legal, financial, and reputational impact.
Option B may preserve system state but allows continued exfiltration until shutdown is complete and may disrupt critical banking operations. Option C is a preventive measure and does not stop an active infection.
Option D is valuable for investigation but should occur after containment, not before.
ECIH guidance consistently prioritizes stopping harm over gathering evidence when critical assets are at risk.
Therefore, immediate network disconnection of affected servers is the correct triage action.

The EC-Council Incident Handler (ECIH) curriculum highlights the Shared Responsibility Model in cloud environments. Cloud providers are responsible for security of the cloud (infrastructure), while customers are responsible for security in the cloud (applications, data, access control).
Confusion over responsibility leads to delayed incident response, misconfigurations, and security gaps. ECIH emphasizes clearly defining roles between cloud providers and internal teams before incidents occur, including logging, monitoring, access management, and incident handling responsibilities.
Option A improves security posture but does not resolve responsibility confusion. Option B improperly shifts all responsibility to the provider, which contradicts the shared model. Option D relates to operational configuration, not governance clarity.
Therefore, understanding shared responsibilities for incident response in cloud environments is critical to effectively managing cloud security incidents.

Centralized logging and monitoring is a core best practice in cloud incident detection and response under ECIH. Cloud environments are distributed and dynamic, making visibility a major challenge.
Option C is correct because aggregating logs from multiple cloud platforms enables correlation, faster detection, and effective incident triage. ECIH emphasizes centralized visibility as essential for identifying cross-platform threats.
Options A and D are limited in scope. Option B does not address cloud-specific risks.