The EC-Council Incident Handler (ECIH) curriculum categorizes incidents such as unauthorized software installation and policy violations under inappropriate usage incidents. In this scenario, the activity originated from a legitimate internal workstation and user account, not an external third party.
The repeated login failures outside business hours combined with installation of an unauthorized remote desktop tool indicate a breach of acceptable use policy and potentially malicious intent.
However, the key factor is that the actions were performed by an internal user using valid access credentials, making this an insider-related policy violation rather than an external unauthorized access attack.

Not enabling default administrative accounts is crucial to ensuring accountability and minimizing the risk of insider attacks by privileged users. By disabling or renaming default accounts, organizations can better track the actions performed by individual administrators, reducing the risk of unauthorized or malicious activities going unnoticed. This practice is part of a broader approach to privilege management that includes limiting permissions to the minimum necessary and monitoring the use of administrative privileges.

In the identification phase of the incident handling lifecycle, the primary objective is to determine whether an observed anomaly qualifies as a security incident. This is a critical first step in incident response because not every unusual activity signifies a true threat. Some anomalies may be harmless system errors, false positives, or performance-related issues rather than attacks.
The process typically begins when security monitoring tools, such as intrusion detection systems (IDS), security information and event management (SIEM) systems, or antivirus software, generate alerts. Security teams then investigate these alerts to assess the scope, impact, and authenticity of the event.

This scenario highlights recovery challenges specific to IoT environments, which are addressed in the ECIH Endpoint and IoT Incident Handling modules. IoT systems generate continuous streams of operational data, configuration states, and control commands that are essential for accurate recovery after disruption.
Option D is correct because maintaining synchronized cloud replicas of critical IoT resources ensures near-real-time availability of sensor data, device configurations, and control logic. ECIH emphasizes that traditional periodic backups are often insufficient for IoT and OT systems due to their dynamic and state-dependent nature. Cloud replication supports faster, more complete restoration and reduces data gaps.
Options A, B, and C rely on static or delayed backup mechanisms that cannot capture the operational state required to restore IoT systems accurately. Tape archives and external drives introduce latency and risk data loss, while ZIP archives lack synchronization.
ECIH recovery guidance stresses resilience and continuity, particularly for operational technology. Continuous replication is therefore the most effective strategy.