If a hacker influences an employee or a disgruntled staff member to gain access to an organization's resources or sensitive information, this is classified as an insider attack. Insider attacks are perpetrated by individuals within the organization, such as employees, contractors, or business associates, who have inside information concerning the organization's security practices, data, and computer systems. The threat from insiders can be intentional, as in the case of a disgruntled employee seeking to harm the organization, or unintentional, where an employee is manipulated or coerced by external parties without realizing the implications of their actions.
Phishing attacks, footprinting, and identity theft represent different types of cybersecurity threats where the attacker's method or objective differs from that of insider attacks.

In IoT and OT environments, the ECIH curriculum emphasizes that containment is the highest first-response priority, especially when public safety and critical services are involved. The abnormal data transmission strongly suggests compromise, and allowing the device to remain connected risks lateral movement, data exfiltration, and operational disruption.
Option C is correct because immediate isolation of the affected IoT device prevents further unauthorized communication while preserving the system's current state for forensic analysis.
Isolation limits the blast radius without unnecessarily disrupting the entire infrastructure.
Option A introduces risk by changing system states during an active incident. Option B is preventive and not an incident response action. Option D is appropriate after containment but not before.
Thus, isolating the compromised device aligns with ECIH endpoint and IoT incident handling principles.

This scenario involves a suspected malicious insider threat with potential external collusion, which significantly elevates legal, regulatory, and evidentiary requirements. The ECIH curriculum emphasizes that when insider activity is suspected--especially involving terminated employees and possible corporate espionage--organizations must prioritize forensic integrity, confidentiality, and lawful investigation.
Option B is correct because collaborating with external forensic experts and law enforcement ensures a neutral, legally defensible investigation. ECIH stresses that insider cases often require specialized forensic capabilities, evidence preservation, and legal authority that internal teams alone may not possess. Maintaining confidentiality protects the organization from reputational damage and legal exposure while facts are being established.
Option A ignores the insider dimension and risks repeat incidents. Option C bypasses legal safeguards and could be interpreted as obstruction or collusion. Option D is premature and exposes the organization to defamation and legal risk without substantiated evidence.
ECIH guidance is clear that complex insider incidents should be escalated appropriately with legal and forensic rigor. Therefore, Option B aligns best with recommended practice.

The ECIH Network Security Incident Handling module emphasizes maintaining availability while mitigating denial-of-service attacks. The objective is not simply to stop traffic, but to distinguish malicious traffic from legitimate user requests.
Option D is correct because rate limiting and challenge-response mechanisms (such as CAPTCHA or SYN cookies) allow legitimate traffic to continue while throttling or blocking malicious requests. This approach minimizes service disruption while effectively containing the attack.
Option A may increase costs and still fail against large-scale DDoS attacks. Option B can unintentionally block legitimate users. Option C contradicts ECIH guidance by unnecessarily impacting availability.
ECIH stresses proportional and intelligent mitigation strategies that preserve business continuity.
Therefore, implementing rate limiting and challenge-response mechanisms is the preferred strategy.