GCIH Incident Detection & Analysis

Question 1

What is the primary objective of incident detection?

Accepted Answer

To identify and mitigate threats in real time

Answer

The primary objective of incident detection is to identify and mitigate security threats in real-time or as close to real-time as possible. This involves continuously monitoring systems, networks, and applications for suspicious activities or anomalies that could indicate a security breach or attack. Prompt detection is crucial for minimizing the impact and scope of an incident before it can cause significant damage.

Question 2

Which type of incidents does intrusion detection primarily focus on?

Accepted Answer

Suspicious network activity and unauthorized access

Answer

Intrusion detection primarily focuses on identifying suspicious network activity and unauthorized access attempts. This includes detecting unusual traffic patterns, login failures, attempts to exploit vulnerabilities, or any behavior that deviates from normal, authorized operations. Its goal is to alert security teams to potential breaches or ongoing attacks, allowing for timely intervention.

Question 3

How does network monitoring contribute to incident detection?

Accepted Answer

It helps detect anomalies that could indicate an incident

Answer

Network monitoring significantly contributes to incident detection by providing continuous visibility into network traffic, device behavior, and resource utilization. By analyzing this data, security teams can identify anomalies, such as unusual spikes in traffic, connections to suspicious IP addresses, or unauthorized data transfers, which often serve as early indicators of a security incident or attack.

Question 4

What is the role of log analysis in incident detection?

Accepted Answer

To identify unauthorized access and system malfunctions

Answer

Log analysis plays a critical role in incident detection by providing a detailed historical record of system activities, user actions, and network events. By reviewing and correlating log data from various sources, security analysts can identify patterns indicative of unauthorized access, system malfunctions, or malicious behavior that might otherwise go unnoticed. This forensic capability is essential for understanding the scope and nature of an incident.

Question 5

What does the term 'false positive' mean in incident detection?

Accepted Answer

A non-threat activity flagged as an incident

Answer

In incident detection, a 'false positive' refers to a non-threat activity or benign event that is mistakenly flagged as a security incident by a detection system. While the system correctly identifies an anomaly, the anomaly itself does not represent a genuine threat or attack. Managing false positives is crucial to avoid alert fatigue and ensure security teams can focus on actual threats.

(GCIH) GIAC Experienced Incident Handler Practice Test

(GCIH) GIAC Experienced Incident Handler Practice Test

GCIH Incident Detection & Analysis