Certified Incident Handler (CIH) Practice Ecam

In the scenario where Williams was handling a security incident, which resources did he investigate?

1. Servers, Application Settings, Network Configurations

2. Servers, Networking, Storage

3. Databases, Operating Systems, User Permissions

4. Virtual Private Networks, Servers, User Accounts

The correct answer is: Servers, Networking, Storage

In the context of handling a security incident, the resources investigated should cover the critical components involved in maintaining the infrastructure and ensuring the security posture of the organization. The choice that includes "Servers," "Networking," and "Storage" embodies a comprehensive approach to incident handling. By focusing on servers, Williams would assess the hardware and software systems that are crucial for operations. These are often the first targets in a security incident and can provide vital clues regarding the breach or compromise. Networking is also foundational as it encompasses the communication between devices, making it necessary to analyze for unauthorized access, suspicious activity, or configuration issues that might have contributed to the incident. Storage involves the data retained by the organization and could contain logs or other essential factors that could shed light on the incident's details. Investigating these resources allows an incident handler to effectively gauge the scope of the incident, determine the vulnerabilities exploited, and assess where corrective measures are necessary. This focused approach on infrastructure and data management is essential for mitigating risks and preventing future incidents.