Certified Incident Handler (CIH) Practice Ecam

What is the key goal of employing a port monitoring tool during an incident?

1. To disable security measures

2. To analyze detailed connection endpoints

3. To prevent any system updates

4. To connect to external networks

The correct answer is: To analyze detailed connection endpoints

Utilizing a port monitoring tool during an incident serves the primary goal of analyzing detailed connection endpoints. This analysis is crucial because it allows incident handlers to observe what connections are being made and identify potential malicious behaviors or unauthorized access attempts on the network. By monitoring various ports, security professionals can gather intelligence about the types of data being transmitted, the protocols being used, and the specific hosts involved in the communication. This information is vital for understanding the scope of the incident, determining the nature of any threats, and formulating an appropriate response strategy. The other choices do not align with the objectives of incident response effectively. Disabling security measures could exacerbate vulnerabilities rather than help secure the environment. Preventing system updates is detrimental because updates often contain security patches that could close vulnerabilities exploited during an incident. Connecting to external networks during an ongoing incident may introduce further risks rather than supporting the containment and investigation efforts.