Certified Incident Handler (CIH) Practice Ecam

What practice helps incident responders restore the network after a wireless security incident?

1. Using SSID cloaking

2. Implementing aggressive traffic filtering

3. Disabling all wireless access temporarily

4. Upgrading firmware across the network devices

The correct answer is: Using SSID cloaking

Restoring a network after a wireless security incident involves several practices aimed at securing the environment while ensuring continuity of service. SSID cloaking involves hiding the network name from being easily visible to potential attackers. This practice can help reduce the risk of unauthorized access and network discovery by adversaries. By reducing the visibility of the wireless network, it can potentially mitigate further attacks and provide incident responders a degree of safety when restoring normal operations. Cloaking an SSID can be part of a broader strategy to improve security postures, allowing for a more secure investigation and resolution process without exposing the network to additional vulnerabilities during the recovery phase. Conversely, while aggressive traffic filtering can enhance security, it may not directly facilitate restoring the network and could potentially disrupt legitimate traffic. Disabling all wireless access temporarily can certainly secure the network but can lead to service outages, which is counterproductive for restoration efforts. Upgrading firmware is a preventive measure for vulnerabilities but would not directly assist in incident recovery. Therefore, SSID cloaking serves as an effective means to restore securely while minimizing further risks.