Certified Incident Handler (CIH) Practice Ecam

What should an incident responder do to prepare for handling network-based security incidents?

1. Review network access policies

2. Execute security vulnerability scans

3. Communicate with the physical security team

4. Deploy a new firewall system

The correct answer is: Communicate with the physical security team

An effective incident responder must ensure a comprehensive approach to incident handling, which includes collaboration with various teams, such as physical security. Communicating with the physical security team is essential because many network-based security incidents can have physical implications, such as unauthorized access to network equipment or data centers. Understanding the physical security measures in place can help an incident responder anticipate potential threats and coordinate response efforts effectively. This collaboration ensures that both virtual and physical security are considered critical factors during the incident response process. Additionally, while reviewing network access policies, executing security vulnerability scans, and deploying a new firewall system are indeed important tasks for securing a network, they primarily pertain to proactive measures rather than preparation for incident response specifically. Communicating with physical security directly addresses the collaborative aspect of incident handling, making it a vital step in preparing for network-based incidents.