Certified Incident Handler (CIH) Practice Ecam

Which of the following is a common sign of network security incidents?

1. Single failed login attempt

2. Multiple failures in network login attempts

3. Authorized access requests

4. Firmware updates on network devices

The correct answer is: Multiple failures in network login attempts

Multiple failures in network login attempts are indeed a common sign of network security incidents. This behavior often indicates that an unauthorized user may be attempting to gain access to a system or network by guessing passwords, which is a classic sign of a brute force attack. When a user fails to log in multiple times, it raises red flags for network administrators as it suggests that there may be attempts at unauthorized access. Monitoring such activities is critical for identifying potential breaches and responding to them effectively. In contrast, a single failed login attempt might not necessarily indicate a security incident, as it could be easily attributed to a forgotten password or a mistyped entry. Authorized access requests do not pose a security concern, as they are expected behavior from validated users. Firmware updates on network devices, while important for maintaining security, do not directly indicate an incident; rather, they are a normal part of network maintenance aimed at improving security and functionality. Thus, the presence of multiple failed login attempts effectively serves as a significant indicator prompting further investigation into possible security threats.