Certified Incident Handler (CIH) Practice Ecam

Which of the following may not help incident responders contain security incidents on the Azure cloud platform?

1. Reviewing Azure logs

2. Identifying potential vulnerabilities

3. Developing a detailed incident response plan

4. Ignoring inactive accounts

The correct answer is: Ignoring inactive accounts

The reasoning behind the correct choice emphasizes the importance of actively managing all user accounts within an organization, especially in the context of incident response on the Azure cloud platform. Ignoring inactive accounts can pose a significant security risk, as these accounts might be exploited by malicious actors. Inactive accounts may not receive regular security checks or patch updates, making them potential entry points for man-in-the-middle attacks or unauthorized access. In contrast, reviewing Azure logs is crucial for tracking user activities and identifying unusual patterns that could indicate a security incident. Identifying potential vulnerabilities helps to proactively address weaknesses in the system before they can be exploited. Developing a detailed incident response plan ensures that the organization is prepared to respond effectively to security incidents when they occur. Therefore, actively managing all accounts, including inactive ones, is essential for a comprehensive incident response strategy on the Azure cloud platform.