Certified Incident Handler (CIH) Practice Ecam

Which of the following signs helps an incident responder detect an unauthorized service usage incident in an organizational network?

1. Installation of new processes and software running on a host

2. Unusual outbound traffic patterns

3. Frequent login attempts from unknown locations

4. Declining performance of network resources

The correct answer is: Installation of new processes and software running on a host

The installation of new processes and software running on a host can be a strong indicator of unauthorized service usage within an organizational network. When an incident responder notices unexpected applications or processes that have been installed without proper authorization, it raises red flags. These installations could be indicative of malicious activities or breaches, as attackers may deploy unauthorized software to exploit vulnerabilities, steal data, or gain control over systems. Monitoring for new software and processes is crucial because legitimate applications usually undergo significant scrutiny before being added to an organization's infrastructure. In contrast, unauthorized or rogue software can create backdoors or allow for unauthorized access, making it a key sign for incident responders to investigate further. The other options, while they may also indicate potential security incidents, focus on different aspects such as traffic anomalies, failed login attempts, or performance issues rather than directly on unauthorized installation, which is a more clear-cut indicator of tampering or misuse of services.