Certified Incident Handler (CIH) Practice Ecam

Which practice assists incident responders in ending inappropriate usage incidents on a network?

1. Register user activity logs and regularly monitor them

2. Ignore user behavior and focus on hardware upgrades

3. Disable logging to save storage space

4. Only review logs periodically

The correct answer is: Register user activity logs and regularly monitor them

Monitoring user activity logs is integral for incident responders in managing and mitigating inappropriate usage incidents on a network. This practice provides a detailed record of user actions and behaviors, enabling responders to identify suspicious or non-compliant activities promptly. By regularly tracking and analyzing these logs, incident handlers can detect patterns of abuse, such as unauthorized access to sensitive data, misuse of network resources, or other security violations. This proactive approach allows organizations to take corrective action before issues escalate, reinforcing security protocols and fostering a safer network environment. Other methods such as ignoring user behavior or disabling logging would increase vulnerability to potential security threats and hinder the ability to perform necessary investigations. Limiting log reviews to periodic checks would also reduce the chance of detecting real-time anomalies, which could prevent timely interventions. Thus, maintaining active and regular monitoring of user activity is essential in the role of an incident responder.