Certified Incident Handler (CIH) Practice Ecam

Which practice helps incident handlers in containing a malware incident?

1. Use automated tools such as anti-malware software, IDS, and IPS

2. Ignore system alerts and notifications

3. Connect to untrusted networks while analyzing

4. Share organizational credentials publicly

The correct answer is: Use automated tools such as anti-malware software, IDS, and IPS

Using automated tools such as anti-malware software, Intrusion Detection Systems (IDS), and Intrusion Prevention Systems (IPS) is a fundamental practice that assists incident handlers in containing malware incidents effectively. These tools are specifically designed to detect, analyze, and respond to potential threats in real time. Automated anti-malware software can identify and eliminate malicious software before it has a chance to cause significant damage. IDS monitors network traffic for suspicious activity and can alert handlers to potential breaches, while IPS can actively block or mitigate detected threats, thereby reducing the risk of further infection or damage. Essentially, these tools support incident handlers by providing the necessary visibility and responsiveness to contain incidents swiftly and minimize their impact on the organization. In contrast, ignoring system alerts and notifications can lead to undetected threats proliferating within the network, while connecting to untrusted networks during an analysis could expose the incident handlers to further risks and complicate containment efforts. Lastly, sharing organizational credentials publicly severely compromises security and can lead to broader incidents beyond malware containment. Utilizing automated tools is thus the most strategic and effective approach for incident handlers in mitigating malware threats.