Certified Incident Handler (CIH) Practice Ecam

Which practice should an incident responder avoid while containing wireless security incidents?

1. Turning on suspected privileges on the router

2. Creating guest network access

3. Changing the wireless encryption method

4. Utilizing MAC address filtering

The correct answer is: Turning on suspected privileges on the router

Avoiding the act of turning on suspected privileges on the router during the containment of wireless security incidents is critical. When an incident responder increases privileges or makes configuration changes without a clear understanding of the incident or its implications, it can lead to further vulnerabilities or damage. This action may inadvertently provide attackers with more opportunities to exploit the system or may compromise the integrity of the ongoing investigation. In addition, altering the router settings during an incident could inadvertently disrupt legitimate users or services, which can escalate user frustration and organizational impact. It's paramount for incident responders to maintain a controlled and cautious approach when responding to security incidents, ensuring that actions taken do not exacerbate the situation or hinder recovery efforts. Other practices, such as creating guest network access, changing the wireless encryption method, or utilizing MAC address filtering, could be appropriate depending on the context and severity of the incident; these actions aim to mitigate risk and secure the environment while assessing the impact of the incident.