Certified Incident Handler (CIH) Practice Ecam

Which stage of the incident response and handling process involves auditing system and network log files?

1. Detection

2. Identification

3. Containment

4. Recovery

The correct answer is: Identification

The correct choice is identification because this stage focuses on understanding the nature of the incident and gathering relevant information to assess its impact. Auditing system and network log files is a crucial part of this process, as it allows incident handlers to determine how the incident occurred, what systems were affected, and whether there are any indicators of compromise. By analyzing logs, the incident response team can identify unusual activities, trace the origins of the incident, and gather forensic evidence, which is essential for making informed decisions on how to handle the situation effectively. Other stages, such as detection, containment, and recovery, while important, do not primarily emphasize the detailed analysis of logs. Detection often involves initial alerts or triggers that indicate a potential incident but doesn't go into depth about analyzing the specifics of what happened. Containment aims to limit the impact of an incident and prevent further damage, and recovery focuses on restoring systems and services to normal operations. Therefore, the identification phase is where log auditing plays its most critical role in understanding and defining the incident.