Certified Incident Handler (CIH) Practice Ecam

Which technique aids incident responders in detecting DoS/DDoS incidents by analyzing network traffic?

1. Packet inspection

2. Wavelet-based signal analysis

3. Firewall log review

4. Data encryption methods

The correct answer is: Wavelet-based signal analysis

The technique that aids incident responders in detecting DoS/DDoS incidents by analyzing network traffic is wavelet-based signal analysis. This method is particularly effective because it can identify patterns and anomalies in network traffic, which are characteristic of denial-of-service attacks. Wavelet transform is useful for processing signals and recognizing behaviors in time-frequency space, allowing responders to detect sudden surges in traffic that may indicate a DoS or DDoS attack. This approach provides a more granular analysis than traditional methods by enabling the identification of transient events otherwise hard to detect in standard network traffic analysis. Other techniques, like packet inspection, while beneficial for examining individual packets and their contents for malicious payloads, may not provide the level of analysis required to detect the broader patterns indicative of a DDoS event. Firewall log review could alert on excessive connections or unusual traffic patterns but lacks the depth of analysis seen in wavelet-based techniques. Data encryption methods focus on securing information rather than enhancing the detection of network attacks, making them less relevant in this context.