Certified Incident Handler (CIH) Practice Ecam

Which technique will not assist in detecting DoS/DDoS incidents?

1. Monitoring router's CPU utilization

2. Checking ARP processes

3. Using outdated software

4. Analyzing traffic logs for spikes

The correct answer is: Using outdated software

The technique that will not assist in detecting DoS (Denial of Service) or DDoS (Distributed Denial of Service) incidents is the use of outdated software. Utilizing outdated software does not provide any significant value in the detection of these types of attacks. In fact, outdated software can introduce vulnerabilities that attackers may exploit, leading to an increase in the likelihood of a successful attack rather than detection. Conversely, the other techniques mentioned are proactive measures in identifying potential DoS/DDoS incidents. Monitoring the router's CPU utilization helps detect unusual spikes in demand, which could signify an ongoing attack. Checking ARP processes can reveal abnormal activity or flooding attempts, typically a tactic used in some types of network-based attacks. Analyzing traffic logs for spikes enables a network administrator to identify traffic patterns that deviate from the norm, often a hallmark of DDoS activities. Therefore, using outdated software does not contribute to detection and may hinder response efforts instead.