Certified Incident Handler (CIH) Practice Ecam

Which tool assists incident handlers in performing network analysis?

1. Vectra Cognito

2. Ekran System

3. Wireshark

4. Nuix Adaptive Security

The correct answer is: Wireshark

Wireshark is a widely used network protocol analyzer that plays a crucial role in incident handling and network analysis. It allows incident handlers to capture and interactively browse the traffic running on a computer network in real-time. With its capability to dissect thousands of protocols and provide detailed insights into network packets, Wireshark helps investigators identify anomalous behavior, troubleshoot network issues, and analyze packet flows associated with potential security incidents. The tool enables incident handlers to visualize and interpret raw data, making it easier to detect and analyze security threats. By providing features such as filtering, searching, and creating graphical representations of data, Wireshark enhances the ability to understand complex network interactions. This makes it invaluable during an incident response process, where quick and accurate analysis of network behavior can reveal the source and scope of an incident. While the other options like Vectra Cognito, Ekran System, and Nuix Adaptive Security are all relevant to security and incident management in different ways—focusing more on aspects like user behavior analytics, privilege access monitoring, or broader adaptive security frameworks—none offer the in-depth network traffic analysis capability that Wireshark does, making it the most suitable tool for the task of network analysis during incident handling.