Certified Incident Handler (CIH) Practice Ecam

Which tool did Robert use to detect suspicious activities in a healthcare organization's network?

1. Infoblox

2. Wireshark

3. Ekran System

4. DataRobot

The correct answer is: Wireshark

Wireshark is an open-source network protocol analyzer that is widely used for network troubleshooting, analysis, development, and education. It allows users to capture and interactively browse the traffic running on a computer network. In the context of detecting suspicious activities in a healthcare organization's network, Wireshark would be particularly useful due to its ability to decode various network protocols and display packet data in real time. By analyzing the captured data, an incident handler can identify unusual patterns, such as unexpected communication between devices, signs of potential data breaches, or unauthorized access attempts. This level of detail is crucial in a sensitive environment like healthcare, where patient data protection is paramount. While other tools listed may have their own purposes—like Infoblox for DNS management, Ekran System for user activity monitoring, and DataRobot for machine learning applications—Wireshark's specific capabilities in network traffic analysis make it the most suitable choice for detecting suspicious activities in this scenario.