Certified Incident Handler (CIH) Practice Ecam

Which tool helps incident responders monitor and analyze user-based insider threats?

1. Wireshark

2. Ekran System

3. Infoblox

4. Vectra Cognito

The correct answer is: Ekran System

The Ekran System is designed specifically for monitoring and analyzing user activity, making it particularly effective in identifying potential insider threats. This tool focuses on user behavior and allows incident responders to track various activities within systems and applications. It offers features such as session recording, access control, and real-time alerts, all of which are crucial for detecting unusual patterns that may signify malicious intent from within the organization. By leveraging this capability, organizations can gain insights into user actions, investigate suspicious activities promptly, and take necessary responses to mitigate potential threats. In contrast, other tools like Wireshark are primarily used for network traffic analysis, while Infoblox is known for DNS management and security, and Vectra Cognito focuses on network-based threats and anomalies rather than specifically addressing user behavior. Thus, the Ekran System is uniquely positioned to address the challenges associated with insider threats effectively.