Certified Incident Handler (CIH) Practice Ecam

Which tool is used to detect DoS/DDoS incidents in a network?

1. Wireshark

2. KFSensor

3. Nmap

4. Firewall Analyzer

The correct answer is: KFSensor

The choice of KFSensor as the appropriate tool for detecting DoS (Denial of Service) and DDoS (Distributed Denial of Service) incidents is based on its functionality. KFSensor is a type of honeypot that can be employed to monitor and analyze network traffic. It is specifically designed to simulate vulnerabilities and detect various types of attacks, including DoS/DDoS attempts. Honeypots like KFSensor actively engage with malicious traffic and can provide insights about the nature of the attack, the tactics used by attackers, and the sources of the attack. This allows for more effective monitoring and response to such incidents compared to other tools. In contrast, while network analysis tools such as Wireshark can capture and analyze packets on a network, they may not specifically focus on detecting DoS/DDoS attacks in real-time. Similarly, Nmap is primarily used for network scanning and vulnerability assessment rather than direct detection of denial of service attacks. Firewall Analyzer, although useful for monitoring firewall logs and policies, does not have the specialized capability to detect DoS/DDoS incidents as effectively as a dedicated honeypot solution.