Analyze the screenshot below. Based on the information, how will you classify this?

The correct answer is B. An event. The system could have a misconfiguration. Until corroborating evidence, is presented, or the event is capable of producing harm, anomalous behavior is classified as an event.

Incident Response & Cyber Kill Chain

Question

Exhibit

Options

AAn incident. The IP address is being spoofed by another host.
BAn event. The system could have a misconfiguration.
CAn incident. This traffic is always malicious.
DAn event. This traffic is always normal.

How the community answered

(40 responses)

A
13% (5)
B
80% (32)
C
3% (1)
D
5% (2)

Explanation

Until corroborating evidence, is presented, or the event is capable of producing harm, anomalous behavior is classified as an event.

Topics

#event vs incident classification#traffic analysis#misconfiguration#incident triage

Community Discussion

No community discussion yet for this question.

Full GCIH Practice