Chapter 6 of 8 · EC-Council 312-38
Incident Detection
Network monitoring, baselines, Wireshark, anomaly detection and log analysis, worth 10 percent.
- 4topics
- 20 minfast track
- 1diagrams and exhibits
- 10%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Network Traffic Monitoring and BaselinesLearn why network traffic monitoring matters, how SPAN ports and TAPs feed sensors, and how to baseline normal and suspicious…5 min
- 2Wireshark, Performance Monitoring and Anomaly DetectionLearn Wireshark filters for spotting suspicious traffic, bandwidth and performance metrics, and behavior based anomaly detection…5 min
- 3Logging Concepts and Windows, Linux and Mac LogsLearn logging concepts, syslog severity levels, key Windows event IDs, Linux log files and macOS unified logging for incident…5 min
- 4Firewall, Router, Web Server and Centralized Log MonitoringLearn to read firewall, router and web server logs for attack signs, and how a SIEM collects, correlates and alerts across…Diagram5 min
About this chapter
What this chapter covers
Incident Detection is 10% of the EC-Council CND 312-38 exam. It covers monitoring network traffic, building baselines, analyzing packets with Wireshark, measuring performance, detecting anomalies, and reading logs from operating systems, firewalls, routers and web servers.
Questions are single-answer multiple choice, often "Which of the following" and short named scenarios. You are asked to choose the right monitoring method or to recognize what a log entry means.
It has 14 outline topics, and four pages cover them.
How the topics fit together
Detection depends on seeing traffic and events, knowing what is normal, and bringing the evidence together.
- Traffic pages cover the sensor, the baseline and the analysis tools.
- Log pages cover what each platform records and the entries that signal an attack.
Most detection questions test a pattern: many failed logons then a success, many denies across ports, or many 404 responses. Learn the pattern and what it means.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorize.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Try to read each short scenario and name the attack before reading the answer. The exam often shows a symptom and asks for the cause.
Ready for more practice?
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.