Maria, a network security analyst working in a multinational corporation, is monitoring real-time logs from...

According to the EC-Council Incident Handler (ECIH) curriculum, an unauthorized access incident occurs when an attacker gains access to a system without proper authorization, often through credential compromise, brute-force attacks, or exploitation of weak authentication controls.

The scenario describes repeated failed login attempts followed by successful access and subsequent data exfiltration. This sequence—brute-force attempts leading to compromise and data transmission—clearly indicates unauthorized system access. The large outbound traffic spike to an unfamiliar IP further confirms potential data exfiltration following successful authentication bypass.

Option A is unrelated to wireless-specific attacks. Option C refers to policy misuse by authorized users. Option D (denial-of-service) focuses on service disruption rather than data theft or credential compromise.

ECIH recommends immediate isolation of affected systems, log preservation, credential resets, forensic analysis, and review of access controls following unauthorized access incidents. Maria’s actions align with these best practices.

Therefore, this incident is classified as an unauthorized access incident.