Which term describes a sign that occurs before an incident, such as port scanning?

Which term describes a sign that occurs before an incident, such as port scanning?

• A. Indication
• B. Precursor
• C. After-action report
• D. Indicator

Answer: (B)

Port scanning is a preparatory activity that often signals an attack is likely coming. A precursor is an early sign or warning that something is about to happen, so it fits as the term describing a sign before an incident. In security, indicators or indications typically point to events already in progress or completed, such as indicators of compromise after an intrusion. An after-action report, by contrast, is produced after an incident to review what happened. So the best fit for a sign that occurs before an incident is precursor.

Port scanning is a preparatory activity that often signals an attack is likely coming. A precursor is an early sign or warning that something is about to happen, so it fits as the term describing a sign before an incident. In security, indicators or indications typically point to events already in progress or completed, such as indicators of compromise after an intrusion. An after-action report, by contrast, is produced after an incident to review what happened. So the best fit for a sign that occurs before an incident is precursor.