In Federal Agency Incident Reporting Categories, which category corresponds to Scans/Probes/Attempted Access?

• A. CAT 5
• B. CAT 1
• C. CAT 2
• D. CAT 6

Answer: (A)

In this framework, categories reflect the level of activity and potential impact. Scans, probes, and attempted access are signals of reconnaissance or unsuccessful intrusion attempts. They show someone is probing a system but there’s no confirmed breach or harm yet. That combination—noticeable activity without an actual compromise—puts it in CAT 5, which is used for these early, limited-risk indicators that warrant monitoring and prompt defensive actions.

The other categories are reserved for different situations, such as confirmed unauthorized access, data exfiltration, or major service disruption. Those require classifications that reflect the higher actual impact or different incident types.