200-201 Question 139
Single answerA cybersecurity analyst is monitoring network traffic and notices an unusual spike in outbound traffic from an internal server during non-business hours. The analyst wants to determine whether this behavior is statistically significant compared to normal traffic patterns. Which statistical data analysis method would be most appropriate to identify whether this anomaly requires further investigation?
- A
Calculate the mean and standard deviation of outbound traffic and compare the spike to the expected range.
- B
Use encryption to secure the outbound traffic and ignore the spike.
- C
Manually review all packets from the server to identify the root cause.
- D
Implement a firewall rule to block all traffic from the server during non-business hours.
Show answer and explanation
Correct answer: A
Explanation
To identify whether an observed anomaly is statistically significant, analyzing the mean and standard deviation of the data is a fundamental approach. This method allows the analyst to compare the observed traffic spike to normal traffic patterns and determine if it falls outside the expected range, warranting further investigation. Other options either do not use statistical data analysis or are impractical for the scenario.
- A. Correct.
Calculating the mean and standard deviation helps establish a baseline for normal behavior. Comparing the spike to the expected range (e.g., using thresholds like 3 standard deviations) can help determine if the spike is statistically significant.
- B. Incorrect.
Securing traffic with encryption does not address the issue of identifying abnormal behavior. This option is not relevant to statistical analysis.
- C. Incorrect.
Manually reviewing all packets is not practical or efficient for identifying statistical anomalies. It also does not leverage statistical data analysis.
- D. Incorrect.
Blocking all traffic during non-business hours might prevent the anomaly but does not help determine whether the behavior is statistically significant or understand the root cause.