200-201 Question 2
Single answerA cybersecurity analyst at a Security Operations Center (SOC) is investigating a potential security incident involving unusual outbound traffic from a corporate server. Which security concept would best help the analyst determine if the server's behavior is legitimate or malicious?
- A
Least Privilege
- B
Defense in Depth
- C
Baseline Behavior
- D
Zero Trust
Show answer and explanation
Correct answer: C
Explanation
In this scenario, the cybersecurity analyst is investigating unusual outbound traffic and needs to determine if it is legitimate or malicious. Establishing a baseline of normal behavior for the server allows the analyst to identify deviations that could signal unauthorized or malicious activity. This makes 'Baseline Behavior' the most relevant security concept for addressing the situation.
- A. Incorrect.
Least Privilege is a principle that ensures users or systems only have the minimum access necessary to perform their tasks, but it does not directly help in identifying unusual behavior.
- B. Incorrect.
Defense in Depth is a strategy that layers multiple security measures to protect systems, but it does not focus on identifying or analyzing unusual behavior.
- C. Correct.
Baseline Behavior refers to establishing a normal pattern of system or network activity, which can then be used to detect deviations that may indicate malicious activity. This concept directly applies to the scenario.
- D. Incorrect.
Zero Trust is a security model that assumes no implicit trust and requires verification for every access request, but it does not specifically address analyzing or detecting unusual behavior.