200-201 Question 33
Single answerYou are a cybersecurity analyst monitoring network traffic using a security information and event management (SIEM) system. The SIEM employs sliding window anomaly detection to identify unusual patterns in data. Recently, you received an alert indicating a potential anomaly in the number of failed login attempts. Which scenario best explains how sliding window anomaly detection triggered this alert?
- A
The number of failed login attempts exceeded a pre-defined static threshold within a specific time period.
- B
The number of failed login attempts in the most recent time window was significantly higher than the average for previous, overlapping time windows.
- C
The number of failed login attempts matched a known signature for brute-force attacks.
- D
The system detected an anomaly because an unauthorized user attempted to log in using administrator credentials.
Show answer and explanation
Correct answer: B
Explanation
Sliding window anomaly detection works by analyzing data in overlapping time windows to identify deviations from normal patterns. In this case, the anomaly detection mechanism likely flagged the alert because the number of failed login attempts in the current window was significantly different from the historical average of prior windows.
- A. Incorrect.
This describes a static threshold approach, not sliding window anomaly detection. Sliding window anomaly detection compares patterns over overlapping time windows rather than relying on fixed thresholds.
- B. Correct.
This correctly describes how sliding window anomaly detection works. It compares recent activity to patterns observed in overlapping windows to identify significant deviations.
- C. Incorrect.
Signature-based detection identifies threats using predefined patterns, whereas sliding window anomaly detection focuses on deviations from normal behavior without relying on signatures.
- D. Incorrect.
While this describes an unauthorized access attempt, it does not explain how sliding window anomaly detection identifies anomalies. This scenario is unrelated to the method described.