200-201 Question 90
Single answerA security analyst is monitoring network traffic in a Security Operations Center (SOC). The analyst notices a rule-based Intrusion Detection System (IDS) flagged an alert for a known signature of a malware attack. However, the analyst also wants to detect previously unknown threats that may not match any known signatures. Which detection method should the analyst use in addition to the rule-based detection?
- A
Behavioral and statistical detection
- B
Firewall-based detection
- C
Signature-based detection
- D
Blacklist-based detection
Show answer and explanation
Correct answer: A
Explanation
Behavioral and statistical detection complements rule-based detection by identifying deviations from normal behavior, making it effective in detecting unknown threats or anomalies that do not match predefined signatures or rules. This approach is essential for addressing zero-day attacks and advanced persistent threats.
- A. Correct.
Behavioral and statistical detection analyzes patterns, trends, and deviations from baseline behavior, which helps identify unknown threats or zero-day attacks that lack known signatures.
- B. Incorrect.
Firewall-based detection is focused on network traffic filtering and access control rather than detecting anomalies or unknown threats.
- C. Incorrect.
Signature-based detection is the same as rule-based detection and relies on predefined rules or patterns, which limits its ability to detect unknown threats.
- D. Incorrect.
Blacklist-based detection relies on known malicious entities, such as IP addresses or domains, and does not address the need to identify new, previously unknown threats.