1.11 Compare Rule-Based Detection vs. Behavioral and Statistical Detection 200-201 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security team is implementing a user and entity behavior analytics (UEBA) system. The system will monitor user activity to detect insider threats. Which type of detection is the UEBA system primarily using?

   • ARule-based detection using predefined user access rules.
   • BA combination of rule-based and statistical detection using fixed rules and thresholds.
   • CStatistical detection using global thresholds for all users.
   • DBehavioral detection by establishing baselines of normal user activity and flagging deviations.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst is monitoring a database server and wants to detect a SQL injection attack. The analyst has a list of known SQL injection patterns. Which detection method is most effective for this specific threat?

   • ABehavioral detection that flags any unusual database queries.
   • BA combination of behavioral and statistical detection to catch both known and unknown threats.
   • CStatistical detection that monitors the number of queries per second.
   • DRule-based detection using signatures for known SQL injection patterns.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security team wants to detect a distributed denial-of-service (DDoS) attack that involves a sudden spike in traffic from many sources. The attack pattern is not yet in any signature database. Which detection method is most appropriate for this scenario?

   • AManual monitoring by an analyst
   • BRule-based detection, because it can match the source IPs
   • CBehavioral detection, because it can track individual user behavior
   • DStatistical detection, because it can identify a significant deviation from normal traffic volume
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst is monitoring a web server and wants to detect a brute-force attack on the login page. The analyst has no prior knowledge of the attacker's IP addresses. Which detection method is most effective for identifying this type of attack?

   • AA combination of rule-based and statistical detection using known attack signatures and traffic volume thresholds.
   • BRule-based detection using a signature for known brute-force tools.
   • CBehavioral detection that flags multiple failed login attempts from a single IP address.
   • DStatistical detection that monitors the total number of login attempts per hour.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is configuring an intrusion detection system for a network that has a well-known set of attack signatures. The analyst wants to ensure that the system detects these known attacks with minimal delay. Which detection method is best suited for this requirement?

   • AManual review of all traffic
   • BRule-based detection, because it matches traffic against predefined signatures
   • CStatistical detection, because it models traffic patterns
   • DBehavioral detection, because it learns normal behavior over time
   Reveal Solution Discussion Select an answer first