1.11 Compare Rule-Based Detection vs. Behavioral and Statistical Detection 200-201 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security analyst is reviewing alerts from a rule-based IDS. The IDS has a signature for a known exploit, but the analyst notices that the signature is triggering on legitimate traffic that contains a similar pattern. The analyst wants to reduce false positives without losing detection capability. Which action is most appropriate?

   • ASwitch to a behavioral detection system to avoid signature-based false positives.
   • BIncrease the alert threshold for all signatures to reduce the number of alerts.
   • CDisable the signature to eliminate false positives.
   • DModify the signature to require additional context, such as specific ports or payload characteristics.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security operations center (SOC) is evaluating a new detection tool. The tool uses a baseline of normal network traffic and raises an alert when traffic deviates from that baseline. However, the SOC has a low tolerance for false positives because the team is small. The network is highly dynamic, with frequent legitimate changes in traffic patterns. Which consideration is most important when deciding whether to deploy this tool?

   • AThe tool will likely generate many false positives due to the dynamic environment, requiring constant tuning of the baseline.
   • BThe tool will replace the need for rule-based detection, simplifying the SOC's workflow.
   • CThe tool will require no maintenance once the baseline is established, making it cost-effective.
   • DThe tool will detect all known attacks with high accuracy, reducing the workload for analysts.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A small company has a limited security budget and a low tolerance for false positives. They want to detect known malware and also spot unusual network traffic patterns that might indicate a new attack. Which approach best fits their constraints?

   • ADeploy only behavioral detection for all traffic
   • BDeploy statistical detection only, with no rule-based detection
   • CDeploy only rule-based detection with a large signature database
   • DDeploy rule-based detection for known malware and statistical detection for network traffic anomalies
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security team is choosing a detection method for a new environment that will experience significant changes in traffic patterns due to seasonal business cycles. The team wants to minimize false positives while still detecting unknown threats. Which approach is most appropriate?

   • AStatistical detection with a fixed threshold for all traffic.
   • BRule-based detection with a comprehensive signature database.
   • CBehavioral detection with a baseline that is updated regularly to reflect seasonal changes.
   • DA combination of rule-based and statistical detection using a static baseline.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst is reviewing alerts from an intrusion detection system. The system generates a high number of false positives because a legitimate application sends traffic that matches a known attack pattern. Which approach would best reduce false positives while still detecting the attack?

   • AIncrease the sensitivity of the rule
   • BSwitch to behavioral detection only
   • CRefine the rule to include additional context, such as source IP or time of day
   • DDisable the rule entirely
   Reveal Solution Discussion Select an answer first