1.11 Compare Rule-Based Detection vs. Behavioral and Statistical Detection 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A small business has a legacy intrusion detection system that relies on signatures. The business cannot afford a full-time security analyst to tune the system. Which scenario is this system most likely to handle effectively?

   • ADetecting a known malware variant that matches an existing signature.
   • BFlagging statistical outliers in network traffic volume.
   • CIdentifying anomalous user behavior that deviates from a baseline.
   • DDetecting a zero-day exploit that has never been seen before.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security operations team is evaluating a behavioral detection tool that uses machine learning to establish baselines for user activity. The tool has been in production for a month and is generating a high number of false positives. The team suspects the baselines are not accurate. Which action is most likely to improve the tool's accuracy?

   • ASwitch to a rule-based detection system to eliminate false positives.
   • BDisable the tool's alerting and rely on manual analysis of logs.
   • CAllow the tool to collect more data over a longer period before establishing baselines.
   • DIncrease the sensitivity of the tool to reduce false positives.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst is configuring a network intrusion detection system (IDS) for a small office. The office has a static network environment with few changes. The analyst wants to detect known malware signatures with minimal false positives. Which detection approach is most suitable?

   • AStatistical detection that monitors traffic volume and flags outliers.
   • BRule-based detection using a well-maintained signature database.
   • CA combination of behavioral and statistical detection to catch both known and unknown threats.
   • DBehavioral detection that learns the network's normal traffic patterns.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A security analyst is configuring an intrusion detection system to alert on a known malware pattern. Which detection method relies on predefined signatures or patterns to identify known threats?

   • AStatistical detection
   • BHeuristic detection
   • CBehavioral detection
   • DRule-based detection
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A university's security team wants to detect potential data exfiltration by students who download large amounts of research data. The team has no prior knowledge of specific attack signatures. They need a solution that can identify unusual download patterns without manually defining thresholds for each user. Which detection approach best meets this requirement?

   • AStatistical detection that applies a global threshold for all users based on average download size.
   • BRule-based detection using a signature for known data exfiltration tools.
   • CA combination of rule-based and statistical detection using a fixed threshold for all users.
   • DBehavioral detection that learns each user's normal download volume and flags significant deviations.
   Reveal Solution Discussion Select an answer first