1.11 Compare Rule-Based Detection vs. Behavioral and Statistical Detection 200-201 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security analyst at a financial firm notices that the existing intrusion detection system generates a high volume of alerts for a known exploit, but the team is overwhelmed and misses a new variant of the exploit that uses a slightly different payload. The analyst wants to improve detection of both the known and new variants without significantly increasing false positives. Which approach should the analyst implement?

   • ACombine rule-based detection for known signatures with behavioral detection to catch anomalies and new variants.
   • BImplement a statistical model that flags traffic based on the frequency of similar payloads.
   • CAdd a signature for the new variant and tune the existing signature to reduce noise.
   • DDeploy a behavioral detection system that baselines normal network traffic and alerts on deviations.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An analyst notices that a user account that normally logs in from 9 AM to 5 PM has suddenly started logging in at 2 AM and downloading large amounts of data. The activity does not match any known attack signature. Which detection method is most likely to flag this activity?

   • AStatistical detection, because it calculates the average login time and flags any deviation
   • BBehavioral detection, because it compares current activity to an established baseline
   • CRule-based detection, because it uses predefined patterns for login times
   • DNone of these methods would flag this activity
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security team is evaluating detection methods for a network that experiences frequent false positives from rule-based detection due to legitimate traffic that resembles attack patterns. They also need to detect a new insider threat that involves a user slowly exfiltrating data over several weeks. The team has limited resources for tuning detection systems. Which approach best balances the need to reduce false positives and detect the slow exfiltration?

   • AUse statistical detection with a threshold set to the mean plus two standard deviations
   • BUse behavioral detection with a baseline that includes gradual changes in data transfer volume
   • CDisable rule-based detection and rely solely on manual review
   • DUse rule-based detection with a rule that flags any data transfer above a fixed threshold
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security team is designing a detection strategy for a large enterprise with a mix of known and unknown threats. The team has limited resources and cannot afford to investigate every alert. They need to prioritize alerts that are most likely to indicate a real attack. Which strategy best balances detection coverage and alert volume?

   • AUse only rule-based detection to minimize false positives and focus on known threats.
   • BUse only behavioral detection to catch all anomalies, regardless of alert volume.
   • CUse only statistical detection to identify outliers, as it is the most accurate method.
   • DImplement a layered approach: rule-based detection for known threats, behavioral detection for anomalies, and statistical detection for volume-based outliers.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   A security system uses a mathematical model to compute the probability of a network event and alerts when the probability falls below a certain threshold. Which detection method is being used?

   • ASignature-based detection
   • BStatistical detection
   • CBehavioral detection
   • DRule-based detection
   Reveal Solution Discussion Select an answer first