1.11 Compare Rule-Based Detection vs. Behavioral and Statistical Detection 200-201 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   A security analyst needs to detect insider threats where an employee accesses files at unusual times and downloads large amounts of data. Which detection method is best suited for this scenario?

   • ABehavioral detection
   • BRule-based detection
   • CSignature-based detection
   • DStatistical detection
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security team is investigating a series of alerts from a behavioral detection system. The system has flagged a user who is accessing files from a new location and at unusual times. The user is a remote worker who frequently travels. Which factor is most important in determining whether these alerts are true positives?

   • AThe user's travel schedule and whether the access patterns align with their known travel destinations.
   • BThe severity rating assigned by the behavioral detection system.
   • CThe user's role and whether they have a history of accessing sensitive files.
   • DThe number of alerts generated by the system in the past week.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary advantage of behavioral detection over rule-based detection?

   • AIt is simpler to configure and maintain
   • BIt requires no initial baseline or training period
   • CIt produces fewer false positives than rule-based detection
   • DIt can detect previously unknown threats that deviate from normal behavior
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security analyst is reviewing alerts from a network-based intrusion detection system (NIDS). The NIDS uses a signature database that is updated weekly. The analyst notices that the NIDS is not detecting a new malware variant that was released yesterday. Which limitation of rule-based detection does this scenario illustrate?

   • ARule-based detection requires a baseline of normal traffic to function.
   • BRule-based detection cannot detect unknown threats until a signature is created and deployed.
   • CRule-based detection is only effective for detecting insider threats.
   • DRule-based detection generates too many false positives.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which characteristic is a primary limitation of rule-based (signature-based) detection?

   • AIt requires large amounts of historical data to train a model
   • BIt requires a baseline of normal behavior to be established first
   • CIt generates a high number of false positives due to normal behavior variations
   • DIt cannot detect previously unseen or zero-day attacks
   Reveal Solution Discussion Select an answer first