1.11 Compare Rule-Based Detection vs. Behavioral and Statistical Detection 200-201 Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which detection method is most appropriate for an organization that needs to detect known malware variants with minimal false positives and has a well-maintained signature database?

   • AStatistical detection
   • BHeuristic detection
   • CBehavioral detection
   • DRule-based detection
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is a key requirement for statistical detection to work effectively?

   • AA sandbox environment to execute suspicious files
   • BA list of user-defined rules for each threat
   • CA database of known attack signatures
   • DA baseline or historical data to establish normal patterns
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A security team is deploying a detection system for a network that has a high rate of false positives from rule-based detection. The false positives are caused by legitimate traffic that matches known attack signatures. The team wants to reduce false positives without missing actual attacks. They have the ability to modify rules. Which approach is most effective?

   • AIncrease the sensitivity of the rules
   • BSwitch to behavioral detection entirely
   • CDisable the rules that generate false positives
   • DRefine the rules to include additional context, such as source IP, destination port, and time of day
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A security team is evaluating detection tools for a cloud-based environment that scales dynamically. The environment experiences frequent changes in traffic patterns due to auto-scaling and new service deployments. The team wants to detect both known and unknown threats while minimizing false positives. Which approach is most suitable?

   • ARule-based detection with a regularly updated signature database.
   • BBehavioral detection with baselines that are automatically updated based on the current environment state.
   • CStatistical detection with a fixed threshold for all traffic.
   • DA combination of rule-based and statistical detection using static baselines.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A security analyst is investigating a potential insider threat. A user has been accessing sensitive files at unusual times, but the activity is not clearly malicious. The analyst wants to reduce false positives while still detecting the insider threat. The user's behavior has been gradually changing over the past month. Which detection approach is most appropriate?

   • ARule-based detection that flags any access outside business hours
   • BStatistical detection with a fixed threshold for all users
   • CDisable all detection and rely on user reports
   • DBehavioral detection with a baseline that is updated regularly to reflect gradual changes
   Reveal Solution Discussion Select an answer first