1.11 Compare Rule-Based Detection vs. Behavioral and Statistical Detection 200-201 Practice Questions (Page 8)

Questions 36–36

1. 36application · medium

   A network administrator wants to detect distributed denial-of-service (DDoS) attacks by monitoring traffic volume. The administrator has no prior knowledge of the attack patterns and wants to identify when traffic exceeds a statistically significant threshold. Which detection method is most appropriate?

   • AStatistical detection that calculates the mean and standard deviation of traffic volume and alerts on outliers.
   • BBehavioral detection that learns normal traffic patterns and flags deviations.
   • CRule-based detection using a signature for known DDoS tools.
   • DA combination of rule-based and behavioral detection using known attack signatures and user baselines.
   Reveal Solution Discussion Select an answer first