1.3 Describe Security Terms 200-201 Practice Questions (Page 11)

Questions 51–51

1. 51expert · hard

   A network security team is monitoring a server that is experiencing intermittent performance issues. The team suspects that a low-and-slow data exfiltration attack is occurring. The server's normal outbound traffic is 10 MB per hour with a standard deviation of 2 MB. The team uses a sliding window anomaly detection algorithm with a window size of 24 hours and alerts when the average in the window exceeds 12 MB per hour. The attack causes a steady increase of 0.5 MB per hour over several days. The team wants to detect the attack as early as possible while minimizing false positives. Which approach is the most effective?

   • AAlert on any hour where the traffic exceeds 12 MB.
   • BUse a sliding window with a trend analysis component that detects gradual increases over time.
   • CReduce the sliding window size to 1 hour.
   • DIncrease the alert threshold to 15 MB per hour.
   Reveal Solution Discussion Select an answer first