How do baselines and signatures work together in anomaly detection?

Baselines replace the need for signatures entirely

Baselines are only used for historical reporting, not for detection

Signatures are used to create baselines, and baselines are used to encrypt traffic

Baselines define normal behavior, and signatures identify known patterns; both help detect anomalies

When comparing real-time traffic to a baseline, what would be considered a significant deviation?

A sudden spike in bandwidth usage that is far above the baseline average

A change in the time of day when traffic is captured

A change in the source MAC address of a single packet

A small fluctuation within the normal range of the baseline

Which step is essential when creating a baseline of network traffic?

Disable all security controls to get raw data

Use only packet captures from a single device

Capture traffic during a period that represents normal operations

Capture traffic only during peak load times

What is the primary purpose of applying signatures in network monitoring?

To encrypt all outgoing traffic

To replace the need for firewalls

To detect known threats and deviations from normal behavior

To increase network speed by compressing packets

An analyst is examining a pcap file and notices a series of packets that all have the same TTL value, same window size, and same TCP options. This pattern is not seen in the baseline. What does this indicate?

The packets are encrypted and cannot be analyzed.

The packets are normal because they share common TCP characteristics.

The packets are definitely part of a denial-of-service attack.

The packets may be generated by the same tool or operating system, creating a unique fingerprint.

EC-CouncilNetwork Defense Essentials

Domain 7Objective 2

Baseline Traffic Analysis and Signature Identification NDE Practice Questions (Page 7)

Part of the Network Traffic Monitoring domain, which makes up ~11% of our current practice bank.

37questions here

8free pages

8concepts

Questions 31–35

31foundation · easy
How do baselines and signatures work together in anomaly detection?
Select an answer first
32foundation · easy
When comparing real-time traffic to a baseline, what would be considered a significant deviation?
Select an answer first
33foundation · easy
Which step is essential when creating a baseline of network traffic?
Select an answer first
34foundation · easy
What is the primary purpose of applying signatures in network monitoring?
Select an answer first
35application · medium
An analyst is examining a pcap file and notices a series of packets that all have the same TTL value, same window size, and same TCP options. This pattern is not seen in the baseline. What does this indicate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “NDE” is a trademark of its owner, used for identification only.