Baseline Traffic Analysis and Signature Identification NDE Practice Questions (Page 8)

Questions 36–37

1. 36expert · hard

   An organization has a mix of known and unknown applications. The security team wants to detect both known malware signatures and new, previously unseen anomalies. Which combination of signature types should they implement?

   • AOnly behavioral signatures for anomaly detection.
   • BBoth static signatures for known threats and behavioral signatures for anomalies.
   • COnly static signatures for known malware.
   • DNeither; rely on manual traffic analysis.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A network admin has a baseline showing average bandwidth usage of 100 Mbps during business hours. Today, the network is experiencing 300 Mbps sustained bandwidth usage. The admin checks the baseline and sees that the increase is isolated to a single department that recently deployed a new video-training platform. What should the admin do?

   • AIgnore the deviation because the baseline is no longer accurate.
   • BInvestigate the traffic to confirm the cause, then update the baseline to reflect the new normal.
   • CCreate a new baseline from today's traffic to replace the old one immediately.
   • DImmediately block the department's traffic to prevent a potential attack.
   Reveal Solution Discussion Select an answer first