2.5 Explain the Limitations of Signature-Based Network Protection CYBERSECURITY-PRACTITIONER Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company's security team is evaluating a new signature-based IPS. During a proof-of-concept, they notice that the IPS is generating a high number of alerts for a legitimate internal application that uses a custom protocol. The alerts are all false positives. The team is concerned about alert fatigue and the operational burden on their analysts. Which operational limitation of signature-based detection is most directly demonstrated by this scenario?

   • AInability to detect unknown threats
   • BSignature update latency
   • CPerformance overhead
   • DFalse positives
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security operations center (SOC) manager is reviewing the alerts generated by the company's signature-based IPS. The manager notices that the IPS is generating thousands of alerts per day, and the SOC team is struggling to keep up. The manager wants to reduce the noise while ensuring real threats are still detected. Which approach would be most effective?

   • AAdd more signatures to the IPS to catch more threats.
   • BIncrease the severity threshold for alerts so only critical alerts are generated.
   • CDisable the IPS and rely on manual log review.
   • DTune the IPS signatures to suppress false positives and prioritize alerts based on risk.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary goal of obfuscation as an evasion technique?

   • ATo split the payload into smaller packets
   • BTo increase the speed of the attack
   • CTo encrypt the entire network connection
   • DTo hide the malicious payload by altering its appearance
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A network engineer is deploying a new signature-based IPS in line with the network. After deployment, they notice that the latency for large file transfers has increased significantly. The IPS is a single appliance and is handling the full traffic load. Which operational limitation of signature-based detection is most directly causing this issue?

   • AFalse positives
   • BSignature update latency
   • CInability to detect unknown threats
   • DPerformance overhead
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which approach complements signature-based detection by focusing on the actions of a process or user?

   • ABehavioral analysis
   • BPort blocking
   • CSignature database updates
   • DPacket filtering
   Reveal Solution Discussion Select an answer first