2.5 Explain the Limitations of Signature-Based Network Protection CYBERSECURITY-PRACTITIONER Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   How does signature-based network protection primarily identify a threat?

   • ABy matching network traffic against a database of known threat patterns
   • BBy using machine learning to classify traffic as malicious or benign
   • CBy sandboxing suspicious files and observing their behavior in a controlled environment
   • DBy analyzing the behavior of network traffic over time to detect anomalies
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security manager is planning the budget for the next fiscal year. The current signature-based IPS has been in place for three years. The manager is concerned about the IPS's inability to detect zero-day attacks and the high number of false positives. The manager has a limited budget and must choose one improvement. Which option would provide the most significant improvement in the security posture?

   • APurchase a larger IPS appliance to improve performance.
   • BImplement a sandboxing solution to analyze unknown files.
   • CSubscribe to a threat intelligence feed to get more signatures.
   • DHire more security analysts to review IPS alerts.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is a common operational challenge of signature-based network protection?

   • AIt generates false positives for legitimate traffic that resembles known threats
   • BIt can only detect attacks that are already known
   • CIt requires a dedicated hardware appliance for every network segment
   • DIt requires a constant internet connection to function
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security analyst is investigating a breach. The attacker exfiltrated data by encoding it in DNS queries to a domain the attacker controls. The company's signature-based IPS did not alert. The analyst finds that the IPS has a signature for the specific malware used, but the malware's command-and-control traffic was sent over DNS. Which evasion technique is most directly responsible for the IPS not detecting the exfiltration?

   • AThe IPS was unable to decrypt the DNS traffic.
   • BThe malware's payload was obfuscated to avoid matching the signature.
   • CThe IPS had a false negative due to signature update latency.
   • DThe malware used protocol tunneling to hide its traffic in DNS.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst is reviewing a packet capture of a malware infection. The analyst sees that the malware sends its command-and-control traffic over HTTPS. The company's signature-based IPS is not configured to decrypt HTTPS traffic. Which limitation of signature-based detection is most directly demonstrated?

   • AInability to detect unknown threats
   • BSignature update latency
   • CFalse positives
   • DInability to inspect encrypted traffic
   Reveal Solution Discussion Select an answer first