A security team wants to use passive classification methods to profile unauthorized devices attempting to connect to their network. Which technique should be used?

Question

Options

• AUsing pre-shared keys
• BActively probing devices with pings
• CMonitoring device traffic behavior
• DManually adding MAC addresses

• A
  2% (1)
• C
  93% (43)
• D
  4% (2)

Explanation

Monitoring device traffic behavior (C) is correct because passive classification involves observing network activity without interacting with or alerting the target device. By analyzing traffic patterns - such as OS fingerprinting via packet headers, protocol usage, or communication timing - security teams can profile unknown devices silently.

Why the distractors fail:

• A (Pre-shared keys) is an authentication mechanism, not a classification or profiling technique.
• B (Actively probing with pings) is the opposite of passive - it generates traffic toward the device, which can alert it and doesn't qualify as passive classification.
• D (Manually adding MAC addresses) describes MAC whitelisting/filtering for access control, not profiling unknown devices.

Memory tip: Think "passive = listen, don't touch." If a method sends anything to the device, it's active. Only watching traffic flowing naturally qualifies as passive - and traffic behavior is the only option here where the security team stays silent.

No community discussion yet for this question.