Which of the following best describes signature-based detection?

Question

Options

• ACompare source code, looking for events or sets of events that could cause damage to a
• BCompare system activity for the behaviour patterns of new attacks.
• CCompare system activity, looking for events or sets of events that match a predefined
• DCompare network nodes looking for objects or sets of objects that match a predefined

• A
  4% (2)
• B
  7% (4)
• C
  88% (50)
• D
  2% (1)

Explanation

Signature-based detection works by monitoring system activity and comparing it against a database of known attack patterns (signatures) - predefined definitions of what malicious behavior looks like. Option C captures this precisely: it checks events or sets of events against these predefined signatures to flag matches as threats.

Why the distractors fail:

• A is wrong because signature-based detection does not analyze source code - that describes static code analysis or SAST tools.
• B describes anomaly-based (or heuristic) detection, which looks for deviations from normal behavior to catch new or unknown attacks - the opposite strength of signature-based systems.
• D is wrong because the scope is network nodes (devices/hosts), not system activity - signature-based detection is event-driven, not node-comparison.

Memory tip: Think of a signature-based IDS like an antivirus with a virus definition file - it can only catch what it already knows. If it's matching against a pre-built list, it's signature-based. If it's learning or detecting novel threats, it's anomaly-based.

No community discussion yet for this question.