SSCP · Question #949
Attributes that characterize an attack are stored for reference using which of the following Intrusion Detection System (IDS) ?
The correct answer is A. signature-based IDS. A signature-based Intrusion Detection System (IDS) identifies attacks by comparing observed activities against a database of known attack patterns.
Question
Attributes that characterize an attack are stored for reference using which of the following Intrusion Detection System (IDS) ?
Options
- Asignature-based IDS
- Bstatistical anomaly-based IDS
- Cevent-based IDS
- Dinferent-based IDS
How the community answered
(52 responses)- A88% (46)
- B4% (2)
- C2% (1)
- D6% (3)
Why each option
A signature-based Intrusion Detection System (IDS) identifies attacks by comparing observed activities against a database of known attack patterns.
Signature-based IDSs maintain a database of specific attack patterns, or 'signatures,' which are characteristic attributes or sequences of events associated with known threats. When network traffic or system logs match one of these predefined signatures, the IDS triggers an alert, indicating a potential intrusion.
Statistical anomaly-based IDSs detect deviations from established baselines of normal network or system behavior, rather than matching against known attack attributes.
Event-based IDS is not a standard classification; all IDSs process events, but this doesn't define the detection methodology.
Inferent-based IDS is not a recognized or standard category for Intrusion Detection Systems.
Concept tested: Signature-based IDS functionality
Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/security-baselines/security-baselines-faq#intrusion-detection-system-ids
Topics
Community Discussion
No community discussion yet for this question.