SY0-301 · Question #902
Using a heuristic system to detect an anomaly in a computer's baseline, a system administrator was able to detect an attack even though the company signature based IDS and antivirus did not detect…
The correct answer is B. Zero-day. A zero-day attack exploits a previously unknown vulnerability for which no patch or signature exists. Because signature-based IDS and antivirus rely on known threat signatures, they cannot detect zero-day exploits. The heuristic system detected it by identifying anomalous…
Question
Using a heuristic system to detect an anomaly in a computer's baseline, a system administrator was able to detect an attack even though the company signature based IDS and antivirus did not detect it. Further analysis revealed that the attacker had downloaded an executable file onto the company PC from the USB port, and executed it to trigger a privilege escalation flaw. Which of the following attacks has MOST likely occurred?
Options
- ACookie stealing
- BZero-day
- CDirectory traversal
- DXML injection
How the community answered
(25 responses)- A4% (1)
- B72% (18)
- C16% (4)
- D8% (2)
Explanation
A zero-day attack exploits a previously unknown vulnerability for which no patch or signature exists. Because signature-based IDS and antivirus rely on known threat signatures, they cannot detect zero-day exploits. The heuristic system detected it by identifying anomalous behavior that deviated from the established baseline - the correct approach for catching unknown threats. The privilege escalation flaw triggered by the unknown executable is characteristic of a zero-day exploit. Cookie stealing involves session hijacking, directory traversal accesses unauthorized file paths, and XML injection manipulates XML parsers - none of which align with the described scenario.
Topics
Community Discussion
No community discussion yet for this question.