ExamGecko
Question list
Search
Search

Question 118 - PCCET discussion

Report
Export

Which classification of IDS/IPS uses a database of known vulnerabilities and attack profiles to identify intrusion attempts?

A.
Statistical-based
Answers
A.
Statistical-based
B.
Knowledge-based
Answers
B.
Knowledge-based
C.
Behavior-based
Answers
C.
Behavior-based
D.
Anomaly-based
Answers
D.
Anomaly-based
Suggested answer: B

Explanation:

A knowledge-based system uses a database of known vulnerabilities and attack profiles to identify intrusion attempts. These types of systems have lower false-alarm rates than behavior-based systems but must be continually updated with new attack signatures to be effective.

A behavior-based system uses a baseline of normal network activity to identify unusual patterns or levels of network activity that may be indicative of an intrusion attempt.

These types of systems are more adaptive than knowledge-based systems and therefore may be more effective in detecting previously unknown vulnerabilities and attacks, but they have a much higher false-positive rate than knowledge-based systems.

asked 23/09/2024
Dustin Roberts
45 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first