Discuss EC-Council 212-82 Exam Topic 8 Question 24

SecuraCorp, a leading financial institution, is worried about zero-day vulnerabilities. With a sprawling network infrastructure and multiple transaction points, it needs a system that does not solely rely on signatures but can effectively identify suspicious patterns based on the behavior in the network. Which type of IDS/IPS should SecuraCorp primarily deploy for its needs?

ANetwork-based IDS

BAnomaly-based IDS

CSignature-based IDS

DHost-based IDS

Suggested Answer: B

/var/log/wtmp is the Linux log file accessed by Gideon in this scenario. /var/log/wtmp is a log file that records information related to user login/logout, such as username, terminal, IP address, and login time. /var/log/wtmp can be used to determine the current login state of users in a Linux system. /var/log/wtmp can be viewed using commands such as last, lastb, or utmpdump1.

Get Premium 212-82 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

35 comments · newest first

Providencia 11 months ago

Host-based IDS? Not really suited for their needs, right?

Michael 11 months ago

Signature-based won't cut it for new vulnerabilities.

Katheryn 11 months ago

Wait, are we sure anomaly-based is reliable enough?

Franklyn 12 months ago

Totally agree, it’s all about behavior detection.

Juliann 12 months ago

Anomaly-based IDS is the way to go for zero-day threats!

Ryan 1 year ago

I feel like host-based IDS might not cover the entire network effectively, so I lean towards anomaly-based for broader detection.

Leatha 1 year ago

I practiced a similar question, and I think network-based IDS could be useful, but anomaly-based seems more aligned with identifying suspicious behavior.

Harrison 1 year ago

I'm not entirely sure, but I think signature-based systems might miss new threats since they rely on known signatures.

Kristofer 1 year ago

I remember studying that anomaly-based IDS can detect unusual patterns, which seems crucial for zero-day vulnerabilities.

Helaine 1 year ago

I'm pretty confident that the anomaly-based IDS is the right choice here. It can analyze network behavior and identify unusual patterns that might indicate a zero-day attack, which is exactly what SecuraCorp needs.

Lindsey 1 year ago

Signature-based IDS are great for known threats, but SecuraCorp is worried about zero-day vulnerabilities, so that's probably not the way to go. I'm leaning towards the anomaly-based IDS as the most suitable solution.

Ronny 1 year ago

Okay, I think the key here is that SecuraCorp needs a system that can detect suspicious patterns, not just rely on signatures. That points me towards an anomaly-based IDS as the best option.

Alecia 1 year ago

Hmm, I'm a bit unsure about this one. I know network-based and host-based IDS have their own strengths, but I'm not sure which one would be better for identifying zero-day vulnerabilities based on network behavior.

Herminia 1 year ago

This seems like a tricky question. I'll need to think carefully about the differences between the IDS/IPS types and which one would best fit SecuraCorp's needs.

Sarah 1 year ago

This seems like a straightforward question about workplace privacy rights. I'll focus on whether the employee had a reasonable expectation of privacy, as that seems to be the key consideration.

Michel 1 year ago

This seems like a pretty straightforward accounting question. I'll need to review the key types of accounting changes that must be disclosed.

Buck 1 year ago

I remember we talked about gateways in class, but I'm not sure if it was specifically for wireless networks. Could it be a Mesh Point?

Teri 2 years ago

Anomaly-based IDS all the way! It's like a cyber-detective, sniffing out the bad guys before they even strike. Gotta keep those financial transactions secure, am I right?

Tiffiny 1 year ago

↳ replying to Teri

D) Host-based IDS

Jess 1 year ago

↳ replying to Teri

C) Signature-based IDS

Kenny 1 year ago

↳ replying to Teri

B) Anomaly-based IDS

Ronnie 1 year ago

↳ replying to Teri

A) Network-based IDS

Sylvie 2 years ago

Hmm, host-based IDS? That's like trying to catch a fly with a sledgehammer. SecuraCorp needs the big guns, the network-wide solution. Although, I do hear the host-based IDS can make a mean grilled cheese sandwich.

Arthur 1 year ago

↳ replying to Sylvie

Network-based IDS

Huey 1 year ago

↳ replying to Sylvie

Anomaly-based IDS

Alesia 2 years ago

Signature-based IDS? Seriously? That's so last decade. SecuraCorp needs to step up its game and go for the anomaly-based approach. Gotta stay ahead of those zero-day threats, you know?

Beata 2 years ago

Network-based IDS might be the better choice here. With all those transaction points, you need something that can monitor the entire network infrastructure, not just individual hosts.

Arletta 2 years ago

I believe Network-based IDS could also be a good option for SecuraCorp to monitor the entire network traffic.

Tawna 2 years ago

I agree with Merrilee. Anomaly-based IDS can detect unusual behavior that signature-based IDS might miss.

Rikki 2 years ago

Anomaly-based IDS sounds like the way to go! It can detect suspicious patterns without relying solely on known signatures. Perfect for dealing with those pesky zero-day vulnerabilities.

Luther 1 year ago

↳ replying to Rikki

Host-based IDS could provide additional security at the endpoint level.

Joaquin 1 year ago

↳ replying to Rikki

Signature-based IDS may not be enough to detect zero-day vulnerabilities.

Gianna 1 year ago

↳ replying to Rikki

Network-based IDS could also be useful to monitor the traffic within the network.

Sophia 1 year ago

↳ replying to Rikki

I agree, anomaly-based IDS is definitely the best choice for SecuraCorp's needs.

Merrilee 2 years ago

I think SecuraCorp should primarily deploy an Anomaly-based IDS.

EC-Council 212-82 Exam - Topic 8 Question 24 Discussion