Eccouncil 312-38 Exam - Topic 3 Question 18 Discussion

Actual exam question for Eccouncil's 312-38 exam

Question #: 18
Topic #: 3

Kyle is an IT consultant working on a contract for a large energy company in Houston. Kyle was hired on to do contract work three weeks ago so the company could prepare for an external IT security audit. With suggestions from upper management, Kyle has installed a network-based IDS system. This system checks for abnormal behavior and patterns found in network traffic that appear to be dissimilar from the traffic normally recorded by the IDS. What type of detection is this network-based IDS system using?

AThis network-based IDS system is using anomaly detection.

BThis network-based IDS system is using dissimilarity algorithms.

CThis system is using misuse detection.

DThis network-based IDS is utilizing definition-based detection.

Show Suggested Answer

Suggested Answer: A

by Carey at May 06, 2022, 07:02 PM

Limited Time Offer

25%

Off

Get Premium 312-38 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Adria

4 months ago

Nah, it's not dissimilarity algorithms. That's not a thing here.

upvoted 0 times

...

Emelda

4 months ago

Really? I didn't know they used that for network traffic!

upvoted 0 times

...

Gladis

4 months ago

Anomaly detection makes sense, especially for abnormal patterns.

upvoted 0 times

...

Lavera

4 months ago

I thought it was misuse detection? Not sure about this.

upvoted 0 times

...

Monroe

5 months ago

Definitely anomaly detection! That's how it works.

upvoted 0 times

...

Kristel

5 months ago

I remember definition-based detection being about specific signatures, so that can't be right either. A seems to fit best with what Kyle is doing.

upvoted 0 times

...

Jenelle

5 months ago

I'm not entirely sure, but I feel like dissimilarity algorithms might be a term I came across. It sounds similar to what the question describes.

upvoted 0 times

...

Lashanda

5 months ago

I think the answer is A, anomaly detection. I remember studying that it looks for deviations from normal patterns in network traffic.

upvoted 0 times

...

Glenn

5 months ago

I practiced a question like this before, and I believe misuse detection is more about known threats, so I don't think it's C.

upvoted 0 times

...

Twila

5 months ago

Hmm, creating a unique global customer ID seems like a good starting point to resolve the inconsistent customer data.

upvoted 0 times

...

Laurena

5 months ago

I'm a bit confused by the multiple exhibits. I'll need to make sure I understand what each one is showing before I can determine the root cause.

upvoted 0 times

...

Leandro

5 months ago

I'm a bit confused here. Should I restore from a snapshot or a backup? I'll have to double-check the details.

upvoted 0 times

...

Tracey

5 months ago

I remember practicing a similar question where we had to adjust for a double entry, but I'm not certain if it was about gas bills specifically.

upvoted 0 times

...

Justine

5 months ago

This is a real ethical dilemma. I'd start by double-checking my work to make sure my conclusion is solid. Then I'd try to have an open and honest discussion with my supervisor, laying out the facts and my reasoning. Hopefully they'll understand. But if they insist on a favorable recommendation, I may need to take it up the chain or even consider resigning on principle.

upvoted 0 times

...