Discuss ISC2 CSSLP Exam Topic 1 Question 104

Which of the following intrusion detection systems (IDS) monitors network traffic and compares it against an established baseline?

AFile-based

BNetwork-based

CAnomaly-based

DSignature-based

Suggested Answer: C

The anomaly-based intrusion detection system (IDS) monitors network traffic and compares it against an established baseline. This type of IDS

monitors traffic and system activity for unusual behavior based on statistics. In order to identify a malicious activity, it learns normal behavior

from the baseline. The anomaly-based intrusion detection is also known as behavior-based or statistical-based intrusion detection.

Answer D is incorrect. Signature-based IDS uses a database with signatures to identify possible attacks and malicious activity.

Answer B is incorrect. A network-based IDS can be a dedicated hardware appliance, or an application running on a computer, attached

to the network. It monitors all traffic in a network or traffic coming through an entry-point such as an Internet connection.

Answer A is incorrect. There is no such intrusion detection system (IDS) that is file-based.

Get Premium CSSLP Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

27 comments · newest first

Alease 9 months ago

Yup, anomaly-based is the right answer here.

Domonique 9 months ago

Totally agree, that's how it works!

Sage 10 months ago

Anomaly-based IDS checks against a baseline.

Aja 10 months ago

Sounds too good to be true, but I guess it makes sense!

Dolores 10 months ago

Wait, are you sure? I thought it was signature-based.

Ammie 11 months ago

I’m confused between C and D. I know signature-based systems look for known threats, but I can't recall if they compare to a baseline.

Providencia 11 months ago

I practiced a similar question last week, and I believe it was also about anomaly-based systems. That seems to fit the description best.

Vivienne 11 months ago

I'm not entirely sure, but I remember something about network-based IDS being more about traffic analysis rather than baseline comparisons.

Hollis 11 months ago

I think the answer might be C, anomaly-based, since it focuses on deviations from a baseline.

Chau 11 months ago

This is a straightforward question. Network-based IDS monitors network traffic and compares it to a baseline, so that's the answer I'm going with.

Noe 12 months ago

I'm a bit confused by the options here. File-based, anomaly-based, and signature-based all sound like they could be valid IDS types. I'll have to review my notes to make sure I understand the differences.

Clay 12 months ago

Okay, I've got this. Network-based IDS compares network traffic to a baseline to detect anomalies. That's the key distinction from the other types. I'm confident that's the right answer.

Ivory 12 months ago

Hmm, I'm a little unsure about this one. I know there are different types of IDS, but I can't quite remember the differences between them. I'll have to think this through carefully.

Bettina 1 year ago

I think this is asking about the different types of intrusion detection systems. Network-based IDS monitors network traffic, so that's probably the right answer.

Lashandra 1 year ago

I disagree, I believe the answer is D) Signature-based.

Tijuana 1 year ago

B) Network-based is the way to go. Gotta keep an eye on that internet superhighway, am I right?

Samira 1 year ago

Haha, this question is a real network traffic jam! I'm going with D) Signature-based, just like my driving habits.

Floyd 9 months ago

↳ replying to Samira

A mix of both could be ideal, but I lean towards C) Anomaly-based too!

Hillary 9 months ago

↳ replying to Samira

I still prefer D) Signature-based. It’s reliable for known threats.

Noah 10 months ago

↳ replying to Samira

I’m with you, Tarra! Anomaly-based makes sense for monitoring.

Tarra 10 months ago

↳ replying to Samira

I think C) Anomaly-based is the right choice. It’s all about detecting unusual patterns!

Ammie 1 year ago

I think the answer is C) Anomaly-based.

Ivette 1 year ago

C) Anomaly-based sounds like the one that monitors the network and looks for deviations from normal patterns. Makes sense to me.

Lili 1 year ago

I think the answer is B) Network-based. It monitors network traffic and compares it to a baseline, right?

Tawny 1 year ago

↳ replying to Lili

C) Anomaly-based

Paris 1 year ago

↳ replying to Lili

B) Network-based

Dulce 1 year ago

↳ replying to Lili

A) File-based

ISC2 CSSLP Exam - Topic 1 Question 104 Discussion