Eccouncil Exam ECSS Topic 5 Question 94 Discussion

Actual exam question for Eccouncil's ECSS exam

Question #: 94
Topic #: 5

[All ECSS Questions]

Messy, a network defender, was hired to secure an organization's internal network. He deployed an IDS in which the detection process depends on observing and comparing the observed events with the normal behavior and then detecting any deviation from it.

Identify the type of IDS employed by Messy in the above scenario.

AStateful protocol analysis

BAnomaly-based

CSignature-based

DApplication proxy

Show Suggested Answer

Suggested Answer: B

by Ricarda at Sep 18, 2024, 10:06 PM

Limited Time Offer

25%

Off

Get Premium ECSS Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Nakita

3 hours ago

Hmm, this one's a bit tricky. I'm torn between B) Anomaly-based and C) Signature-based. But I'll go with B since Messy seems to be a pretty savvy network defender.

upvoted 0 times

...

Rene

14 days ago

I think the answer is B) Anomaly-based. The scenario describes an IDS that compares observed events with normal behavior to detect deviations, which is the hallmark of an anomaly-based IDS.

upvoted 0 times

...