Cisco CyberOps Associate (CBROPS) 200-201Security ConceptsHard
A security team is implementing a new endpoint detection and response (EDR) solution. The solution is configured to continuously monitor system calls, process activity, and file system changes on endpoints. It then uses machine learning to identify deviations from normal behavior patterns to detect potential threats, even if they are previously unknown. What security monitoring concept is primarily being utilized by this EDR solution?
- ASignature-based detection
- BAnomaly-based detection
- CThreat intelligence feeds
- DHeuristic-based detection
Show answer & explanationAnswer & explanation
Correct answer: B. Anomaly-based detection
Anomaly-based detection, often employing machine learning, establishes a baseline of 'normal' system behavior. It then flags any activity that deviates significantly from this baseline as potentially malicious, allowing detection of zero-day attacks or novel threats not covered by signatures. The scenario's focus on 'deviations from normal behavior patterns' and 'previously unknown' threats directly points to anomaly-based detection.
Why the other options are wrong
- A. Signature-based detection relies on known patterns and would not effectively detect 'previously unknown' threats.
- C. Threat intelligence feeds provide lists of known bad indicators, which is complementary but not the primary 'monitoring concept' described for detecting unknown threats via behavioral analysis.
- D. Heuristic-based detection uses rules and algorithms but may not be as adaptive as machine learning for identifying 'deviations from normal behavior patterns' for unknown threats.
Anomaly-based Detection
A security monitoring technique that identifies threats by flagging activities that deviate significantly from an established baseline of normal or expected system behavior.
- Effective at detecting zero-day attacks and novel threats.
- Often uses machine learning or statistical analysis.
- Can generate a higher rate of false positives compared to signature-based.
Memory trick: Anomalies are the 'Odd Ones Out'.