Cisco Certified Support Technician (CCST) CybersecurityNetwork SecurityHard
An incident response team is analyzing a recent breach where an attacker was able to gain access to a critical server by exploiting a zero-day vulnerability in its operating system. Before the breach, the server was protected by a traditional firewall and an antivirus solution. Which advanced security concept, if implemented, might have offered better protection against this unknown threat?
- ASpanning Tree Protocol (STP)
- BBehavioral Analytics
- CNetwork Address Translation (NAT)
- DDemilitarized Zone (DMZ)
Show answer & explanationAnswer & explanation
Correct answer: B. Behavioral Analytics
Behavioral analytics focuses on detecting deviations from normal system or user behavior. A zero-day exploit, by definition, is an unknown vulnerability, meaning signature-based defenses (like traditional antivirus) would not detect it. Behavioral analytics might identify the unusual activity caused by the exploit, even if the exploit itself is unknown.
Why the other options are wrong
- A. STP prevents network loops and has no relevance to protecting against zero-day exploits.
- C. NAT translates IP addresses and provides some ambiguity but offers no direct protection against zero-day exploits.
- D. A DMZ isolates public-facing services but doesn't inherently protect against zero-day exploits on a server within it.
Behavioral Analytics
Behavioral analytics in cybersecurity involves monitoring and analyzing user and system activity to detect anomalies that may indicate a threat, including unknown (zero-day) exploits.
- Detects deviations from baseline behavior
- Effective against zero-day threats
- Uses machine learning and AI for pattern recognition
Memory trick: Behavioral analytics spots the 'ghost' of an unknown attack.