212-82: Certified Cybersecurity TechnicianDemo

By ECCouncil · Question Mode

QuestionQ76

Network Monitoring and Analysis

Anderson, a security engineer, was instructed to monitor all incoming and outgoing traffic on the organization’s network to identify suspicious traffic. For this purpose, he used an analysis technique that examined packet-header fields such as IP options, IP protocols, IP fragmentation flags, offset, and identification to determine whether any fields had been altered in transit.

Identify the type of attack signature analysis Anderson performed in this scenario.

  • A Context-based signature analysis
  • B Atomic-signature-based analysis
  • C Composite-signature-based analysis
  • D Content-based signature analysis
Explanation

Context-based signature analysis evaluates the contextual metadata in packet headers, such as IP options, protocol indicators, and fragmentation fields, to identify anomalous or altered network traffic. Payload inspection is characteristic of content-based signature analysis, while atomic and composite signatures describe single-event and multi-event correlation patterns.

Community Discussion

No comments yet. Be the first to start the discussion!