Exam CISA topic 1 question 171 discussion

According to CISA Review Manual 27th,5.15.1 Intrusion Detection System, In contrast to IDSs, which rely on signature files to identify an attack as it happens (or after),an intrusion prevention system (IPS) predicts an attack before it can take effect. It does this by monitoring key areas of a computer system and looking for bad behavior, such as worms,Trojans, spyware, malware and hackers. It complements firewall, antivirus and antispyware tools to provide complete protection from emerging threats. It is able to block new (zero-day) threats that bypass traditional security measures, because it is not reliant on identifying and distributing threat signatures or patches.

From CRM: In contrast to IDSs, which rely on signature files to identify an attack as it happens (or after),an intrusion prevention system (IPS) predicts an attack before it can take effect. It does this by monitoring key areas of a computer system and looking for bad behavior, such as worms,Trojans, spyware, malware and hackers. It complements firewall, antivirus and antispyware tools to provide complete protection from emerging threats. It is able to block new (zero-day) threats that bypass traditional security measures, because it is not reliant on identifying and distributing threat signatures or patches.

Q: Which of the following BEST facilitates detection? Answer: C IDS are focused on detecting suspicious activities or anomalies in network traffic and system behavior without necessarily taking immediate action to block them. IDS can be more effective in identifying zero-day exploits because they rely on detecting abnormal patterns or behaviors that may indicate the presence of an attack, even if the specific exploit is unknown. Therefore, in the context of detecting zero-day exploits, an IDS would be a more suitable choice than an IPS.

IDS is specifically designed to detect new and emerging threats. - CISA Study Guide 5.15.1.

Zero-day exploits tend to be very difficult to detect. Anti-malware software, some Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) are often ineffective because attack signatures do not yet exist. For this reason, the best way to detect zero-day attacks is to analyze user behavior.

B is the answer since there is not digital fingerprints of zero day attacks for the IDS or IPS to be used..

Option B Since other methods depends on known signatures. However CISA is stating that IPS detects attacks by leveraging on its ability to monitor and identify behavioral disparities within the system. This now make it quite tricky. To be safe, I’d stick to user behavior analysis

B 100%

Yes is B

B with no doubt

B is teh answer

It should be B

B. User behavior analytics User behavior analytics is the best option for facilitating the detection of zero-day exploits. Zero-day exploits are vulnerabilities that are not known to the vendor or to the general public and therefore have not yet been patched. They can be difficult to detect because they are not detected by traditional security controls. User behavior analytics involves analyzing user activity in order to identify unusual or suspicious behavior that may indicate an attempted zero-day exploit. Options A, C, and D may also help to detect zero-day exploits, but they are not as effective as user behavior analytics.

The answer is B

Zero-day exploits tend to be very difficult to detect. Antimalware software and some intrusion detection systems (IDSes) and intrusion prevention systems (IPSes) are often ineffective because no attack signature yet exists. This is why the best way to detect a zero-day attack is user behavior analytics.

Answer looks like D based on manual : In contrast to IDSs, which rely on signature files to identify an attack as it happens (or after), an intrusion prevention system (IPS) predicts an attack before it can take effect. It does this by monitoring key areas of a computer system and looking for bad behavior, such as worms, Trojans, spyware, malware and hackers. It complements firewall, antivirus and antispyware tools to provide complete protection from emerging threats. It is able to block new (zero-day) threats that bypass traditional security measures, because it is not reliant on identifying and distributing threat signatures or patches.

Why is the correct answer D, if IPS and IDS do work on signatures these are not valid options to detect zero-days. Instead behavior based solutions should be a better option