QUESTION: 21

What is the difference between statistical detection and rule-based detection models?

Rule-based detection involves the collection of data in relation to the behavior of legitimate users over a period of time
Statistical detection defines legitimate data of users over a period of time and rule-based detection defines it on an IF/THEN basis
Statistical detection involves the evaluation of an object on its intended actions before it executes that behavior
Rule-based detection defines legitimate data of users over a period of time and statistical detection defines it on an IF/THEN basis

Answer(s): B

Reveal Solution Next Question

QUESTION: 22

What is the difference between a threat and a risk?

Threat represents a potential danger that could take advantage of a weakness in a system
Risk represents the known and identified loss or danger in the system
Risk represents the nonintentional interaction with uncertainty in the system
Threat represents a state of being exposed to an attack or a compromise, either physically or logically.

Answer(s): A

Explanation:

A threat is any potential danger to an asset. If a vulnerability exists but has not yet been exploited-- or, more importantly, it is not yet publicly known--the threat is latent and not yet realized.

Reveal Solution Next Question

QUESTION: 23

Which attack method intercepts traffic on a switched network?

denial of service
ARP cache poisoning
DHCP snooping
command and control

Answer(s): B

Explanation:

An ARP-based MITM attack is achieved when an attacker poisons the ARP cache of two devices with the MAC address of the attacker's network interface card (NIC). Once the ARP caches have been successfully poisoned, each victim device sends all its packets to the attacker when communicating to the other device and puts the attacker in the middle of the communications path between the two victim devices. It allows an attacker to easily monitor all communication between victim devices. The intent is to intercept and view the information being passed between the two victim devices and potentially introduce sessions and traffic between the two victim devices

Reveal Solution Next Question