An engineer must create a SIEM rule to test events and traffic for spikes and changes that occur in regular patterns to detect irregularities. Which rules achieve the desired results?
The correct answer is: A. Anomaly
Why ? :
Anomaly detection rules are designed to identify deviations from established baselines or normal behavior patterns. These rules are highly effective for detecting spikes, changes, and irregularities in event and traffic patterns.
Anomaly detection works by:
Comparing current data to historical baselines.
Identifying unusual activity, such as traffic spikes, failed login attempts, or data exfiltration attempts.
This section is not available anymore. Please use the main Exam Page.200-201 Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
mgo28404
5 months agoImGonnaPassIt
5 months, 2 weeks ago3000bd6
7 months, 1 week ago