Exam SY0-401 topic 1 question 16 discussion

Actual exam question from CompTIA's SY0-401

Question #: 16
Topic #: 1

When performing the daily review of the system vulnerability scans of the network Joe, the administrator, noticed several security related vulnerabilities with an assigned vulnerability identification number. Joe researches the assigned vulnerability identification number from the vendor website. Joe proceeds with applying the recommended solution for identified vulnerability.
Which of the following is the type of vulnerability described?

A. Network based
B. IDS
C. Signature based
D. Host based

Show Suggested Answer

Suggested Answer: C 🗳️
A signature-based monitoring or detection method relies on a database of signatures or patterns of known malicious or unwanted activity. The strength of a signature-based system is that it can quickly and accurately detect any event from its database of signatures.
Incorrect Answers:
A: A network-based IDS (NIDS) watches network traffic in real time. Its reliable for detecting network-focused attacks, such as bandwidth-based DoS attacks.
B: An intrusion detection system (IDS) is an automated system that either watches activity in real time or reviews the contents of audit logs in order to detect intrusions or security policy violations.
C: A host-based IDS (HIDS) watches the audit trails and log files of a host system. Its reliable for detecting attacks directed against a host, whether they originate from an external source or are being perpetrated by a user locally logged in to the host.
References:
, Sybex, Indianapolis, 2014, p. 21

by [deleted] at March 9, 2025, 7:01 a.m.

Comments

Submit Cancel

Currently there are no comments in this discussion, be the first to comment!