(ISC)2 Certified in Cybersecurity Practice Exam

Which detection method relies on pre-defined signatures of known threats?

1. Anomaly base detection

2. Behavior-based detection

3. Signature-based detection

4. Heuristic detection

The correct answer is: Signature-based detection

Signature-based detection is a method that relies on a database of known threat signatures to identify malicious activities or software. This approach functions by comparing observed behaviors or attributes of files and network traffic to a catalog of known signatures that are associated with specific malware, exploits, or other cybersecurity threats. When a match is found, an alert for a potential threat is generated. This method is highly effective for detecting known vulnerabilities and threats because it specifically targets previously identified patterns of malicious behavior, leading to rapid detection and response. Signature-based detection is often used in conjunction with other detection methods, as it can struggle to identify new, unknown threats that do not have established signatures. In contrast, anomaly-based detection identifies deviations from normal behavior, which can be useful but may generate false positives if a legitimate change occurs in the network or user behavior. Behavior-based detection focuses on the behavior of entities (like users or systems) rather than specific signatures, while heuristic detection uses algorithms to identify potentially harmful files based on characteristics and behavior rather than specific signatures.