An anomaly-based intrusion detection system (IDS) operates by gathering data on:

A. normal network behavior and using it as a baseline for measuring abnormal activity.

B. abnormal network behavior and using it as 4 baseline for measuring normal activity.

C. abnormal network behavior and issuing instructions to the firewall to drop rogue connections.

D. attack pattern signatures from historical data.








 

Suggested Answer: A



This question is in CISM exam 
For getting Certified Information Security Manager Certificate


Disclaimers:
The website is not related to, affiliated with, endorsed or authorized by ISACA.
The website does not contain actual questions and answers from ISACA's Certification Exams.
Trademarks, certification & product names are used for reference only and belong to ISACA.