Cisco 200-201 Exam With Confidence Using Practice Dumps

According to NIST SP800-61, the incident response phase called “Containment, Eradication, and Recovery” involves containing the incident, eradicating the threat, and recovering from the incident2. In the scenario described, the engineer worked on containing the DDoS attack by identifying the attacker and the technique used, which is part of the containment process. The recommendation to implement Blackhole filtering is part of the eradication process, where measures are taken to prevent the attack from happening again. Finally, restoring the server is part of the recovery process, where normal operations are resumed. Therefore, the engineer finished work during the “Containment, Eradication, and Recovery” phase. References: NIST SP800-61 Computer Security Incident Handling Guide2.

Rule-based detection methods rely on predefined rules and patterns that are known beforehand. These rules are created based on prior knowledge of what constitutes normal and abnormal behavior.

Statistical detection, on the other hand, involves analyzing data to identify anomalies. It is based on assumptions about what normal behavior looks like and uses statistical methods to detect deviations from this norm.

Rule-based systems are typically straightforward but may miss novel attacks that do not match existing rules.

Statistical methods can detect previously unknown threats by recognizing patterns that deviate from established baselines but may produce more false positives.

References

Intrusion Detection Systems (IDS) Concepts

Comparative Studies on Rule-based and Statistical Anomaly Detection

Understanding Anomaly Detection in Network Security