Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Systems Auditor · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
From CRM: In contrast to IDSs, which rely on signature files to identify an attack as it happens (or after),an intrusion prevention system (IPS) predicts an attack before it can take effect. It does this by monitoring key areas of a computer system and looking for bad behavior, such as worms,Trojans, spyware, malware and hackers. It complements firewall, antivirus and antispyware tools to provide complete protection from emerging threats. It is able to block new (zero-day) threats that bypass traditional security measures, because it is not reliant on identifying and distributing threat signatures or patches.
Q: Which of the following BEST facilitates detection? Answer: C IDS are focused on detecting suspicious activities or anomalies in network traffic and system behavior without necessarily taking immediate action to block them. IDS can be more effective in identifying zero-day exploits because they rely on detecting abnormal patterns or behaviors that may indicate the presence of an attack, even if the specific exploit is unknown. Therefore, in the context of detecting zero-day exploits, an IDS would be a more suitable choice than an IPS.
IDS is specifically designed to detect new and emerging threats. - CISA Study Guide 5.15.1.