Match each analysis technique to its description.
Drag a concept onto its matching description — or click a concept then click the description.
Matches known patterns
Identifies deviations from baseline
Uses rules to detect suspicious behavior
Monitors actions over time
Applies mathematical models
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Behavioral Analysis: Monitors and analyzes the behavior of entities (users, systems) to detect deviations from normal patterns.
Behavioral analysis monitors entity behavior; signature-based uses known patterns; anomaly-based uses baselines; heuristic uses rules. Common confusions include swapping behavioral and anomaly definitions or misassigning signature analysis.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Behavioral Analysis: Monitors and analyzes the behavior of entities (users, systems) to detect deviations from normal patterns.
Why this is correct
Behavioral analysis is correct because it involves continuously observing the actions of specific entities—such as users, endpoints, or applications—and building a personalized baseline of typical activity over time. By learning these entity-specific patterns, the technique can identify deviations, such as a user suddenly accessing systems at 3 AM or downloading large volumes of data, which may indicate compromise. This is distinct from anomaly-based analysis because it focuses on the evolving behavior profile of an individual entity rather than a broader statistical baseline.
Signature-Based Analysis: Compares data against known patterns (signatures) of malicious activity.
Why this is correct
Signature-based analysis works by inspecting data—files, network packets, or process memory—against a database of known malicious fingerprints, such as unique byte sequences, cryptographic hashes, or protocol patterns. These signatures derive from previously identified malware or attack campaigns, so the technique is highly accurate with minimal false positives. However, it is inherently limited to detecting only threats that are already documented; novel or polymorphic attacks that don't match an existing signature evade detection.
Anomaly-Based Analysis: Establishes a baseline of normal activity and flags any significant deviations.
Why this is correct
Anomaly-based analysis establishes a foundational baseline of what is considered 'normal' for a system or network. Once that baseline is created, it continuously monitors incoming activity and applies statistical modeling to flag any measurement that falls outside an established threshold of expected variance. This enables the detection of emerging or unknown threats, but it often produces high false-positive rates because legitimate but unusual activity—such as a rare administrative action—can be misclassified as malicious.
Heuristic Analysis: Uses algorithms and rules to identify potentially malicious behavior based on characteristics.
Why this is correct
Heuristic analysis applies a set of algorithmic rules, scoring criteria, and behavioral or structural characteristics to evaluate whether a file or process is likely malicious. Rather than relying on exact matches, it estimates a risk score based on traits like suspicious code structure, obfuscation, filesystem actions, or registry modifications. Because it generalizes from known attack patterns to detect similar but previously unseen threats, it is valuable for zero-day protection, though it can also generate false positives when benign applications share those risky attributes.
Behavioral Analysis: Establishes a baseline of normal activity and flags any significant deviations.
Why it's wrong here
This answer is incorrect because the described behavior—establishing a baseline of normal activity and flagging significant deviations—is the defining characteristic of anomaly-based analysis, not behavioral analysis. Behavioral analysis does build baselines, but it does so specifically for individual entities by learning their unique routines and interaction patterns over time. In contrast, anomaly-based analysis more broadly compares current system or network activity against a predefined statistical baseline, lacking the per-entity, profile-driven focus of true behavioral detection.
Signature-Based Analysis: Monitors and analyzes the behavior of entities to detect deviations.
Why it's wrong here
This answer is wrong because it describes behavioral analysis, not signature-based analysis. Signature-based analysis never monitors entity behavior over time; instead, it performs static or dynamic inspection to match known indicators of compromise, such as a malware file's hash or a command-and-control domain string. Monitoring and analyzing the behavior of entities to detect deviations is a hallmark of behavioral analysis, which learns a baseline and identifies anomalies in the actions of users or systems.
Go deeper
About these practice questions
Courseiva writes every CS0-004 question from scratch — 236 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.