A network administrator is configuring an intrusion prevention system (IPS) and needs to understand how signature-based and anomaly-based detection engines operate. Which TWO statements accurately describe anomaly-based IPS detection? (Choose two)
Anomaly-based IPS detection builds a baseline of normal network traffic patterns, then flags deviations from that baseline as potential threats. This contrasts with signature-based detection, which matches known attack patterns rather than modelling normal behaviour.
Why this answer
Option A is correct because anomaly-based IPS detection works by first profiling legitimate traffic to build a statistical baseline of normal behavior, then flagging activity that deviates from that baseline as suspicious. Option B is correct because, since anomaly detection does not depend on pre-existing signatures, it can identify novel or zero-day attacks whose patterns have never been seen before. Option C is incorrect because relying on an up-to-date database of known malware signatures and attack strings describes signature-based detection, not anomaly-based detection.
Option D is incorrect because anomaly-based systems are actually prone to false positives, since legitimate but unusual traffic can deviate from the baseline, and no IPS guarantees zero false positives in high-throughput environments. Option E is incorrect because anomaly-based engines learn behavior dynamically and do not require vendor signature or threat-intelligence updates for every new vulnerability, which again describes signature-based systems.
Exam trap
CND often tests the signature-vs-anomaly trade-off, and the trap is picking the option claiming anomaly detection has no false positives or requires signature updates — both are signature-engine traits misattributed to anomaly engines.