SSCP Risk Identification, Monitoring, and Analysis Practice Question
Which type of IDS uses a database of known attack patterns to identify malicious activity?
⚠ Common exam trap
It's easy for candidates to confuse the detection method (signature-based) with the deployment type (network-based), leading candidates to pick 'Network-based IDS' because they associate it with monitoring network traffic, even though the question specifically asks about the detection methodology using known attack patterns.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Signature-based IDS
Signature-based IDS (D) is correct because it relies on a pre-defined database of known attack patterns, or signatures, to match against network traffic or system activity. When a packet or event matches a signature, the IDS generates an alert. This is the traditional method used by systems like Snort, which compares traffic against rule sets containing specific byte sequences or protocol anomalies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Behavior-based IDS
Why it's wrong here
Behavior-based is similar to anomaly.
- ✗
Network-based IDS
Why it's wrong here
NIDS is a deployment type, not detection method.
- ✗
Anomaly-based IDS
Why it's wrong here
Anomaly-based uses baselines of normal behavior.
- ✓
Signature-based IDS
Why this is correct
Signature-based matches known attack signatures.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.