A team wants detection that can catch previously unseen attack behaviour and accepts more investigation…

Question

A team wants detection that can catch previously unseen attack behaviour and accepts more investigation effort. Which approach fits?

Accepted Answer

B. Anomaly-based detection — Anomaly detection can flag the novel case at the cost of more false positives; signatures need the pattern to be known.

Answer

Signature-based detection

Answer

DNS filtering

Answer

Allow-listing