A system administrator is implementing an IDS on the database server to see who is trying to
access the server. The administrator relies on the software provider for what to detect. Which of
the following would MOST likely be installed?
A.
Behavior based IDS
B.
Network based IDS
C.
Signature based IDS
D.
Honeypot
Explanation:
Signature detection involves searching network traffic for a series of bytes or packet sequences
known to be malicious. A key advantage of this detection method is that signatures are easy to
develop and understand if you know what network behavior you’re trying to identify.