Which statement describes the policy-based intrusion detection approach?
- It compares the signatures of incoming traffic to a known intrusion database.
- It compares the antimalware definitions to a central repository for the latest updates.
- It compares the operations of a host against well-defined security rules.
- It compares the behaviors of a host to an established baseline to identify potential intrusion.
| Explanation & Hint:
With the anomaly-based intrusion detection approach, a set of rules or policies are applied to a host. Violation of these policies is interpreted to be the result of a potential intrusion. |