Which Security Procedure item involves analyzing traffic patterns to detect anomalies?

Which Security Procedure item involves analyzing traffic patterns to detect anomalies?

• A. Traffic Analysis
• B. End-to-End Access Control
• C. Think like an adversary
• D. Privileges Assignment

Answer: (A)

Traffic analysis focuses on monitoring and examining network traffic patterns to spot anomalies. By baselining normal traffic behavior and watching for deviations—such as unexpected spikes in volume, unusual destinations, unusual ports or protocols, or unusual bursty activity—you can detect potential security events like intrusions, botnets, or data exfiltration. This aligns with a security procedure that uses traffic patterns to identify anomalies. End-to-end access control is about verifying who can use resources along the path, not about monitoring traffic patterns. Thinking like an adversary is a planning or threat-modeling mindset, not a traffic-monitoring activity. Privileges assignment deals with granting appropriate rights to users, not analyzing traffic for anomalies.

Traffic analysis focuses on monitoring and examining network traffic patterns to spot anomalies. By baselining normal traffic behavior and watching for deviations—such as unexpected spikes in volume, unusual destinations, unusual ports or protocols, or unusual bursty activity—you can detect potential security events like intrusions, botnets, or data exfiltration. This aligns with a security procedure that uses traffic patterns to identify anomalies.

End-to-end access control is about verifying who can use resources along the path, not about monitoring traffic patterns. Thinking like an adversary is a planning or threat-modeling mindset, not a traffic-monitoring activity. Privileges assignment deals with granting appropriate rights to users, not analyzing traffic for anomalies.