問題文
A sensor was left watching a segment for two weeks to work out what normal traffic looks like there, and one host was already compromised during those two weeks. What does that do to the sensor?
選択肢
- The activity of that host was folded into the picture of normal, so the same activity is no longer reported as a deviation worth acting on.
- The list of known patterns was widened by what it saw, so the sensor now reports the pattern it learned wherever that pattern appears again.
- The picture of normal was left too thin to be usable, so every host on the segment produces reports at a rate nobody can work through.
- The universal description of the protocol was overwritten, so the sensor now has to be given the description again by the party that wrote it.