問題文
An analyst receives a feed listing file hashes and server addresses seen in recent attacks, and separately a description of how an attacker group tends to move between hosts. How do these two kinds of input differ in how long they stay useful?
選択肢
- Both kinds of input stay useful for the same length of time, because both of them are derived from observations of real attacks and therefore both of them become outdated at the same rate as the attacks themselves change.
- Neither kind of input is useful for detection, because both of them describe attacks that have already happened somewhere else and therefore cannot say anything about what will arrive at this organization.
- The hashes and addresses go stale quickly because an attacker can change them cheaply once they are published, while the description of behavior stays useful for much longer because changing it costs real effort.
- The description of behavior goes stale faster, because attacker groups reorganize their operations often while the infrastructure that they have already paid for tends to be reused across many campaigns.