Palo Alto Networks (PANW) Certified Cybersecurity Entry-level Technician (PCCET) Practice Exam

Which type of system can be blinded by a low-and-slow approach?

1. Intrusion detection

2. Intrusion prevention

3. Signature based

4. Behavior based

The correct answer is: Behavior based

A low-and-slow approach is a tactic used by attackers to evade detection and avoid triggering security mechanisms. By slowing down the rate of their attacks, they can blend in with normal traffic and avoid generating enough alerts to be caught by security systems. Behavior-based systems are designed to detect anomalies by analyzing the normal behavior of systems or users. These systems typically rely on patterns and deviations from expected behavior to identify potential threats. A low-and-slow attack can easily circumvent such systems because the attacker’s traffic does not significantly deviate from the established baseline of normal activity over time, making it harder for the behavior-based detection methods to recognize the malicious activity. In contrast, signature-based systems rely on known signatures of malware or patterns of attack. They are likely to catch various forms of attacks quickly as long as the signatures of those attacks are up-to-date. Similarly, intrusion prevention systems, which proactively block threats based on known signatures or specific behaviors, are also more likely to detect aggressive or rapid attack patterns. Therefore, the nuanced and gradual nature of a low-and-slow attack presents a particular challenge for behavior-based detection methods, as it allows the attacker to remain undetected for longer periods.