ISC2 CISSP Practice Question

Behavior-based detection is the BEST approach for the scenario because it establishes baselines of normal activity and can identify deviations that may indicate previously unknown attacks or zero-day threats before significant damage occurs. This proactive approach allows the financial institution to detect anomalous behavior that might not match known signatures but represents potentially malicious activity.

Signature-based detection relies on known patterns of malicious activity and would not detect new or modified attacks that don't match existing signatures. While useful, it's reactive rather than proactive. Heuristic detection uses rules to identify suspicious behavior but can generate more false positives and is not as comprehensive as behavior-based detection for establishing normal baseline operations. Stateful inspection primarily examines network traffic against connection states and doesn't provide the comprehensive monitoring needed for proactive threat detection across the environment.