Anderson, a security engineer, was Instructed to monitor all incoming and outgoing traffic on the organization's network to identify any suspicious…

Context-based signature analysis focuses on examining the metadata and header fields of network packets rather than their payload. It inspects elements such as IP options, fragmentation flags, offsets, and protocol identifiers to detect anomalies, unauthorized alterations, or specific attack patterns like fragmentation attacks or spoofing. This directly matches the scenario where Anderson analyzes packet header fields to identify suspicious traffic.

B. Atomic-signature-based analysis focuses on identifying attacks based on a single packet or event, rather than specifically targeting header field alterations.
C. Composite-signature-based analysis involves analyzing multiple packets or events over a period to detect complex, multi-step attacks.
D. Content-based signature analysis inspects the actual payload or data portion of the packet for malicious strings or malware signatures, not the headers.

1. EC-Council Certified Cybersecurity Technician (CCT) Courseware, Module: Network Security and Intrusion Detection Systems.

2. NIST Special Publication 800-94: Guide to Intrusion Detection and Prevention Systems (IDPS), Section 2.3.