During a penetration test at Rocky Mountain Insurance in Denver, ethical hacker Sophia Nguyen attempts...

The correct answer is D. Anomaly-Based Detection because the scenario explicitly states that the system “monitors traffic for deviations from established baselines” and flags behavior that does not match normal network activity. In CEH-aligned IDS/IPS concepts, anomaly-based detection (also called behavior-based detection) works by building a profile of what “normal” looks like—such as typical packet rates, protocol usage, session patterns, timing, connection distributions, and expected traffic flows—and then identifying events that deviate significantly from those norms. This makes it particularly useful against evasion techniques and previously unseen patterns, because it is not limited to matching known signatures.

Sophia’s tactic—packet fragmentation—is a classic evasion approach intended to bypass simplistic inspection systems by splitting malicious payloads or attack patterns across multiple fragments so they are harder to reconstruct or match. A baseline-driven anomaly system can still detect the attack because fragmentation itself (or the resulting traffic characteristics) may appear abnormal: unusual fragment counts, unexpected fragment sizes, atypical reassembly behavior, irregular session characteristics, or protocol violations compared to normal traffic profiles. Because the detection is based on behavior rather than a fixed pattern, it can trigger alerts even if the exact malicious payload is not recognized.

Why the other options are less correct: Signature-based detection relies on known patterns and may be evaded when attackers modify payloads or fragment traffic to avoid matches. Stateful packet inspection tracks connection state and can help with session validation, but it is not inherently a baseline deviation detector. Deep packet inspection inspects packet contents and can sometimes reassemble fragments depending on implementation, but the question’s key clue is “deviations from established baselines,” which directly points to anomaly-based detection.

Therefore, the IT team is most likely using anomaly-based detection.