A retailer compares the last hour of DNS query volume at one store with the previous hour at that same store, rather than with one fixed count. Which term names that comparison?
Select an answer to reveal the explanation.
Short Explanation
Comparing this hour's rain gauge with the previous hour is not the same as checking one mark painted on the wall. You are comparing two adjacent windows of DNS volume at the same store. The trap is a single-domain signature, a vulnerability score, or a list of assets.
Full Explanation
Sliding-window anomaly detection comparing this store's latest DNS hour with the prior hour is the term. The retailer slides the comparison forward in time: the latest hour of DNS query volume at one store is judged against the previous hour at that same store, not against a fixed count. A departure between those adjacent windows is the anomaly. A signature rule that matches one named domain and skips comparing one hour of volume with another matches a known pattern, here one domain name, and it does not compare volume from one hour with the next. A signature can fire on a single query regardless of how the hour compares with the hour before it. A CVSS rating that scores a published weakness on a system installed at that store scores a published weakness. A vulnerability rating does not measure DNS query volume and is not a comparison of two time windows. An asset inventory that lists the store systems, their owners, and where each one sits lists systems, owners, and locations. An inventory is a catalog of assets, not a detector that compares one hour of queries with the prior hour. Exam caveat: an anomaly is a lead about a change from the recent window. It is not automatically an incident, and the exam is not asking you to invent a numeric threshold. Operational check: confirm both hours cover the same store and the same kind of DNS query before you treat the rise as suspicious.