Deck 7: Security Technology: Intrusion Detection and Prevention Systems, and Other Security Tools

Question 1

Intrusion detection and prevention systems perform monitoring and analysis of system events and user behaviors.

Answer 1

True

Question 2

All IDPS vendors target users with the same levels of technical and security expertise.

Answer 2

False

Question 3

The statistical anomaly-based IDPS collects statistical summaries by observing traffic that is known to be normal.

Answer 3

True

Question 4

Your organization's operational goals,constraints,and culture should not affect the selection of the IDPS and other security tools and technologies to protect your systems.

Question 5

The Simple Network Management Protocol contains trap functions,which allow a device to send a message to the SNMP management console indicating that a certain threshold has been crossed,either positively or negatively.

Question 6

NIDPSs can reliably ascertain if an attack was successful or not.

Question 7

A false positive is the failure of an IDPS system to react to an actual attack event.

Question 8

A HIDPS is optimized to detect multihost scanning,and it is able to detect the scanning of non-host network devices,such as routers or switches.

Question 9

In DNS cache poisoning,valid packets exploit poorly configured DNS servers to inject false information to corrupt the servers' answers to routine DNS queries from other systems on the network.

Question 10

A passive response is a definitive action automatically initiated when certain types of alerts are triggered.

Question 11

In order to determine which IDPS best meets an organization's needs,first consider the organizational environment in technical,physical,and political terms.

Question 12

An HIDPS can detect local events on host systems and also detect attacks that may elude a network-based IDPS.

Question 13

IDPS responses can be classified as active or passive.

Question 14

Intrusion detection consists of procedures and systems that identify system intrusions and take action when an intrusion is detected.

Question 15

A HIDPS can monitor systems logs for predefined events.

Question 16

An IDPS can be configured to dial a phone number and produce an alphanumeric page or a modem noise.

Question 17

Intrusion detection and prevention systems can deal effectively with switched networks.

Question 18

The process by which attackers change the format and/or timing of their activities to avoid being detected by the IDPS is known as a false attack stimulus.

Question 19

A fully distributed IDPS control strategy is the opposite of the centralized strategy.

Question 20

HIDPSs are also known as system integrity verifiers.

Question 21

Services using the TCP/IP protocol can run only on port 80.

Question 22

The confidence value,which is based upon false logic,helps an administrator determine how likely it is that an IDPS alert or alarm indicates an actual attack in progress._________________________

Question 23

The activities that gather information about the organization and its network activities and assets is called fingerprinting._________________________

Question 24

Nmap uses incrementing Time-To-Live packets to determine the path into a network as well as the default firewall policy.

Question 25

A strategy based on the concept of defense in depth is likely to include intrusion detection systems,active vulnerability scanners,passive vulnerability scanners,automated log analyzers,and protocol analyzers.

Question 26

An alert or intrusion is an indication that a system has just been attacked or is under attack._________________________

Question 27

The IDPS console includes the management software,which collects information from the remote sensors,analyzes the systems or networks,and determines whether the current situation has deviated from the preconfigured baseline._________________________

Question 28

The Metasploit Framework is a collection of exploits coupled with an interface that allows the penetration tester to automate the custom exploitation of vulnerable systems.

Question 29

A sniffer cannot be used to eavesdrop on network traffic.

Question 30

Most of the technologies that scan human characteristics convert these images to some form of minutiae.

Question 31

A(n)NIDPS functions on the host system,where encrypted traffic will have been decrypted and is available for processing._________________________

Question 32

Preconfigured,predetermined attack patterns are called signatures._________________________

Question 33

To assist in the footprint intelligence collection process,you can use an enhanced Web scanner that,among other things,can scan entire Web sites for valuable pieces of information,such as server names and e-mail addresses.

Question 34

A(n)server-based IDPS protects the server or host's information assets._________________________

Question 35

In the process of protocol application verification,the NIDPSs look for invalid data packets._________________________

Question 36

Passive scanners are advantageous in that they require vulnerability analysts to get approval prior to testing.

Question 37

Alarm filtering is alarm clustering that may be based on combinations of frequency,similarity in attack signature,similarity in attack target,or other criteria that are defined by the system administrators._________________________

Question 38

Once the OS is known,all of the vulnerabilities to which a system is susceptible can easily be determined.

Question 39

A(n)log file monitor is similar to a NIDPS._________________________

Question 40

A starting scanner is one that initiates traffic on the network in order to determine security holes.

Question 41

A padded cell is a hardened honeynet._________________________

Question 42

Intrusion ____ activities finalize the restoration of operations to a normal state and seek to identify the source and method of the intrusion in order to ensure that the same type of attack cannot occur again.

A)prevention
B)reaction
C)detection
D)correction

Question 43

The false detect rate is the percentage of identification instances in which unauthorized users are allowed access to systems or areas as a result of a failure in the biometric device._________________________

Question 44

Enticement is the action of luring an individual into committing a crime to get a conviction._________________________

Question 45

____ is an event that triggers an alarm when no actual attack is in progress.

A)False Positive
B)False Attack Stimulus
C)False Negative
D)Noise

Question 46

A(n)partially distributed IDPS control strategy combines the best of the other two strategies._________________________

Question 47

A wireless security toolkit should include the ability to sniff wireless traffic,scan wireless hosts,and assess the level of privacy or confidentiality afforded on the wireless network._________________________

Question 48

Minutiae are unique points of reference that are digitized and stored in an encrypted format when the user's system access credentials are created._________________________

Question 49

The trace usually consists of a honeypot or padded cell and an alarm._________________________

Question 50

For Linux or BSD systems,there is a tool called "scanner" that allows a remote individual to "mirror" entire Web sites._________________________

Question 51

When a collection of honeypots connects several honeypot systems on a subnet,it may be called a(n)honeynet._________________________

Question 52

A(n)____ works like a burglar alarm in that it detects a violation (some system activities analogous to an opened or broken window)and activates an alarm.

A)IDS
B)IIS
C)ITS
D)SIS

Question 53

Fingerprinting is the organized research of the Internet addresses owned or controlled by a target organization._________________________

Question 54

The trap is a process by which the organization attempts to identify an entity discovered in unauthorized areas of the network or systems._________________________

Question 55

Port fingers are tools used by both attackers and defenders to identify (or fingerprint)the computers that are active on a network,as well as the ports and services active on those computers,the functions and roles the machines are fulfilling,and other useful information._________________________

Question 56

A(n)listener vulnerability scanner is one that listens in on the network and determines vulnerable versions of both server and client software._________________________

Question 57

A(n)port is a network channel or connection point in a data communications system._________________________

Question 58

Activities that scan network locales for active systems and then identify the network services offered by the host systems is known as ____.

A)filtering
B)doorknob rattling
C)footprinting
D)fingerprinting

Question 59

____ is the process of classifying IDPS alerts so that they can be more effectively managed.

A)Alarm filtering
B)Alarm clustering
C)Alarm compaction
D)Alarm attenuation

Question 60

The false error rate is the percentage of identification instances in which authorized users are denied access a result of a failure in the biometric device._________________________

Question 61

____ testing is a straightforward testing technique that looks for vulnerabilities in a program or protocol by feeding random input to the program or a network running the protocol.

A)Buzz
B)Fuzz
C)Spike
D)Black

Question 62

____ is based on the use of some measurable human characteristic or trait to authenticate the identity of a proposed systems user.

A)Biometric access control
B)Physical access control
C)Software access control
D)System access control

Question 63

A(n)____ is a proposed systems user.

A)authenticator
B)challenger
C)supplicant
D)activator

Question 64

____ applications use a combination of techniques to detect an intrusion and then trace it back to its source.

A)Trace and treat
B)Trap and trace
C)Treat and trap
D)Trace and clip

Question 65

A(n)____ is a network tool that collects copies of packets from the network and analyzes them.

A)packet scanner
B)packet sniffer
C)honey pot
D)honey packet

Question 66

____ are decoy systems designed to lure potential attackers away from critical systems.

A)Honeypots
B)Honeycells
C)Padded cells
D)Padded nets

Question 67

Most NBA sensors can be deployed in ____ mode only,using the same connection methods as network-based IDPSs.

A)passive
B)active
C)reactive
D)dynamic

Question 68

____ benchmark and monitor the status of key system files and detect when an intruder creates,modifies,or deletes monitored files.

A)NIDPSs
B)HIDPSs
C)AppIDPSs
D)SIDPSs

Question 69

To determine whether an attack has occurred or is underway,NIDPSs compare measured activity to known ____ in their knowledge base.

A)fingernails
B)fingerprints
C)signatures
D)footprints

Question 70

____ is a specially configured connection on a network device that is capable of viewing all of the traffic that moves through the entire device.

A)NIDPS
B)SPAN
C)DPS
D)IDSE

Question 71

Which of the following ports is commonly used for the HTTP protocol?

A)20
B)25
C)53
D)80

Question 72

Using ____,the system reviews the log files generated by servers,network devices,and even other IDPSs.

A)LFM
B)stat IDPS
C)AppIDPS
D)HIDPS

Question 73

____ sensors are typically intended for network perimeter use,so they would be deployed in close proximity to the perimeter firewalls,often between the firewall and the Internet border router to limit incoming attacks that could overwhelm the firewall.

A)Inline
B)Offline
C)Passive
D)Bypass

Question 74

In TCP/IP networking,port ____ is not used.

A)0
B)1
C)13
D)1023

Question 75

Among all possible biometrics,____ is(are)considered truly unique.

A)retina of the eye
B)fingerprints
C)iris of the eye
D)All of the above

Question 76

A(n)____ IDPS is focused on protecting network information assets.

A)network-based
B)host-based
C)application-based
D)server-based

Question 77

____ are usually passive devices and can be deployed into existing networks with little or no disruption to normal network operations.

A)NIDPSs
B)HIDPSs
C)AppIDPSs
D)SIDPSs

Question 78

____ is the action of luring an individual into committing a crime to get a conviction.

A)Entrapment
B)Enticement
C)Intrusion
D)Padding

Question 79

IDPS researchers have used padded cell and honeypot systems since the late ____.

A)1960s
B)1970s
C)1980s
D)1990s

Question 80

The ____ is the level at which the number of false rejections equals the false acceptances,and is also known as the equal error rate.

A)BIOM
B)REC
C)IIS
D)CER