Deck 13: Intrusion Detection Systems and Network Security

Question 1

What must you do in order to sniff the traffic on all ports on a switch?

A)Nothing;you can see all the traffic on a switch by default.
B)Nothing;a switch does not allow you do see all traffic.
C)Enable port mirroring.
D)Run a cable to each port.

Answer 1

C

Question 2

The difference between misuse and anomaly IDS models is

A)Misuse models require knowledge of normal activity,whereas anomaly models don't.
B)Anomaly models require knowledge of normal activity,whereas misuse models don't.
C)Anomaly models are based on patterns of suspicious activity.
D)Anomaly model-based systems suffer from many false negatives.

Answer 2

B

Question 3

Your boss is concerned about employees viewing in appropriate or illegal web sites in the workplace.Which device would be the best at addressing this concern?

A)Antivirus
B)Firewall
C)Protocol analyzer
D)Internet content filter

Answer 3

D

Question 4

Which of the following is NOT an advantage of network-based IDS?

A)It takes fewer systems to provide IDS coverage.
B)They can reduce false positive rates.
C)Development,maintenance,and upgrade costs are usually lower.
D)Visibility into all network traffic and can correlate attacks among multiple systems.

Question 5

Which of the following is NOT a component of an IDS?

A)Traffic collector
B)Signature database
C)Expert knowledge database
D)User interface and reporting

Question 6

Which of the following is NOT a disadvantage of host-based IDS?

A)The IDS uses local system resources.
B)The IDS can have a high cost of ownership and maintenance.
C)The IDS must have a process on every system you want to watch.
D)The IDS is ineffective when traffic is encrypted.

Question 7

The nuisance of web pages that automatically appear on top of your current web page can be remedied with

A)Antivirus
B)Antispam
C)Pop-up blockers
D)Firewalls

Question 8

Your boss would like you to implement a network device that will monitor traffic and turn off processes and reconfigure permissions as necessary.To do this you would use

A)A firewall
B)A sniffer
C)A passive HIDS
D)An active HIDS

Question 9

What does a host-based IDS monitor?

A)A single system
B)Networks
C)Physical intrusions into facilities
D)A system and all its surrounding systems

Question 10

One of the advantages of HIDS is that

A)They can reduce false-positive rates
B)Their signatures are broader
C)They can examine data before it has been decrypted
D)They are inexpensive to maintain in the enterprise

Question 11

What device would you use to attract potential attacks,so that you could safely monitor the activity and discover the intentions of the attacker?

A)Firewall
B)Antivirus
C)IDS
D)Honeypot

Question 12

According to SANS Internet Storm Center,the average survival time of an unpatched Windows PC on the Internet is

A)Less than two minutes
B)Less than two hours
C)Less than two days
D)Less than two weeks

Question 13

The main purpose of a honeypot is

A)To identify hackers so they can be tracked down by the FBI
B)To slow hackers down by providing an additional layer of security that they must pass before accessing the actual network
C)To distract hackers away from attacking an organization's live network
D)To help security professionals better understand and protect against threats to the system

Question 14

Antispam does all of the following EXCEPT:

A)Blacklisting
B)Malicious code detection
C)Language filtering
D)Trapping

Question 15

Windows Defender does all of the following EXCEPT:

A)Spyware detection and removal
B)Real-time malware protection
C)Spam filtering
D)Examine programs running on your computer

Question 16

Zone Alarm,Windows ICF,and iptables are all examples of

A)Antivirus
B)Antispyware
C)Antispam
D)Personal firewalls

Question 17

The model that most modern intrusion detection systems use is largely based upon a model created by Dorothy Denning and Peter Neumann called:

A)Intrusion Detection Interface System (IDIS)
B)Intrusion Response Interdiction system (IRIS)
C)Intrusion Detection Expert System (IDES)
D)Discovery,Haystack,Multics Intrusion Detection and Alerting System (MIDAS)

Question 18

Antivirus products do all of the following EXCEPT:

A)Automated updates
B)Media scanning
C)Block network traffic based on policies
D)Scan e-mail for malicious code and attachments

Question 19

A new breed of IDS that is designed to identify and prevent malicious activity from harming a system.

A)Dynamic IDS
B)Preventive IDS
C)Active IDS
D)HIPS

Question 20

Egress filtering

A)Scans incoming mail to catch spam
B)Scans outgoing mail to catch spam
C)Messages are scan for specific words or phrases
D)Filters out POP traffic

Question 21

Hostile activity that does not match an IDS signature and goes undetected is called a false positive.

Question 22

Simple rule sets that are applied to port number and IP addresses are called

A)Network address translation
B)Stateful packet filtering
C)Access control lists
D)Basic packet filtering

Question 23

A(n)_______________ is a network device with the purpose of enforcing a security policy across its connection,by allowing or denying traffic to pass into or out of the network.

Question 24

How does stateful packet filtering differ from basic packet filtering?

A)Stateful packet filtering looks only at each packet individually.
B)Stateful packet filtering looks at the packets in relation to other packets.
C)Stateful packet filtering looks at the destination address.
D)Stateful packet filtering looks at the source address.

Question 25

The security tool that will hide information about the requesting system and make the browsing experience secret is a

A)Web proxy
B)Reverse proxy
C)Anonymizing proxy
D)Open proxy

Question 26

Only active intrusion detection systems (IDS)can aggressively respond to suspicious activity,whereas passive IDS cannot.

Question 27

Network-based IDS examines activity on a system such,as a mail server or web server.

Question 28

A(n)_______________ monitors network traffic for malicious or unwanted behavior and can block,reject,or redirect traffic in real time.

Question 29

Deploying,maintaining,and upgrading host-based IDSs in a large network is cheaper than NIDSs.

Question 30

Content-based signatures detect character patterns and TCP flag settings.

Question 31

How does IPS differ from an IDS?

A)IPS is passive and IDS is active.
B)IPS uses heuristics and IDS is signature based.
C)IPS will block,reject,or redirect unwanted traffic;an IDS will only alert.
D)IDS will block,reject,or redirect unwanted traffic;an IPS will only alert.

Question 32

Which component of an IDS examines the collected network traffic and compares it to known patterns of suspicious or malicious activity?

A)Traffic collector
B)Analysis engine
C)Signature database
D)Examination collector

Question 33

_______________ detection looks for things that are out of the ordinary,such as a user logging in when he's not supposed to,or unusually high network traffic into and out of a workstation.

Question 34

A(n)_______________ server can be used to filter out undesirable traffic and prevent employees from accessing potentially hostile web sites.

Question 35

The misuse detection IDS model is more difficult to implement than the anomaly detection model,and is not as popular as a result.

Question 36

A sniffer must use a NIC in promiscuous mode;otherwise it will not see all the network traffic coming into the NIC.

Question 37

While NIDS are able to detect activities such as port scans and brute force attacks,it is unable to detect tunneling.

Question 38

The NIDS signature database is usually much larger than that of a host-based system.

Question 39

A signature database contains a list of the contents of the IP packet header's signature block,for every type of packet the IDS monitors.

Question 40

_______________ signatures are designed to match large patterns of activity,and examine how certain types of activity fit into the other activities going on around them.

Question 41

_______________ are host-based protective mechanisms that monitor and control traffic passing into and out of a single system.

Question 42

What are content- and context-based signatures?

Question 43

A(n)_______________ is an artificial environment where attackers can be contained and observed,without putting real systems at risk.

Question 44

What was wrong with the first host-based IDSs?

Question 45

_______________ scanning typically looks for commands or instructions that are not normally found in application programs,such as attempts to access a reserved memory register.

Question 46

List three approaches that antispam software uses to filter out junk e-mail.

Question 47

What are the advantages and disadvantages of HIDSs?

Question 48

A(n)_______________ is also known as a packet sniffer and network sniffer.

Question 49

_______________ products filter out the junk e-mail.