Question 1

Match each statement with an item below. -Triggers an alert or alarm when one of the following changes occurs: file attributes change,new files are created,or existing files are deleted. A)Intrusion detection system B)HIDS C)Signature-based IDS D)Enticement E)Entrapment F)Alarm clustering G)NIDS H)Nmap I)Scanning utility

Accepted Answer

HIDS (Host-based Intrusion Detection System) can trigger an alert or alarm when file attributes change, new files are created, or existing files are deleted.

Answer: C 
 Signature-based IDS (Intrusion Detection System) uses specific signatures or patterns in network packets or system files to detect threats and send alerts.

Answer: G 
 NIDS (Network-based Intrusion Detection System) can detect network attacks and intrusions by monitoring network traffic.

Answer: H 
 Nmap is a scanning utility used for network discovery and security auditing. It can scan networks to detect open ports and services, and can also be used to identify potential vulnerabilities.

Question 2

A(n)____________________ can adapt its reaction activities based on both guidance learned over time from the administrator as well as circumstances present in the local environment.

Accepted Answer

The answer of A(n)____________________ can adapt its reaction activities based...

Question 3

Match each statement with an item below. -A widely used port scanner. A)Intrusion detection system B)HIDS C)Signature-based IDS D)Enticement E)Entrapment F)Alarm clustering G)NIDS H)Nmap I)Scanning utility

Accepted Answer

Nmap is a widely used scanning utility that can scan for open ports on a network.

Answer: G
 NIDS refers to Network-based Intrusion Detection Systems that monitor network traffic to detect any suspicious activity.

Answer: A
 Intrusion Detection System (IDS) refers to a system that identifies potential security breaches by monitoring network or system activity.

Note: The other options are not directly related to the given item, so they are not a good match.

Question 4

_________________________ is the process of evaluating circumstances around organizational events,determining which events are possible incidents,or incident candidates,and then determining whether or not the event constitutes an actual incident.

Accepted Answer

The answer of _________________________ is the process of evaluating circumstances...

Question 5

The task of monitoring file systems for unauthorized change is best performed by using a(n)____.
A)cache
B)honeypot
C)SPAN
D)HIDS

Accepted Answer

HIDS (Host-based Intrusion Detection System) is the best option for monitoring file systems for unauthorized changes. HIDS operates by analyzing events associated with the file system to detect any unexpected changes. This is done by comparing the current state of the file system to a known good state, and generating alerts when discrepancies are found.

Question 6

The term ____________________ refers to a consolidation of almost identical alarms into a single higher-level alarm.

Accepted Answer

The answer of The term ____________________ refers to a consolidation...

Question 7

Match each statement with an item below. -Looks for indications of ongoing or successful attacks and resides on a computer or appliance connected to that network segment. A)Intrusion detection system B)HIDS C)Signature-based IDS D)Enticement E)Entrapment F)Alarm clustering G)NIDS H)Nmap I)Scanning utility

Accepted Answer

The answer of Match each statement with an item below. -Looks...

Question 8

Match each statement with an item below. -Network burglar alarm. A)Intrusion detection system B)HIDS C)Signature-based IDS D)Enticement E)Entrapment F)Alarm clustering G)NIDS H)Nmap I)Scanning utility

Accepted Answer

A network burglar alarm is another term for an intrusion detection system, which is designed to detect unauthorized access to a network or system.

Answer: G
 NIDS stands for network-based intrusion detection system, which monitors network traffic for suspicious activity and alerts administrators when potential threats are detected.

Answer: C
 Signature-based IDS uses a database of known attack signatures to identify and block suspicious activity on a network or system.

Answer: H and I
 Nmap is a popular network scanning utility that can be used to identify hosts and services on a network, while also checking for known vulnerabilities and misconfigurations.

Question 9

Match each statement with an item below. -Tool used to identify which computers are active on a network,as well as which ports and services are active on the computers,what function or role the machines may be fulfilling,and so on. A)Intrusion detection system B)HIDS C)Signature-based IDS D)Enticement E)Entrapment F)Alarm clustering G)NIDS H)Nmap I)Scanning utility

Accepted Answer

The answer of Match each statement with an item below. -Tool...

Question 10

Match each statement with an item below. -The action of luring an individual into committing a crime to get a conviction. A)Intrusion detection system B)HIDS C)Signature-based IDS D)Enticement E)Entrapment F)Alarm clustering G)NIDS H)Nmap I)Scanning utility

Accepted Answer

Entrapment is the action of luring an individual into committing a crime to get a conviction.

Answer: D
 Enticement is the act of persuading or enticing someone to do something, typically illegal or dishonest.

Answer: C
 Signature-based IDS identifies known patterns of attacks or events called signatures.

Answer: G
 NIDS (Network Intrusion Detection System) monitors network traffic to identify signs of malicious activity.

Answer: I
 Nmap is a popular scanning utility used to discover hosts and services on a network.

Note: The other options, HIDS (Host-based Intrusion Detection System) and Alarm clustering, are not accurately matched with any of the given statements.

Question 11

A ____ is a computer server configured to resemble a production system,containing rich information just begging to be hacked.
A)smart IDS
B)DNS cache
C)network cluster
D)honeypot

Accepted Answer

A honeypot is a computer server designed to appear as a vulnerable system, often containing fabricated or decoy data which can expose potential attackers. The purpose of a honeypot is to detect and monitor attacks, as well as gather information about attacker methods, techniques and tools. It serves as a proactive measure for organizations to identify potential weaknesses in their systems and protect against real attacks.

Question 12

A ____ is a high-interaction honeypot designed to capture extensive information on threats.
A)DNS cache
B)honeypot Farm
C)DNS farm
D)network-based IDS

Accepted Answer

A honeypot farm is a collection of high-interaction honeypots designed to capture extensive information on threats. This type of honeypot is typically used by organizations that need to gather intelligence on attackers, such as security vendors or government agencies. It is different from a network-based IDS, which is a passive system that detects and alerts on suspicious network activity, and a DNS cache or DNS farm, which are used for caching and distributing DNS queries.

Question 13

Match each statement with an item below. -Examines data traffic in search of patterns that match known signatures - that is,preconfigured,predetermined attack patterns. A)Intrusion detection system B)HIDS C)Signature-based IDS D)Enticement E)Entrapment F)Alarm clustering G)NIDS H)Nmap I)Scanning utility

Accepted Answer

Signature-based IDS examines data traffic in search of patterns that match known signatures.

Answer: A
 Intrusion detection system (IDS) examines data traffic in search of possible attacks, including by using signature-based methodologies.

Answer: G
 Network intrusion detection systems (NIDS) specifically examine network traffic in search of possible attacks.

Answer: H
 Nmap is a popular scanning utility used to map out networks and find potential vulnerabilities.

Answer: I
 Scanning utilities like Nmap are often used to identify potential security weaknesses and vulnerabilities in systems.

Note: The other options (B, D, E, and F) do not match any of the given statements.

Question 14

Match each statement with an item below. -The process of attracting attention to a system by placing tantalizing bits of information in key locations. A)Intrusion detection system B)HIDS C)Signature-based IDS D)Enticement E)Entrapment F)Alarm clustering G)NIDS H)Nmap I)Scanning utility

Accepted Answer

Enticement refers to the process of attracting attention to a system by placing tantalizing bits of information in key locations.

Answer: H
 Nmap is a scanning utility that can be used to discover information about network hosts and the services running on them.

Answer: G
 NIDS (network intrusion detection system) is an IDS that monitors network traffic and alerts administrators to potential security threats.

Note: The other options (A, B, C, E, and F) are also related to intrusion detection and network security, but they do not match the given statements as accurately as D, H, and G do.

Question 15

A ____ is a type of IDS that is similar to the NIDS,reviews the log files generated by servers,network devices,and even other IDSs.
A)honeypot
B)alarm cluster
C)log file monitor
D)DNS cache

Accepted Answer

A log file monitor is a type of IDS that reviews log files generated by servers, network devices, and other IDSs. It is similar to NIDS (Network Intrusion Detection System) in that it examines network traffic, but it specifically focuses on analyzing log files rather than real-time traffic. Honeypots are used as a decoy to lure attackers away from real systems, alarm clusters are collections of IDS systems that work together, and DNS cache is a server cache that stores DNS information for faster retrieval.

Question 16

____ are tools used to identify which computers are active on a network,as well as which ports and services are active on the computers,what function or role the machines may be fulfilling,and so on.
A)Triggers
B)Clusters
C)Scanning utilities
D)Filters

Accepted Answer

Scanning utilities, such as port scanners and network mapping tools, are used to identify active computers on a network, as well as their functions and the ports and services they are running. Triggers, clusters, and filters are not typically used for this purpose.

Question 17

Match each statement with an item below. -Can indicate if a relationship exists between the individual alarm elements when they have specific similar attributes. A)Intrusion detection system B)HIDS C)Signature-based IDS D)Enticement E)Entrapment F)Alarm clustering G)NIDS H)Nmap I)Scanning utility

Accepted Answer

Alarm clustering can indicate if a relationship exists between individual alarm elements when they have specific similar attributes by grouping related alarms together, which helps in identifying patterns or coordinated attacks.

Question 18

A(n)____________________ monitors traffic on a segment of an organization's network.

Accepted Answer

The answer of A(n)____________________ monitors traffic on a segment of...

Question 19

The term ____ refers to the level at which the IDS triggers an alert to notify the administrator.
A)clipping level
B)cache level
C)signature matching
D)Alarm Filtering

Accepted Answer

The term "clipping level" refers to the threshold or level at which an IDS triggers an alert to notify the administrator. It is also known as the detection threshold, and it can be adjusted to customize the level of sensitivity of the IDS. Cache level refers to the amount of memory or storage space allocated for storing temporary data, while signature matching is a technique used by IDS to detect known patterns of attacks. Alarm filtering refers to the process of prioritizing and categorizing security alerts based on their severity and relevance.

Question 20

____________________ is the process of classifying the attack alerts that an IDS detects in order to distinguish or sort false positives from actual attacks more efficiently.

Accepted Answer

The answer of ____________________ is the process of classifying the...

Quiz 4: Incident Response: Detection and Decision Making

Match each statement with an item below. -Triggers an alert or alarm when one of the following changes occurs: file attributes change,new files are created,or existing files are deleted.

A(n)____________________ can adapt its reaction activities based on both guidance learned over time from the administrator as well as circumstances present in the local environment.

Match each statement with an item below. -A widely used port scanner.

_________________________ is the process of evaluating circumstances around organizational events,determining which events are possible incidents,or incident candidates,and then determining whether or not the event constitutes an actual incident.

The task of monitoring file systems for unauthorized change is best performed by using a(n) ____.

The term ____________________ refers to a consolidation of almost identical alarms into a single higher-level alarm.

Match each statement with an item below. -Looks for indications of ongoing or successful attacks and resides on a computer or appliance connected to that network segment.

Match each statement with an item below. -Network burglar alarm.

Match each statement with an item below. -Tool used to identify which computers are active on a network,as well as which ports and services are active on the computers,what function or role the machines may be fulfilling,and so on.

Match each statement with an item below. -The action of luring an individual into committing a crime to get a conviction.

A ____ is a computer server configured to resemble a production system,containing rich information just begging to be hacked.

A ____ is a high-interaction honeypot designed to capture extensive information on threats.

Match each statement with an item below. -Examines data traffic in search of patterns that match known signatures - that is,preconfigured,predetermined attack patterns.

Match each statement with an item below. -The process of attracting attention to a system by placing tantalizing bits of information in key locations.

A ____ is a type of IDS that is similar to the NIDS,reviews the log files generated by servers,network devices,and even other IDSs.

____ are tools used to identify which computers are active on a network,as well as which ports and services are active on the computers,what function or role the machines may be fulfilling,and so on.

Match each statement with an item below. -Can indicate if a relationship exists between the individual alarm elements when they have specific similar attributes.

A(n)____________________ monitors traffic on a segment of an organization's network.

The term ____ refers to the level at which the IDS triggers an alert to notify the administrator.

____________________ is the process of classifying the attack alerts that an IDS detects in order to distinguish or sort false positives from actual attacks more efficiently.