When evaluating possible NIDS, you are concerned that an attacker might detect the present of
Your monitoring agent. Which if the following techniques can be used to hide the NIDS? (Choose two)
A) NIDS will not respond to scans by default, detection is not possible
B) Set the IP address of the tap to be the same as the gateway
C) Have two NICS, and make sure the tap is not bound to the IP stack
D) Use a receive only cable on the tap

Question

Quizplus · Accepted Answer

A receive only cable prevents the NIC from responding in any way to a scan. The next best thing is to make sure that no protocol stacks are bound to the interface.

When Evaluating Possible NIDS, You Are Concerned That an Attacker