Question 1

Services using the TCP/IP protocol can run only on their commonly used port number as specified in their original Internet standard.

Accepted Answer

While services often have a default port number specified in their Internet standard, they can still run on other port numbers if configured to do so. This is commonly done as a security measure to avoid detection by attackers who may scan for common port numbers associated with specific services.

Question 2

Security tools that go beyond routine intrusion detection include honeypots, honeynets, and padded cell systems.

Accepted Answer

Honeypots, honeynets, and padded cell systems are considered advanced security tools that go beyond routine intrusion detection. Honeypots simulate vulnerable systems to attract and track attackers, honeynets are networks of honeypots that work together to gather information, and padded cell systems isolate malware to prevent it from spreading.

Question 3

A strategy based on the concept of defense in depth is likely to include intrusion detection systems, active vulnerability scanners, passive vulnerability scanners, automated log analyzers, and protocol analyzers.

Accepted Answer

Defense in depth strategy involves deploying multiple layers of defense measures to protect against cyber attacks. Intrusion detection systems, active and passive vulnerability scanners, automated log analyzers, and protocol analyzers all contribute to different layers of defense to make the overall security posture more robust.

Question 4

Once the OS is known, all of the vulnerabilities to which a system is susceptible can easily be determined.

Accepted Answer

The OS is the core software that manages the hardware and software resources of a computer. It is responsible for providing a stable and secure environment for applications to run. By knowing the OS, it is possible to determine the vulnerabilities to which a system is susceptible. This is because the OS is the target of many attacks, and its vulnerabilities are well-known.

Question 5

In the process of protocol application verification, the NIDPSs look for invalid data packets. _________________________

Accepted Answer

stack

Question 6

To assist in footprint intelligence collection, attackers may use an enhanced Web scanner that, among other things, can scan entire Web sites for valuable pieces of information, such as server names and e-mail addresses.

Accepted Answer

This statement is true as an enhanced Web scanner can indeed scan entire websites for valuable information such as server names and e-mail addresses to assist in footprint intelligence collection.

Question 7

Preconfigured, predetermined attack patterns are called signatures. _________________________

Accepted Answer

Signatures are preconfigured, predetermined attack patterns used to identify and protect against known threats.

Question 8

Alarm events that are accurate and noteworthy but do not pose significant threats to information security are called noise. _________________________

Accepted Answer

This statement is true. Noise refers to alarm events that are accurate, but do not pose significant threats to information security. These events may include legitimate user activities, such as accessing a commonly used file, or minor system errors that do not affect overall security. Identifying and filtering out noise is important in maintaining the efficiency and effectiveness of a security monitoring system.

Question 9

Administrators who are wary of using the same tools that attackers use should remember that a tool that can help close an open or poorly configured firewall will not help the network defender minimize the risk from attack.

Accepted Answer

The statement is incorrect. Tools used by attackers can also be used by network defenders to identify and address vulnerabilities and improve overall security. It is important for administrators to have knowledge of the same tools and techniques that attackers use in order to effectively protect their networks.

Question 10

The process of entrapment occurs when an attacker changes the format and/or timing of activities to avoid being detected by an IDPS. _________________________

Accepted Answer

evasion

Question 11

The activities that gather public information about the organization and its network activities and assets is called fingerprinting. _________________________

Accepted Answer

footprinting

Question 12

A(n) known vulnerability is a published weakness or fault in an information asset or its protective systems that may be exploited and result in loss. _________________________

Accepted Answer

A known vulnerability refers to a weakness that has been publicly documented and disclosed to the public or a specific group of individuals. It can be exploited by attackers to gain unauthorized access or cause damage to the system or network.

Question 13

A passive vulnerability scanner is one that initiates traffic on the network in order to determine security holes.

Accepted Answer

A passive vulnerability scanner does not initiate traffic on the network. It observes network traffic and analyzes it to find vulnerabilities without actively sending packets or connections.

Question 14

A(n) NIDPS functions on the host system, where encrypted traffic will have been decrypted and is available for processing. _________________________

Accepted Answer

HIDPS

Question 15

The Metasploit Framework is a collection of exploits coupled with an interface that allows the penetration tester to automate the custom exploitation of vulnerable systems.

Accepted Answer

This statement accurately describes the purpose and functionality of the Metasploit Framework.

Question 16

A(n) server-based IDPS protects the server or host's information assets. _________________________

Accepted Answer

host-based

Question 17

A(n) event is an indication that a system has just been attacked or is under attack. _________________________

Accepted Answer

alert, alarm

Question 18

The integrity value, which is based upon fuzzy logic, helps an administrator determine how likely it is that an IDPS alert or alarm indicates an actual attack in progress. _________________________

Accepted Answer

confidence

Question 19

Passive scanners are advantageous in that they require vulnerability analysts to get approval prior to testing.

Accepted Answer

Passive scanners do not require approval or permission from the system owner or network administrator to test for vulnerabilities because they do not actively interact with the system or network. They simply gather information that is publicly available.

Question 20

Alarm filtering may be based on combinations of frequency, similarity in attack signature, similarity in attack target, or other criteria that are defined by the system administrators. _________________________

Accepted Answer

clustering

Quiz 7: Security Technology: Intrusion Detection and Prevention Systems, and Other Security Tools