Exam 7: Security Technology: Intrusion Detection and Prevention Systems, and Other Security Tools

__________ is the action of luring an individual into committing a crime to get a conviction.

A(n) event is an indication that a system has just been attacked or is under attack. _________________________

NIDPSs can reliably ascertain whether an attack was successful.

Intrusion detection and prevention systems can deal effectively with switched networks.

When the measured activity is outside the baseline parameters, it is said to exceed the ____________________ level.

HIDPSs are also known as system integrity verifiers.

Which of the following is NOT a described IDPS control strategy?

All IDPS vendors target users with the same levels of technical and security expertise.

A(n) port is the equivalent of a network channel or connection point in a data communications system. _________________________

A(n) __________ is a software program or hardware appliance that can intercept, copy, and interpret network traffic.

Alarm events that are accurate and noteworthy but do not pose significant threats to information security are called noise. _________________________

List and describe the four advantages of HIDPSs.

An HIDPS can detect inconsistencies in how applications and systems programs were used by examining the records stored in audit logs. This can enable it to detect some types of attacks, including Trojan horse programs.

The activities that gather public information about the organization and its network activities and assets is called fingerprinting. _________________________

When a collection of honeypots connects several honeypot systems on a subnet, it may be called a(n) ____________________.

____________________ is the process of attracting attention to a system by placing tantalizing bits of information in key locations.

Port explorers are tools used both by attackers and defenders to identify (or fingerprint) the computers that are active on a network, as well as the ports and services active on those computers, the functions and roles the machines are fulfilling, and other useful information. _________________________

__________ are usually passive devices and can be deployed into existing networks with little or no disruption to normal network operations.

For Linux or BSD systems, a tool called "Snow White" allows a remote individual to "mirror" entire Web sites. _________________________

Intrusion detection and prevention systems perform monitoring and analysis of system events and user behaviors.