Exam 7: Security Technology: Intrusion Detection and Prevention Systems, and Other Security Tools

A passive vulnerability scanner is one that initiates traffic on the network in order to determine security holes.

Using __________, the system reviews the log files generated by servers, network devices, and even other IDPSs.

An IDPS can be configured to dial a phone number and produce an alphanumeric page or other type of signal or message.

A padded cell is a hardened honeynet. _________________________

Fingerprinting is the organized research of the Internet addresses owned or controlled by a target organization. _________________________

The integrity value, which is based upon fuzzy logic, helps an administrator determine how likely it is that an IDPS alert or alarm indicates an actual attack in progress. _________________________

To prevent problem behaviors by increasing the perceived risk of discovery and punishment for those who would attack or otherwise abuse the system

The ____________________ port is also known as a switched port analysis (SPAN) port or mirror port.

A false positive is the failure of an IDPS system to react to an actual attack event.

An HIDPS functions on the host system, where encrypted traffic will have been decrypted and is available for processing.

A ____________________ vulnerability scanner listens in on the network and identifies vulnerable versions of both server and client software.

Once the OS is known, all of the vulnerabilities to which a system is susceptible can easily be determined.

A fully distributed IDPS control strategy is an IDPS implementation approach in which all control functions are applied at the physical location of each IDPS component.

NIDPSs are not usually susceptible to direct attack and may not be detectable by attackers.

HIDPSs are also known as system ____________________ verifiers.

When a collection of honeypots connects several honeypot systems on a subnet, it may be called a(n) honeynet. _________________________

__________ are decoy systems designed to lure potential attackers away from critical systems.

The use of switched network protocols does not affect an HIDPS.

To assist in footprint intelligence collection, attackers may use an enhanced Web scanner that, among other things, can scan entire Web sites for valuable pieces of information, such as server names and e-mail addresses.

A(n) __________ IDPS is focused on protecting network information assets.