Chat with AIExam 6: Network Monitoring and Intrusion Detection and Prevention Systems
Match each item with a statement below.
a.Alert
f.False positive
b.Confidence
g.Filtering
c.Evasion
h.Tuning
d.Events
i.Thresholds
e.False negative
-The failure of an IDPS to react to an actual attack event.
(39) 
VerifiedE
What does the tcpdump host 192.168.1.100 command do?
(35) VerifiedA
List three disadvantages of using a honeypot approach.
(37) Verified The disadvantages of using a honeypot approach are:
The legal implications of using such devices are not well defined.
An expert attacker, once diverted into a decoy system, may become angry and launch a more hostile attack against an organization's systems.
Administrators and security managers need a high level of expertise to use these systems.
Administrators should also be wary of the wasp trap syndrome. In this syndrome, a concerned homeowner installs a wasp trap in his backyard to trap the few insects he sees flying about. Because these traps use scented bait, however, they wind up attracting far more wasps than were originally present. Security administrators should keep the wasp trap syndrome in mind before implementing honeypots.
Special care must be taken in order to ensure that a honeypot cannot be compromised in a way that could lead to further attacks on your networks or systems.
When a collection of honeypots connects several honeypot systems on a subnet, it may be called a ____.
(41) When the measured activity is outside the baseline parameters - exceeding what is called the ____ - the IDPS sends an alert to the administrator.
(28) Match each item with a statement below.
a.Alert
f.False positive
b.Confidence
g.Filtering
c.Evasion
h.Tuning
d.Events
i.Thresholds
e.False negative
-A value that sets the limit between normal and abnormal behavior.
(32) The Simple Network Management Protocol contains ____ functions, which allow a device to send a message to the SNMP management console indicating that a certain threshold has been crossed, either positively or negatively.
(29) Match each item with a statement below.
a.Alert
f.False positive
b.Confidence
g.Filtering
c.Evasion
h.Tuning
d.Events
i.Thresholds
e.False negative
-The process of adjusting an IDPS to maximize its efficiency in detecting true positives while minimizing both false positives and false negatives.
(33) Blacklists and whitelists are most commonly used in ____ detection and stateful protocol analysis.
(31) Which tcpdump option specifies the number of packets to capture?
(31) Match each item with a statement below.
a.Alert
f.False positive
b.Confidence
g.Filtering
c.Evasion
h.Tuning
d.Events
i.Thresholds
e.False negative
-An alert or alarm that occurs in the absence of an actual attack.
(33) Match each item with a statement below.
a.Alert
f.False positive
b.Confidence
g.Filtering
c.Evasion
h.Tuning
d.Events
i.Thresholds
e.False negative
-The process of reducing IDPS events in order to receive a better confidence in the alerts received.
(39) ____ applications use a combination of techniques to detect an intrusion and trace it back to its source.
(36) The first hurdle a potential IDPS must clear is functioning in your systems environment.
(35) Under the guise of justice, some less scrupulous administrators may even be tempted to ____, or hack into a hacker's system to find out as much as possible about the hacker.
(34) 
Filters
- Essay(0)
- Multiple Choice(0)
- Short Answer(0)
- True False(0)
- Matching(0)