Exam 6: Network Monitoring and Intrusion Detection and Prevention Systems

The ____________________ port, also known as a switched port analysis (SPAN) port or mirror port, is a specially configured connection on a network device that is capable of viewing all the traffic that moves through the entire device.

One of the best reasons to install a(n) ____ is to provide an organization with overall situational awareness - or a better overall understanding - of the activities that take place on the network.

The tcpdump tool will output both the header and packet contents into ____ format.

Because of its ubiquity in UNIX/Linux systems, ____ has become the de facto standard in network sniffing.

Describe three factors that can delay or undermine an organization's ability to make its systems safe from attack and subsequent loss.

A signature-based IDPS examines network traffic in search of patterns that match known ____.

Deploying and implementing an IDPS is always a straightforward task.

In ____, valid packets exploit poorly configured DNS servers to inject false information to corrupt the servers' answers to routine DNS queries from other systems on the network.

A(n) ____________________ occurs when an attacker attempts to gain entry or disrupt the normal operations of an information system, almost always with the intent to do harm.

Match each item with a statement below. a.Alert f.False positive b.Confidence g.Filtering c.Evasion h.Tuning d.Events i.Thresholds e.False negative -IDPS events that are accurate and noteworthy but do not pose a significant threat to information security.

Intrusion ____ consists of activities that deter an intrusion.

The size of a signature base is a good measure of an IDPS's effectiveness.

Match each item with a statement below. a.Alert f.False positive b.Confidence g.Filtering c.Evasion h.Tuning d.Events i.Thresholds e.False negative -The process by which an attacker changes the format of the network packets and/or timing of their activities to avoid being detected by the IDPS.

Most NBA sensors can be deployed in ____ mode only, using the same connection methods (e.g., network tap, switch spanning port) as network-based IDPSs.

____________________ are decoy systems designed to lure potential attackers away from critical systems.

Describe an incident response.

In ____ verification, the higher-order protocols (HTTP, FTP, Telnet) are examined for unexpected packet behavior or improper use.

Signature-based IDPS technology is widely used because many attacks have clear and distinct signatures.

Explain the focus of a network-based IDPS and describe the specialized subtypes of network-based IDPSs.

A ____ is a list of discrete entities that are known to be benign.