Question 1

Which type of intrusion detection focuses on monitoring network traffic associated with a specific network segment?

Accepted Answer

A)  Host-based 
B)  System-based 
C)  Network-based 
D)  LAN-based 
A)  Host-based 
B)  System-based 
C)  Network-based 
D)  LAN-based

Question 2

In the event log, what type of event is indicated with a white "x" that appears inside a red circle?

Accepted Answer

A)  Information 
B)  Warning 
C)  Standby 
D)  Error 
A)  Information 
B)  Warning 
C)  Standby 
D)  Error

Question 3

List four third-party active intrusion-detection tools.

Accepted Answer

Any four of the following:
1. Entercept:

Question 4

Which active intrusion-detection tool is a distributed system that works on servers and clients and denies application requests that are not permitted, on the basis of a security policy applying to the servers and clients?

Accepted Answer

A)  Entercept 
B)  AppShield 
C)  SecureHost 
D)  Storm Watch 
A)  Entercept 
B)  AppShield 
C)  SecureHost 
D)  Storm Watch

Question 5

Which event log records events that are associated with Active Directory?

Accepted Answer

A)  Active Directory 
B)  Directory Service 
C)  System 
D)  None of the above 
A)  Active Directory 
B)  Directory Service 
C)  System 
D)  None of the above

Question 6

Can Network Monitor filter frames and packets on the basis of SAP or ETYPE?

Accepted Answer

A) True 
 B)False

Question 7

List five third-party passive intrusion-detection tools.

Accepted Answer

Any five of the following:
1. klaxon: De

Question 8

Active intrusion detection is effective as long as the server or network administrator regularly checks the logs and recorded information for possible intrusion attempts.

Accepted Answer

A) True 
 B)False

Question 9

If a network administrator wants to use host-based intrusion detection, which devices in the figure above would need to be configured?

Accepted Answer

A)  Only the workstations 
B)  Only the servers 
C)  All workstations and servers 
D)  None of the workstations or servers 
A)  Only the workstations 
B)  Only the servers 
C)  All workstations and servers 
D)  None of the workstations or servers

Question 10

What two purposes does a honeypot serve for an organization?

Accepted Answer

1. Draws attackers away from c

Question 11

Network Monitor is a utility which comes with Windows 2000 Server and Windows Server 2003.

Accepted Answer

A) True 
 B)False

Question 12

The default folder for saved Network Monitor capture information in Windows Server 2003 is \WINNT\system32\NETMON\CAPTURES .

Accepted Answer

A) True 
 B)False

Question 13

Network-based intrusion-detection software is categorized as host wrappers or host-based agents.

Accepted Answer

A) True 
 B)False

Question 14

A(n) ____________________ can be acquired by using performance monitoring to establish slow, average, and peak periods for a network, and keeping records on these periods.

Accepted Answer

The answer of A(n) ____________________ can be acquired by using...

Question 15

At minimum, ____________________ intrusion detection alerts a server or network administrator about an attack or intrusion, so the administrator can take action.

Accepted Answer

The answer of At minimum, ____________________ intrusion detection alerts a...

Question 16

Can the version of Network Monitor that comes with Windows Server 2003 capture and read the contents of any frames transported on the network segment to which the host computer is connected?

Accepted Answer

A) True 
 B)False

Question 17

In Netware, in which directory are the Access log and the Error log kept?

Accepted Answer

A)  SYS:NOVONYX\SUITESPOT\ADMIN-SERV\LOGS\ 
B)  SYS:ETC\ 
C)  SYS:VAR\ 
D)  SYS:NOVONYX\SUITESPOT\LOGS\ 
A)  SYS:NOVONYX\SUITESPOT\ADMIN-SERV\LOGS\ 
B)  SYS:ETC\ 
C)  SYS:VAR\ 
D)  SYS:NOVONYX\SUITESPOT\LOGS\

Question 18

Which passive intrusion-detection tool monitors network activity and includes a proprietary programming language to customize the way it captures and analyzes information?

Accepted Answer

A)  klaxon 
B)  Real Secure 
C)  Dragon Squire 
D)  Network Flight Recorder 
A)  klaxon 
B)  Real Secure 
C)  Dragon Squire 
D)  Network Flight Recorder

Question 19

Are the Mac OS X logs located in the /var/log directory?

Accepted Answer

A) True 
 B)False

Question 20

Is the System Log in Mac OS X contained in the file messages.x?

Accepted Answer

A) True 
 B)False

Which type of intrusion detection focuses on monitoring network traffic associated with a specific network segment?

In the event log, what type of event is indicated with a white "x" that appears inside a red circle?

List four third-party active intrusion-detection tools.

Which active intrusion-detection tool is a distributed system that works on servers and clients and denies application requests that are not permitted, on the basis of a security policy applying to the servers and clients?

Which event log records events that are associated with Active Directory?

Can Network Monitor filter frames and packets on the basis of SAP or ETYPE?

List five third-party passive intrusion-detection tools.

Active intrusion detection is effective as long as the server or network administrator regularly checks the logs and recorded information for possible intrusion attempts.

If a network administrator wants to use host-based intrusion detection, which devices in the figure above would need to be configured?

What two purposes does a honeypot serve for an organization?

Network Monitor is a utility which comes with Windows 2000 Server and Windows Server 2003.

The default folder for saved Network Monitor capture information in Windows Server 2003 is \WINNT\system32\NETMON\CAPTURES .

Network-based intrusion-detection software is categorized as host wrappers or host-based agents.

A(n) ____________________ can be acquired by using performance monitoring to establish slow, average, and peak periods for a network, and keeping records on these periods.

At minimum, ____________________ intrusion detection alerts a server or network administrator about an attack or intrusion, so the administrator can take action.

Can the version of Network Monitor that comes with Windows Server 2003 capture and read the contents of any frames transported on the network segment to which the host computer is connected?

In Netware, in which directory are the Access log and the Error log kept?

Which passive intrusion-detection tool monitors network activity and includes a proprietary programming language to customize the way it captures and analyzes information?

Are the Mac OS X logs located in the /var/log directory?

Is the System Log in Mac OS X contained in the file messages.x?

Operating Systems Security: Keeping Computers and Networks Secure

Viruses, Worms, and Malicious Software

Security Through Authentication and Encryption

Account-Based Security

File, Directory, and Shared Resource Security

Firewalls and Border Security

Physical and Network Topology Security

Wireless Security

Web, Remote Access, and VPN Security

E-Mail Security

Security Through Disaster Recovery

Filters

Exam 12: Security Through Monitoring and Auditing

Which type of intrusion detection focuses on monitoring network traffic associated with a specific network segment?

In the event log, what type of event is indicated with a white "x" that appears inside a red circle?

List four third-party active intrusion-detection tools.

Which active intrusion-detection tool is a distributed system that works on servers and clients and denies application requests that are not permitted, on the basis of a security policy applying to the servers and clients?

Which event log records events that are associated with Active Directory?

Can Network Monitor filter frames and packets on the basis of SAP or ETYPE?

List five third-party passive intrusion-detection tools.

Active intrusion detection is effective as long as the server or network administrator regularly checks the logs and recorded information for possible intrusion attempts.

If a network administrator wants to use host-based intrusion detection, which devices in the figure above would need to be configured?

What two purposes does a honeypot serve for an organization?

Network Monitor is a utility which comes with Windows 2000 Server and Windows Server 2003.

The default folder for saved Network Monitor capture information in Windows Server 2003 is \WINNT\system32\NETMON\CAPTURES .

Network-based intrusion-detection software is categorized as host wrappers or host-based agents.

A(n) ____________________ can be acquired by using performance monitoring to establish slow, average, and peak periods for a network, and keeping records on these periods.

At minimum, ____________________ intrusion detection alerts a server or network administrator about an attack or intrusion, so the administrator can take action.

Can the version of Network Monitor that comes with Windows Server 2003 capture and read the contents of any frames transported on the network segment to which the host computer is connected?

In Netware, in which directory are the Access log and the Error log kept?

Which passive intrusion-detection tool monitors network activity and includes a proprietary programming language to customize the way it captures and analyzes information?

Are the Mac OS X logs located in the /var/log directory?

Is the System Log in Mac OS X contained in the file messages.x?

Operating Systems Security: Keeping Computers and Networks Secure

Viruses, Worms, and Malicious Software

Security Through Authentication and Encryption

Account-Based Security

File, Directory, and Shared Resource Security

Firewalls and Border Security

Physical and Network Topology Security

Wireless Security

Web, Remote Access, and VPN Security

E-Mail Security

Security Through Disaster Recovery

Filters