Exam 4: Incident Response: Detection and Decision Making

A(n)____ is an event that triggers alarms and causes a false positive when no actual attacks are in progress.

A(n)____ is designed to be placed in a network to determine whether or not the network is being used in ways that are out of compliance with the policy of the organization.

What are the advantages and disadvantages of HIDS?

According to Pipkin,what are the four types of incident candidates that are probable indicators of actual incidents? Provide a brief description of each incident candidate.

Match each statement with an item below. -Network burglar alarm.

Match each statement with an item below. -The action of luring an individual into committing a crime to get a conviction.

____ are also known as system integrity verifiers.

____ is an ongoing activity from alarm events that are accurate and noteworthy but not necessarily significant as potentially successful attacks.

The failure of an IDS system to react to an actual attack event is known as a ____.

Match each statement with an item below. -The process of attracting attention to a system by placing tantalizing bits of information in key locations.

Using a process known as ____,Network IDSs must look for attack patterns by comparing measured activity to known signatures in their knowledge base to determine whether or not an attack has occurred or may be underway.

The purpose of a NIDS is to look for patterns within network traffic that indicate an intrusion event is underway or about to begin.

Match each statement with an item below. -Can indicate if a relationship exists between the individual alarm elements when they have specific similar attributes.

A ____ is an alarm or alert that indicates that an attack is in progress or that an attack has successfully occurred when in fact there was no such attack.

Briefly describe the tasks involved in managing logs.

Discuss two weaknesses of the signature-based IDS technology.

What are the steps involved in monitoring networks for signs of intrusion?

The term ____ refers to an event that triggers alarms and causes an IDS to react as if a real attack is in progress.

When placed next to a hub,switch,or other key networking device,the NIDS may use that device's monitoring port,also known as a(n)____ port or mirror port.

List five reasons why you would acquire and use an IDS.