Exam 4: Incident Response: Detection and Decision Making

What are honeypots? Briefly describe each of the two general types.

The term ____ refers to the level at which the IDS triggers an alert to notify the administrator.

The Electronic Communications Protection Act prohibits the recording of wire- or cable-based communications unless an exception applies.Briefly discuss four of these exceptions.

A ____ is a high-interaction honeypot designed to capture extensive information on threats.

Match each statement with an item below. -Triggers an alert or alarm when one of the following changes occurs: file attributes change,new files are created,or existing files are deleted.

____ is an IDS's ability to dynamically modify its site policies in reaction or response to environmental activity.

What are the advantages and disadvantages of NIDS?

_________________________ is the process of evaluating circumstances around organizational events,determining which events are possible incidents,or incident candidates,and then determining whether or not the event constitutes an actual incident.

A ____ is a type of IDS that is similar to the NIDS,reviews the log files generated by servers,network devices,and even other IDSs.