Question 1

What does a host-based IDS monitor?

Accepted Answer

A) A single system 
B) Networks 
C) Physical intrusions into facilities 
D) A system and all its surrounding systems 
A) A single system 
B) Networks 
C) Physical intrusions into facilities 
D) A system and all its surrounding systems A

Question 2

Deploying,maintaining,and upgrading host-based IDSs in a large network is cheaper than NIDSs.

Accepted Answer

A) True 
 B)False  False

Question 3

One of the advantages of HIDS is that

Accepted Answer

A) They can reduce false-positive rates 
B) Their signatures are broader 
C) They can examine data before it has been decrypted 
D) They are inexpensive to maintain in the enterprise 
A) They can reduce false-positive rates 
B) Their signatures are broader 
C) They can examine data before it has been decrypted 
D) They are inexpensive to maintain in the enterprise A

Question 4

Network-based IDS examines activity on a system such,as a mail server or web server.

Accepted Answer

A) True 
 B)False

Question 5

According to SANS Internet Storm Center,the average survival time of an unpatched Windows PC on the Internet is

Accepted Answer

A) Less than two minutes 
B) Less than two hours 
C) Less than two days 
D) Less than two weeks 
A) Less than two minutes 
B) Less than two hours 
C) Less than two days 
D) Less than two weeks

Question 6

What are content- and context-based signatures?

Accepted Answer

Content-based signatures are generally t

Question 7

Only active intrusion detection systems (IDS)can aggressively respond to suspicious activity,whereas passive IDS cannot.

Accepted Answer

A) True 
 B)False

Question 8

A(n)_______________ server can be used to filter out undesirable traffic and prevent employees from accessing potentially hostile web sites.

Accepted Answer

The answer of A(n)_______________ server can be used to filter...

Question 9

Which of the following is NOT an advantage of network-based IDS?

Accepted Answer

A) It takes fewer systems to provide IDS coverage. 
B) They can reduce false positive rates. 
C) Development,maintenance,and upgrade costs are usually lower. 
D) Visibility into all network traffic and can correlate attacks among multiple systems. 
A) It takes fewer systems to provide IDS coverage. 
B) They can reduce false positive rates. 
C) Development,maintenance,and upgrade costs are usually lower. 
D) Visibility into all network traffic and can correlate attacks among multiple systems.

Question 10

Antivirus products do all of the following EXCEPT:

Accepted Answer

A) Automated updates 
B) Media scanning 
C) Block network traffic based on policies 
D) Scan e-mail for malicious code and attachments 
A) Automated updates 
B) Media scanning 
C) Block network traffic based on policies 
D) Scan e-mail for malicious code and attachments

Question 11

Hostile activity that does not match an IDS signature and goes undetected is called a false positive.

Accepted Answer

A) True 
 B)False

Question 12

Simple rule sets that are applied to port number and IP addresses are called

Accepted Answer

A) Network address translation 
B) Stateful packet filtering 
C) Access control lists 
D) Basic packet filtering 
A) Network address translation 
B) Stateful packet filtering 
C) Access control lists 
D) Basic packet filtering

Question 13

Which of the following is NOT a component of an IDS?

Accepted Answer

A) Traffic collector 
B) Signature database 
C) Expert knowledge database 
D) User interface and reporting 
A) Traffic collector 
B) Signature database 
C) Expert knowledge database 
D) User interface and reporting

Question 14

A new breed of IDS that is designed to identify and prevent malicious activity from harming a system.

Accepted Answer

A) Dynamic IDS 
B) Preventive IDS 
C) Active IDS 
D) HIPS 
A) Dynamic IDS 
B) Preventive IDS 
C) Active IDS 
D) HIPS

Question 15

The NIDS signature database is usually much larger than that of a host-based system.

Accepted Answer

A) True 
 B)False

Question 16

List three approaches that antispam software uses to filter out junk e-mail.

Accepted Answer

Answers can include three of the followi

Question 17

_______________ detection looks for things that are out of the ordinary,such as a user logging in when he's not supposed to,or unusually high network traffic into and out of a workstation.

Accepted Answer

The answer of _______________ detection looks for things that are...

Question 18

_______________ signatures are designed to match large patterns of activity,and examine how certain types of activity fit into the other activities going on around them.

Accepted Answer

The answer of _______________ signatures are designed to match large...

Question 19

How does stateful packet filtering differ from basic packet filtering?

Accepted Answer

A) Stateful packet filtering looks only at each packet individually. 
B) Stateful packet filtering looks at the packets in relation to other packets. 
C) Stateful packet filtering looks at the destination address. 
D) Stateful packet filtering looks at the source address. 
A) Stateful packet filtering looks only at each packet individually. 
B) Stateful packet filtering looks at the packets in relation to other packets. 
C) Stateful packet filtering looks at the destination address. 
D) Stateful packet filtering looks at the source address.

Question 20

The model that most modern intrusion detection systems use is largely based upon a model created by Dorothy Denning and Peter Neumann called:

Accepted Answer

A) Intrusion Detection Interface System (IDIS) 
B) Intrusion Response Interdiction system (IRIS) 
C) Intrusion Detection Expert System (IDES) 
D) Discovery,Haystack,Multics Intrusion Detection and Alerting System (MIDAS) 
A) Intrusion Detection Interface System (IDIS) 
B) Intrusion Response Interdiction system (IRIS) 
C) Intrusion Detection Expert System (IDES) 
D) Discovery,Haystack,Multics Intrusion Detection and Alerting System (MIDAS)

Exam 13: Intrusion Detection Systems and Network Security

What does a host-based IDS monitor?

Deploying,maintaining,and upgrading host-based IDSs in a large network is cheaper than NIDSs.

One of the advantages of HIDS is that

Network-based IDS examines activity on a system such,as a mail server or web server.

According to SANS Internet Storm Center,the average survival time of an unpatched Windows PC on the Internet is

What are content- and context-based signatures?

Only active intrusion detection systems (IDS)can aggressively respond to suspicious activity,whereas passive IDS cannot.

A(n)_______________ server can be used to filter out undesirable traffic and prevent employees from accessing potentially hostile web sites.

Which of the following is NOT an advantage of network-based IDS?

Antivirus products do all of the following EXCEPT:

Hostile activity that does not match an IDS signature and goes undetected is called a false positive.

Simple rule sets that are applied to port number and IP addresses are called

Which of the following is NOT a component of an IDS?

A new breed of IDS that is designed to identify and prevent malicious activity from harming a system.

The NIDS signature database is usually much larger than that of a host-based system.

List three approaches that antispam software uses to filter out junk e-mail.

_______________ detection looks for things that are out of the ordinary,such as a user logging in when he's not supposed to,or unusually high network traffic into and out of a workstation.

_______________ signatures are designed to match large patterns of activity,and examine how certain types of activity fit into the other activities going on around them.

How does stateful packet filtering differ from basic packet filtering?

The model that most modern intrusion detection systems use is largely based upon a model created by Dorothy Denning and Peter Neumann called:

Introduction and Security Trends

General Security Concepts

Operational-Organizational Security

The Role of People in Security

Cryptography

Public Key Infrastructure

Standards and Protocols

Physical Security

Network Fundamentals

Infrastructure Security

Authentication and Remote Access

Wireless

Baselines

Types of Attacks and Malicious Software

E-Mail and Instant Messaging

Web Components

Secure Software Development

Disaster Recovery, Business Continuity, and Organizational Policies

Risk Management

Change Management

Privilege Management

Computer Forensics

Legal Issues and Ethics

Privacy

Filters