Exam 8: Intrusion Detection

The masquerader is most likely an insider.

A common location for a NIDS sensor is just inside the external firewall.

Those who hack into computers do so for the thrill of it or for status.

The purpose of the ________ module is to collect data on security related events on the host and transmit these to the central manager.

A Snort installation consists of four logical components: packet decoder,detection engine,logger,and ________.

An inline sensor monitors a copy of network traffic; the actual traffic does not pass through the device.

The _________ module analyzes LAN traffic and reports the results to the central manager.

A ________ IDS monitors traffic at selected points on a network or interconnected set of networks.

Intrusion detection is based on the assumption that the behavior of the intruder differs from that of a legitimate user in ways that can be quantified.

_________ are among the most difficult to detect and prevent.

The _________ detection approach involves defining thresholds,independent of user,for the frequency of occurrence of various events.

The primary purpose of an IDS is to detect intrusions,log suspicious events,and send alerts.

A ________ monitors network traffic for particular network segments or devices and analyzes network,transport,and application protocols to identify suspicious activity.

The rule _______ tells Snort what to do when it finds a packet that matches the rule criteria.

To be of practical use an IDS should detect a substantial percentage of intrusions while keeping the false alarm rate at an acceptable level.

________ are decoy systems that are designed to lure a potential attacker away from critical systems.

_________ is a document that describes the application level protocol for exchanging data between intrusion detection entities.

Signature-based approaches attempt to define normal,or expected, behavior,whereas anomaly approaches attempt to define proper behavior.

An IDS comprises three logical components: analyzers,user interface and _____.

Anomaly detection is effective against misfeasors.