Exam 8: Intrusion Detection

The broad classes of intruders are: cyber criminals,state-sponsored organizations,_________ ,and others.

The _________ (RFC 4766)document defines requirements for the Intrusion Detection Message Exchange Format (IDMEF).

The rule _______ tells Snort what to do when it finds a packet that matches the rule criteria.

Those who hack into computers do so for the thrill of it or for status.

A _________ is a security event that constitutes a security incident in which an intruder gains access to a system without having authorization to do so.

The ________ is responsible for determining if an intrusion has occurred.

A common location for a NIDS sensor is just inside the external firewall.

The IDS component responsible for collecting data is the user interface.

Intruders typically use steps from a common attack methodology.

_________ involves the collection of data relating to the behavior of legitimate users over a period of time.

Running a packet sniffer on a workstation to capture usernames and passwords is an example of intrusion.

Copying a database containing credit card numbers,viewing sensitive data without authorization,and guessing and cracking passwords are examples of _________ .

A (n)__________ is a hacker with minimal technical skill who primarily uses existing attack toolkits.

Signature-based approaches attempt to define normal,or expected, behavior,whereas anomaly approaches attempt to define proper behavior.

A ________ is a hacker with sufficient technical skills to modify and extend attack toolkits to use newly discovered vulnerabilities.

An IDS comprises three logical components: analyzers,user interface and _____.

The primary purpose of an IDS is to detect intrusions,log suspicious events,and send alerts.

A _________ monitors the characteristics of a single host and the events occurring within that host for suspicious activity.

The _________ module analyzes LAN traffic and reports the results to the central manager.

A ________ monitors network traffic for particular network segments or devices and analyzes network,transport,and application protocols to identify suspicious activity.