Exam 8: Intrusion Detection

The broad classes of intruders are: cyber criminals, state-sponsored organizations, _________ , and others.

An inline sensor monitors a copy of network traffic; the actual trafficdoes not pass through the device.

Snort can perform intrusion prevention but not intrusion detection.

__________ is a security service that monitors and analyzes system events for the purpose of finding, and providing real-time warning of attempts to access system resources in an unauthorized manner.

Those who hack into computers do so for the thrill of it or for status.

Signature-based approaches attempt to define normal, or expected,behavior, whereas anomaly approaches attempt to define proper behavior.

_________ involves the collection of data relating to the behavior of legitimate users over a period of time.

A _________ monitors the characteristics of a single host and the events occurring within that host for suspicious activity.

Intruders typically use steps from a common attack methodology.

________ are decoy systems that are designed to lure a potential attacker away from critical systems.

The primary purpose of an IDS is to detect intrusions, log suspiciousevents, and send alerts.

Intrusion detection is based on the assumption that the behavior of theintruder differs from that of a legitimate user in ways that can be quantified.

Network-based intrusion detection makes use of signature detectionand anomaly detection.

The purpose of the ________ module is to collect data on security related events on the host and transmit these to the central manager.

Running a packet sniffer on a workstation to capture usernames and passwords is an example of intrusion.

The IDS component responsible for collecting data is the user interface.

_________ is a document that describes the application level protocol for exchanging data between intrusion detection entities.

The _________ module analyzes LAN traffic and reports the results to the central manager.

An intruder can also be referred to as a hacker or cracker.

A(n) ________ is inserted into a network segment so that the traffic that it is monitoring must pass through the sensor.