Deck 8: Intrusion Detection

Question 1

Snort can perform intrusion prevention but not intrusion detection.

Answer 1

False

Question 2

Those who hack into computers do so for the thrill of it or for status.

Answer 2

True

Question 3

Signature-based approaches attempt to define normal,or expected,
behavior,whereas anomaly approaches attempt to define proper behavior.

Answer 3

False

Question 4

A ________ monitors network traffic for particular network segments or devices and analyzes network,transport,and application protocols to identify suspicious activity.

A)host-based IDS
B)security intrusion
C)network-based IDS
D)intrusion detection

Question 5

An inline sensor monitors a copy of network traffic; the actual traffic
does not pass through the device.

Question 6

_________ are among the most difficult to detect and prevent.

A)Organized groups of hackers
B)Insider attacks
C)Outsider attacks
D)Crackers

Question 7

An intruder can also be referred to as a hacker or cracker.

Question 8

Anomaly detection is effective against misfeasors.

Question 9

The objective of the intruder is to gain access to a system or to increase
the range of privileges accessible on a system.

Question 10

A _________ monitors the characteristics of a single host and the events occurring within that host for suspicious activity.

A)host-based IDS
B)security intrusion
C)network-based IDS
D)intrusion detection

Question 11

The ________ is responsible for determining if an intrusion has occurred.

A)analyzer
B)host
C)user interface
D)sensor

Question 12

To be of practical use an IDS should detect a substantial percentage of
intrusions while keeping the false alarm rate at an acceptable level.

Question 13

Network-based intrusion detection makes use of signature detection
and anomaly detection.

Question 14

The masquerader is most likely an insider.

Question 15

The primary purpose of an IDS is to detect intrusions,log suspicious
events,and send alerts.

Question 16

A _________ is a security event that constitutes a security incident in which an intruder gains access to a system without having authorization to do so.

A)intrusion detection
B)IDS
C)criminal enterprise
D)security intrusion

Question 17

The IDS component responsible for collecting data is the user interface.

Question 18

A common location for a NIDS sensor is just inside the external
firewall.

Question 19

Intrusion detection is based on the assumption that the behavior of the
intruder differs from that of a legitimate user in ways that can be quantified.

Question 20

Running a packet sniffer on a workstation to capture usernames and passwords is an example of intrusion.

Question 21

The _________ module analyzes LAN traffic and reports the results to the central manager.

A)LAN monitor agent
B)host agent
C)central manager agent
D)architecture agent

Question 22

_________ are cooperative ventures that collect information about system vulnerabilities and disseminate it to systems mangers.

Question 23

A(n)________ is inserted into a network segment so that the traffic that it is monitoring must pass through the sensor.

A)passive sensor
B)analysis sensor
C)LAN sensor
D)inline sensor

Question 24

A(n)________ event is an alert that is generated when the gossip traffic enables a platform to conclude that an attack is under way.

A)PEP
B)DDI
C)IDEP
D)IDME

Question 25

A ________ IDS monitors traffic at selected points on a network or interconnected set of networks.

Question 26

__________ involves an attempt to define a set of rules or attack patterns that can be used to decide if a given behavior is that of an intruder.

A)Profile based detection
B)Signature detection
C)Threshold detection
D)Anomaly detection

Question 27

__________ is a security service that monitors and analyzes system events for the purpose of finding,and providing real-time warning of attempts to access system resources in an unauthorized manner.

Question 28

The three classes of intruders are masquerader,clandestine user and _________.

Question 29

_________ involves the collection of data relating to the behavior of legitimate users over a period of time.

A)Profile based detection
B)Signature detection
C)Threshold detection
D)Anomaly detection

Question 30

The _________ detection approach involves defining thresholds,independent of user,for the frequency of occurrence of various events.

Question 31

_________ anomaly detection focuses on characterizing the past behavior of individual users or related groups of users and then detecting significant deviations.

Question 32

A ________ is a legitimate user who accesses data,programs,or resources for which such access is not authorized,or who is authorized for such access but misuses his or her privileges.

Question 33

_________ is a document that describes the application level protocol for exchanging data between intrusion detection entities.

A)RFC 4767
B)RFC 4766
C)RFC 4765
D)RFC 4764

Question 34

The rule _______ tells Snort what to do when it finds a packet that matches the rule criteria.

A)protocol
B)direction
C)action
D)destination port

Question 35

The purpose of the ________ module is to collect data on security related events on the host and transmit these to the central manager.

A)central manager agent
B)LAN monitor agent
C)host agent
D)architecture agent

Question 36

An IDS comprises three logical components: analyzers,user interface and _____.

Question 37

A ________ model is used to establish transition probabilities among various states.

A)multivariate model
B)Markov process
C)time series
D)operational model

Question 38

A distributed IDS consists of three main components: host agent module,central manager module,and ___________ module.

Question 39

The _______ is the ID component that analyzes the data collected by the sensor for signs of unauthorized or undesired activity or for events that might be of interest to the security administrator.

A)data source
B)sensor
C)operator
D)analyzer

Question 40

________ detection techniques detect intrusion by observing events in the system and applying a set of rules that lead to a decision regarding whether a given pattern of activity is or is not suspicious.

Question 41

________ are decoy systems that are designed to lure a potential attacker away from critical systems.

Question 42

A Snort installation consists of four logical components: packet decoder,detection engine,logger,and ________.

Question 43

The functional components of an _________ are: data source,sensor,analyzer,administration,manager,and operator.

Question 44

The _________ is the predefined formally documented statement that defines what activities are allowed to take place on an organization's network or on particular hosts to support the organization's requirements.

Question 45

The _________ (RFC 4766)document defines requirements for the Intrusion Detection Message Exchange Format (IDMEF).