Deck 6: Network Monitoring and Intrusion Detection and Prevention Systems

Question 1

Which tcpdump option specifies the number of packets to capture?

A) -i
C) -p
B) -c
D) -n

Answer 1

B

Question 2

In ____, valid packets exploit poorly configured DNS servers to inject false information to corrupt the servers' answers to routine DNS queries from other systems on the network.

A) DNS cache poisoning
C) denial-of-service (DoS) attacks
B) Tiny Fragment Packet attacks
D) man-in-the-middle attacks

Answer 2

A

Question 3

The first hurdle a potential IDPS must clear is functioning in your systems environment.

Answer 3

True

Question 4

What does the tcpdump host 192.168.1.100 command do?

A) It only captures traffic originating from and destined to 192.168.1.100.
B) It only captures traffic originating from 192.168.1.100.
C) It only captures traffic destined to 192.168.1.100.
D) It only captures traffic destined to the default host 192.168.1.1.

Question 5

Deploying and implementing an IDPS is always a straightforward task.

Question 6

The tcpdump tool will output both the header and packet contents into ____ format.

A) binary
C) ASCII
B) hex
D) EBCDIC

Question 7

The size of a signature base is a good measure of an IDPS's effectiveness.

Question 8

A ____ resides on a computer or appliance connected to a segment of an organization's network and monitors network traffic on that network segment - much like tcpdump - looking for indications of ongoing or successful attacks.

A) network-based IDPS (NIDPS)
B) host-based IDPS (HIDPS)
C) wireless IDPS
D) network behavior analysis (NBA) system

Question 9

Most NBA sensors can be deployed in ____ mode only, using the same connection methods (e.g., network tap, switch spanning port) as network-based IDPSs.

A) simple
C) active
B) aggressive
D) passive

Question 10

By default, tcpdump will just print ____ information.

A) source
C) packet header
B) destination
D) packet contents

Question 11

Because of its ubiquity in UNIX/Linux systems, ____ has become the de facto standard in network sniffing.

A) ICMP
C) tcpdump
B) LaBrea
D) snort

Question 12

Wireless sensors are most effective when their ____ overlap.

A) thresholds
C) footprints
B) signatures
D) keys

Question 13

Signature-based IDPS technology is widely used because many attacks have clear and distinct signatures.

Question 14

In ____ verification, the higher-order protocols (HTTP, FTP, Telnet) are examined for unexpected packet behavior or improper use.

A) application stack
C) protocol stack
B) application protocol
D) protocol behavior

Question 15

A signature-based IDPS examines network traffic in search of patterns that match known ____.

A) keys
C) signatures
B) addresses
D) phrases

Question 16

One of the best reasons to install a(n) ____ is to provide an organization with overall situational awareness - or a better overall understanding - of the activities that take place on the network.

A) router
C) firewall
B) IDPS
D) VPN

Question 17

When the measured activity is outside the baseline parameters - exceeding what is called the ____ - the IDPS sends an alert to the administrator.

A) baseline
C) radius
B) clipping level
D) sensor range

Question 18

The Simple Network Management Protocol contains ____ functions, which allow a device to send a message to the SNMP management console indicating that a certain threshold has been crossed, either positively or negatively.

A) log
C) evidentiary packet dump
B) trap
D) e-mail message

Question 19

Intrusion ____ consists of activities that deter an intrusion.

A) detection
C) response
B) prevention
D) alert

Question 20

A sniffer can decipher encrypted traffic.

Question 21

Under the guise of justice, some less scrupulous administrators may even be tempted to ____, or hack into a hacker's system to find out as much as possible about the hacker.

A) reverse hack
C) white hack
B) back hack
D) transpose

Question 22

Match each item with a statement below.
a.Alert
f.False positive
b.Confidence
g.Filtering
c.Evasion
h.Tuning
d.Events
i.Thresholds
e.False negative
A value placed on an IDPS event's ability to correctly detect and identify certain types of attacks.

Question 23

Match each item with a statement below.
a.Alert
f.False positive
b.Confidence
g.Filtering
c.Evasion
h.Tuning
d.Events
i.Thresholds
e.False negative
The failure of an IDPS to react to an actual attack event.

Question 24

____________________ are decoy systems designed to lure potential attackers away from critical systems.

Question 25

Match each item with a statement below.
a.Alert
f.False positive
b.Confidence
g.Filtering
c.Evasion
h.Tuning
d.Events
i.Thresholds
e.False negative
An indication that a system has detected a possible attack.

Question 26

Match each item with a statement below.
a.Alert
f.False positive
b.Confidence
g.Filtering
c.Evasion
h.Tuning
d.Events
i.Thresholds
e.False negative
IDPS events that are accurate and noteworthy but do not pose a significant threat to information security.

Question 27

One tool that provides active intrusion prevention is known as ____.

A) tcpdump
C) Vigenère cipher
B) ICMP
D) LaBrea

Question 28

Match each item with a statement below.
a.Alert
f.False positive
b.Confidence
g.Filtering
c.Evasion
h.Tuning
d.Events
i.Thresholds
e.False negative
The process of reducing IDPS events in order to receive a better confidence in the alerts received.

Question 29

Match each item with a statement below.
a.Alert
f.False positive
b.Confidence
g.Filtering
c.Evasion
h.Tuning
d.Events
i.Thresholds
e.False negative
The process by which an attacker changes the format of the network packets and/or timing of their activities to avoid being detected by the IDPS.

Question 30

The ____________________ port, also known as a switched port analysis (SPAN) port or mirror port, is a specially configured connection on a network device that is capable of viewing all the traffic that moves through the entire device.

Question 31

According to SP 800-94, ____________________ (SPA) is a process of comparing predetermined profiles of generally accepted definitions of benign activity for each protocol state against observed events to identify deviations.

Question 32

A ____ is a list of discrete entities that are known to be benign.

A) blacklist
C) whitelist
B) hot list
D) clean list

Question 33

Match each item with a statement below.
a.Alert
f.False positive
b.Confidence
g.Filtering
c.Evasion
h.Tuning
d.Events
i.Thresholds
e.False negative
A value that sets the limit between normal and abnormal behavior.

Question 34

____ applications use a combination of techniques to detect an intrusion and trace it back to its source.

A) Trap-and-trace applications
C) Behavior-based
B) Honeynet
D) Statistical anomaly-based

Question 35

____________________ sensors are typically intended for network perimeter use, so they would be deployed in close proximity to the perimeter firewalls, often between the firewall and the Internet border router to limit incoming attacks that could overwhelm the firewall.

Question 36

Match each item with a statement below.
a.Alert
f.False positive
b.Confidence
g.Filtering
c.Evasion
h.Tuning
d.Events
i.Thresholds
e.False negative
An alert or alarm that occurs in the absence of an actual attack.

Question 37

Blacklists and whitelists are most commonly used in ____ detection and stateful protocol analysis.

A) blacklist
C) statistical anomaly-based
B) signature-based
D) behavior-based

Question 38

Match each item with a statement below.
a.Alert
f.False positive
b.Confidence
g.Filtering
c.Evasion
h.Tuning
d.Events
i.Thresholds
e.False negative
The process of adjusting an IDPS to maximize its efficiency in detecting true positives while minimizing both false positives and false negatives.

Question 39

A(n) ____________________ occurs when an attacker attempts to gain entry or disrupt the normal operations of an information system, almost always with the intent to do harm.

Question 40

When a collection of honeypots connects several honeypot systems on a subnet, it may be called a ____.

A) nest
C) honeynet
B) web
D) tunnel

Question 41

List three disadvantages of using a honeypot approach.

Question 42

List five strengths of IDPSs.

Question 43

Describe an incident response.

Question 44

Define enticement and entrapment and compare the two.

Question 45

Explain the focus of a network-based IDPS and describe the specialized subtypes of network-based IDPSs.

Question 46

List four problems a wireless IDPS can help detect.

Question 47

Describe the response behavior of IDPSs.

Question 48

Define and describe a fully distributed IDPS control strategy.

Question 49

List three advantages of operational NIDPSs.

Question 50

Describe three factors that can delay or undermine an organization's ability to make its systems safe from attack and subsequent loss.