Untitled Presentation

Multiple Choice

Which type of IDS system uses a predetermined set of rules or signatures to detect known malicious activity?

• Anomaly-based system

• Protocol-based system

• Signature-based system

• Behavior-based system

Multiple Choice

What triggers an alert in a SIEM system?

• All data received

• Data matching a known virus signature

• Data exceeding an established threshold

• Unauthorized access attempts

Multiple Choice

What is the purpose of NIPS/NIDS in network monitoring?

• To monitor asset conditions

• To detect and prevent network intrusions

• To manage network performance

• To analyze network traffic

Multiple Choice

What are the classifications of intrusion mentioned in the text?

• Attempted Break-ins

• Masquerade attacks

• Denial of Service

• Malicious Use

Multiple Choice

How does an Intrusion Detection System (IDS) differ from an Intrusion Prevention System (IPS)?

• An IDS detects and alerts on potential intrusions, while an IPS can actively block or prevent them.

• An IDS operates on the network layer, while an IPS operates on the application layer.

• An IDS is used for physical security breaches, while an IPS is used for digital security breaches.

• There is no difference; IDS and IPS are interchangeable terms.

Multiple Choice

What is a firewall and how does it enhance security?

• A firewall enhances security by encrypting all network traffic.

• A firewall enhances security by slowing down network performance.

• A firewall enhances security by monitoring and controlling network traffic based on security rules, acting as a barrier between trusted and untrusted networks.

• A firewall enhances security by allowing all network traffic without any restrictions.

Multiple Choice

A(n) ______________ _____________ ____________ detects anomalies with the aim of

catching hackers before they do real damage to a network.

• Spam Filter (SF)
• Antivirus Software (AS)
• Intrusion Detection System (IDS)
• Firewall System (FS)

Multiple Choice

What are the limitations of a firewall compared to an IDS?

• Firewalls can detect all security breaches

• Firewalls inspect all traffic content

• Firewalls are less likely to be attacked than IDS

• Firewalls cannot detect security breaches associated with traffic that does not pass through it

Multiple Choice

What is the primary goal of intrusion detection systems (IDS)?

• To block all network traffic

• To inspect all network activity and identify suspicious patterns

• To monitor only outbound traffic

• To prevent all system attacks

Multiple Choice

What are the main functions of an Intrusion Detection System as depicted in the diagram?

• Monitor

• Respond

• Report

• Analyze

Multiple Select

What are the two main functions of an Intrusion Detection System (IDS) as described in the text?

• Monitor

• Report

• Analyze

• Detect

Multiple Choice

What is the purpose of ID in reducing security risks?

• To initiate mitigation activities

• To provide risk-related information

• To deal with incidents

• To monitor security risks

Multiple Choice

What are the two approaches to Intrusion Detection mentioned in the image?

• Preemptory

• Reactionary

• Proactive

• Passive

Multiple Choice

What are the main functions of a Network-Based Intrusion Detection System (IDS)?

• Monitoring network activity

• Capturing packet headers

• Comparing patterns with threats

• Sending email notifications

Multiple Choice

What are the tools used in Host-based IDS?

• Swatch

• Log check

• Mod_security

• Tripwire

Multiple Choice

What is the difference between Rule Based / Misuse detection and Anomaly detection in network security?

• Rule Based detection is faster

• Anomaly detection can identify new attacks

• Rule Based detection requires less data

• Anomaly detection is less accurate

Multiple Choice

Which IDS method searches for intrusion or attack attempts by recognizing patterns or identifying entities listed in a database?

• Anomaly-analysis-based IDS

• Heuristics-based IDS

• Stateful-inspection-based IDS

• Signature-based IDS

Multiple Choice

What is the MOST common form of host-based IDS that employs signature or pattern-matching detection methods?

• Anti-Virus

  software

• Motion Detectors

• Firewall

• Honeypots

Multiple Choice

____________ is an unusual activity in a group of otherwise normal activities.

• Anomaly

• Iteration

• Parameter

• Precision

Multiple Choice

What are the two types of response mentioned in the image?

• Active

• Passive

• Reactive

• Proactive

Multiple Choice

What is a threshold in the context of normal activity?

• A value that represents the boundary of normal activity

• A maximum number of attempts allowed

• A type of network activity

• A measure of file I/O activity

Multiple Choice

What does the rule "Alert tcp any any -> 192.168.1.0/24 111" specify in terms of packet examination?

• It specifies the action to take

• It specifies the destination IP

• It specifies the protocol

• It specifies the source IP

Multiple Choice

What are the two methods of anomaly detection mentioned in the image?

• Header Analysis

• Payload Analysis

• Traffic Analysis

• Network Analysis

Multiple Choice

What are the two classes that the training data is classified into using a certain method?

• Intrusion

• Non-intrusion

• Malware

• Phishing

Multiple Choice

What are the common techniques used in anomaly detection for network attacks?

• Using bad checksum

• Spoofed addresses

• Duplicate TCP packets

• All of the above

Multiple Choice

What are some leading products in the field of Intrusion Detection Systems (IDS)?

• Dragon from Enterasys

• CISCO Secure IDS

• Snort

• Wazuh

Multiple Choice

What are the three modes of Snort as a Network IDS?

• Sniffer

• Packet logger

• Network intrusion detection

• Firewall

Multiple Choice

What are the key features of Snort as mentioned in the slide?

• Fast

• Flexible

• Open-source

• All of the above

Poll

How confident do you feel about this topic now?

• Very confident
• Somewhat confident
• Not confident