Untitled Presentation

Open Ended

How do monitoring and detection systems like IDS/IPS contribute to protecting organizational information assets?

Multiple Choice

Why is intrusion detection important for network security?

• It helps identify unauthorized access and potential threats.

• It slows down network performance.

• It is only useful for small organizations.

• It replaces the need for firewalls.

Multiple Choice

Which of the following tools is used for monitoring the status of network assets from various operational indicators?

• Wazuh

• Nagios

• Solarwinds

• Elastic

Multiple Select

Which of the following activities are classified as intrusion according to the definition provided?

• Attempted Break-ins

• Masquerade attacks

• Running permitted programs

• Denial of Service

Multiple Choice

Why is it necessary to have an application that complements the firewall in network security?

• Because firewalls cannot detect all threats

• Because firewalls are always secure

• Because firewalls can inspect all traffic

• Because firewalls never get attacked

Open Ended

Explain the main difference between the function of a firewall and an IDS in network security.

Multiple Choice

What is the primary goal of an Intrusion Detection System (IDS)?

• To block all network traffic

• To inspect all network activity and identify suspicious patterns

• To encrypt data transmissions

• To manage user authentication

Multiple Select

Which of the following are functions performed by an Intrusion Detection System (IDS)?

• Monitoring target system activity

• Reporting information to security infrastructure

• Responding to detected intrusions

• Encrypting network traffic

Open Ended

Explain the roles of 'Monitor', 'Report', and 'Respond' in the context of Intrusion Detection Systems (IDS).

Open Ended

What are the two approaches to Intrusion Detection mentioned in the slides, and how do they differ?

Multiple Choice

Which of the following tools is used as a File System Integrity Checker in Host-based IDS?

• Swatch

• Log check

• Mod_security

• Tripwire

Open Ended

Explain the difference between Rule Based (Misuse detection) and Anomaly detection methods in IDS.

Multiple Select

Which of the following are considered active responses in IDS?

• Alerts – Visual, Audio, E-mail, Pager, SNMP Alarms

• Snapshots taken for later analysis

• Update Policy

• Block Traffic Completely

Multiple Choice

In the context of IDS rules, what does the 'content' field specify?

• The protocol to use

• The value of a payload

• The port number

• The message to send

Open Ended

Describe how header and payload analysis are used in anomaly detection for IDS. Provide examples of attacks detected by each method.

Multiple Choice

Which step comes immediately after data traffic is captured using tcpdump in the anomaly detection process?

• Preprocessing and splitting data into training and testing sets

• Classification using SVM

• Testing the trained model

• Labeling the data

Multiple Select

Which of the following are examples of attack behaviors detected by anomaly detection systems?

• Smurf ICMP echo request flooding

• UDPStorm spoofed request flooding

• Checksum errors in packets

• Normal TCP/IP communication

Open Ended

Explain how anomaly detection distinguishes between normal and attack packets based on the principles described.

Open Ended

Reflecting on the four aspects of network security discussed, which aspect do you think is most critical for an organization and why?

Multiple Choice

Which aspect of network security focuses on monitoring organizational information assets, and what are some examples of tools used for this purpose?

• Protect; Firewall

• Detect/Monitoring; IDS/IPS, SIEM

• Respond; Network Forensics

• Predict; Threat Intelligence