snort

Which of the following is NOT typically considered a key element of access control within network security?

• Network Access Control (NAC)

• Intrusion Detection and Prevention (IDS/IPS)

• Identity and Access Management (IAM)

• Firewall Protection

Which base network security control level focuses on policies, access levels, and authentication processes?

• Physical

• Technical

• Administrative

• Operational

A Zero Trust security model operates on the principle of:

• Providing full network access to all users by default.

• Never trusting any user or device, and always verifying.

• Implementing security measures only at the network perimeter.

• Granting access based on the user's physical location.

Which of the following technologies is primarily designed to detect and potentially block suspicious network traffic?

• Intrusion Detection and Prevention System (IDS/IPS)

• Virtual Private Network (VPN)

• Network Segmentation

• Identity and Access Management (IAM)

You want to analyze network traffic to gain overall statistics and summaries without looking at individual packets. Which Traffic Analysis technique would be most suitable?

• Flow Analysis

• Packet Analysis

• Threat Hunting

• Network Forensics

Which of the following is NOT a main detection/prevention technique used by IDS/IPS systems?

• Signature-Based

• Behavior-Based

• Policy-Based

• Time-Based

Snort can function in several modes. Which mode would you use if your primary goal is to collect detailed records of all network traffic for later analysis?

• NIDS mode

• Packet Logger mode

• Sniffer mode

• NIPS mode

A key difference between a Network Intrusion Detection System (NIDS) and a Network Intrusion Prevention System (NIPS) is that:

• NIDS only analyzes traffic on wireless networks, while a NIPS works on wired networks.

• NIDS monitors traffic on the entire subnet, while a NIPS focuses on a single device.

• NIDS can detect threats but cannot stop them, while a NIPS can both detect and take action against threats.

• NIDS is primarily focused on known threats, while a NIPS specializes in detecting new, unknown threats.

You want to configure Snort to detect attacks that exploit a newly discovered software vulnerability (for which there are no existing signatures). Which type of IPS system would be the best choice?

• Network Intrusion Prevention System (NIPS)

• Behavior-based Intrusion Prevention System (NBA)

• Host-based Intrusion Prevention System (HIPS).

• None of the above; Snort cannot detect attacks without signatures.

Which of the following is a key advantage of using Snort as an IDS/IPS?

• It is a proprietary, closed-source solution with guaranteed support.

• It has a very simple configuration with no need for complex rules.

• It offers flexibility, customizability, and a strong community.

• It is the only IDS/IPS that can detect zero-day attacks.