IDS quiz

What are Intrusion Detection Systems (IDS)?

• Computer programs that detect malicious activity on a network or system

• Software that monitors network traffic and identifies potential threats

• Tools used to alert administrators of unauthorized access or suspicious activity

• All of the above

Goals of IDS

• Mobility and allow for a stable connection

• Take action and allowing an attack to the network

• Identify abnormal behaviour of network or misuse of resources

• Different ways to transmit data securely and safely

____________explores issues in intrusion detection associated with deviations from normal system or user behavior.

• Anomaly detection

• Signature detection

• Log Analyser

• None of these

____________examines activity on an individual system, such as a mail server, web server or individual PC.

• Anomaly detection

• Signature detection

• Host Based IDS

• Network based IDS

____________ examines activity on the network itself.

• Anomaly detection

• Signature detection

• Host Based IDS

• Network based IDS

____________ component that interfaces with the human elements providing alerts, when appropriate and giving the user a means to interact with and operate the IDS.

• Traffic Collector

• Analysis engine

• User interface and reporting

• None of these

What is the main limitation of signature-based IDS systems?

• They are less effective at detecting new or unknown threats

• They require constant monitoring by administrators

• They can only detect network-based threats

• They are expensive to implement

What should be done to ensure the effectiveness of a signature based IDS system?

• Regularly update the system with the latest security signatures

• Install multiple IDS systems for redundancy

• Use only anomaly-based IDS systems

• Disable firewalls and antivirus software

A network-attached system set up as a decoy to lure cyberattackers and to detect, deflect or study hacking attempts in order to gain unauthorized access to information systems.

• intrusion detection system

• Fly trap

• Honeypot

• Intruder alarm server

A virus has been detected on a device connected to a network. What SHOULD be done first?

• Run a virus scan on all shared areas

• Disconnect the device from the network

• Contact the user to let them know what has happened

• Update the anti-virus software