Intrusion Detection Systems Quiz

What is the purpose of an Intrusion Detection System (IDS)?

• To install software on servers

• To identify, assess, and report unauthorized network activity

• To create secure passwords

• To design network architecture

Which type of IDS is more focused on analyzing specific operating systems and applications?

• Network Based Intrusion Detection

• Honeypots

• Host Based Intrusion Detection

• Hybrid Intrusion Detection

What is the main difference between Host Based and Network Based Intrusion Detection Systems?

• Network Based IDS detects local attacks before they hit the network

• Network Based IDS is OS-specific, while Host Based IDS is OS-independent

• Host Based IDS is cheaper to implement than Network Based IDS

• Host Based IDS watches specific host activities, while Network Based IDS watches all network activities

What is the purpose of a Honeypot in network security?

• To install antivirus software

• To encrypt network traffic

• To monitor server performance

• To create a virtual trap to lure attackers

What is the main function of Passive Intrusion Detection Systems?

• Detect a potential security breach and log the information

• Analyze network traffic in real-time

• Encrypt all network data

• Take preventive measures to stop attacks

What is the drawback of Signature Based IDS?

• Only detect known attacks and require new signatures for new vulnerabilities

• Have high false alarm rates due to inaccurate profiles

• Are difficult to set up and manage

• Cannot monitor network traffic

What is the main advantage of Anomaly Based IDS?

• Can detect new attacks for which no signature exists

• Are easy to develop and understand

• React in real-time to attacks

• Monitor only known attack patterns

What is the significance of IDS in network security?

• Alert administrators of malicious activity to prevent further damage

• Block all incoming network traffic

• Encrypt all network traffic

• Slow down network performance

How does an IDS fit into a security plan?

• As an additional layer of protection in a defense in depth strategy

• To monitor only external network traffic

• As the sole security measure for a network

• To replace firewalls and routers

What is a common issue faced by IDS known as False Negatives?

• When an IDS generates false alarms

• When an IDS mistakenly reports normal activity as malicious

• When an IDS fails to detect an attack

• When an IDS cannot monitor network traffic