Evaluating Alerts Quiz

What classification is used for an alert that correctly identifies that an exploit has occurred?

• • false negative

• • true positive

• • true negative

• • false positive

Which type of analysis relies on predefined conditions and can analyze applications that only use well-known fixed ports?

• • deterministic

• • probabilistic

• • log

• • statistical

  
  

Which tool is included with Security Onion that is used by Snort to automatically download new rules?

• • Sguil

• • Wireshark

• • PulledPork

• • ELK

Which tool included in Security Onion is an interactive dashboard interface to Elasticsearch data?

• • Sguil

• • Zeek

• • Kibana

• • Wireshark

Which type of analysis relies on different methods to establish the likelihood that a security event has happened or will happen?

• • probabilistic

• • statistical

• • deterministic

• log

Which NIDS tool uses a signature-based approach and native multithreading for alert detection?

• • Snort

• • Bro

• • Zeek

• • Suricata

What is the host-based intrusion detection tool that is integrated into Security Onion?

• • OSSEC
    

• • Snort

• • Sguil

• • Wireshark

What are three analysis tools that are integrated into Security Onion? (Choose three.)

• • Snort

• • Suricata

• • Sguil

• • Kibana

• • Wireshark

What function is provided by Snort as part of the Security Onion?

• • to view pcap transcripts generated by intrusion detection tools

• • to generate network intrusion alerts by the use of rules and signatures

• • to normalize logs from various NSM data logs so they can be represented, stored, and accessed through a common schema

• • to display full-packet captures for analysis

Which tool is a Security Onion integrated host-based intrusion detection system?

• • Wazuh

• • Suricata

• • Suricata

• Zeek