Intrusion Detection and Prevention Systems

What is the primary function of an Intrusion Detection System (IDS)?

• To prevent all attacks

• To manage user accounts

• To monitor and analyze events for signs of incidents

• To create backups of data

Answer explanation

The primary function of an Intrusion Detection System (IDS) is to monitor and analyze events for signs of incidents, helping to identify potential security breaches rather than preventing all attacks or managing user accounts.

What does an Intrusion Prevention System (IPS) do that an IDS does not?

• Logs information about attacks

• Attempts to stop possible incidents

• Analyzes network traffic

• Detects unauthorized access

Answer explanation

An Intrusion Prevention System (IPS) actively attempts to stop possible incidents, whereas an Intrusion Detection System (IDS) only detects and logs unauthorized access without taking action.

Which of the following is a characteristic of signature-based detection?

• It uses statistical methods to identify anomalies

• It requires constant updates to profiles

• It compares observed events against known attack patterns

• It detects previously unknown attacks

Answer explanation

Signature-based detection identifies threats by comparing observed events against known attack patterns, making it effective for recognizing established attacks, unlike anomaly detection which uses statistical methods.

What is a false positive in the context of IDPS?

• Correctly identifying a malicious activity

• Identifying a benign activity as malicious

• Logging an event without analysis

• Failing to detect a real attack

Answer explanation

A false positive in IDPS occurs when a system incorrectly identifies a benign activity as malicious. This can lead to unnecessary alerts and resource allocation, making it crucial to distinguish between real threats and normal behavior.

What is the purpose of tuning an IDPS?

• To enhance user interface

• To increase the number of alerts

• To improve detection accuracy

• To disable all detection features

Answer explanation

Tuning an IDPS is essential to improve detection accuracy. This process helps reduce false positives and ensures that the system effectively identifies real threats, enhancing overall security.

Which detection methodology uses profiles of normal behavior?

• Network behavior analysis

• Stateful protocol analysis

• Anomaly-based detection

• Signature-based detection

Answer explanation

Anomaly-based detection uses profiles of normal behavior to identify deviations that may indicate potential threats, making it effective for detecting unknown attacks.

What is the main drawback of stateful protocol analysis?

• It cannot detect any attacks

• It requires no configuration

• It is resource-intensive

• It is only effective for known attacks

Answer explanation

The main drawback of stateful protocol analysis is that it is resource-intensive. This means it requires significant processing power and memory to track the state of connections, making it less efficient compared to other methods.

What type of IDPS monitors network traffic for specific segments?

• Network-Based IDPS

• Behavior Analysis IDPS

• Wireless IDPS

• Host-Based IDPS

Answer explanation

A Network-Based IDPS monitors network traffic across specific segments, analyzing data packets for suspicious activity. This makes it the correct choice, as it focuses on network-level security.

Which of the following is a limitation of wireless IDPS?

• It has no false positives

• It is less accurate than wired IDPS

• It can monitor all channels simultaneously

• It cannot detect attacks on wired networks

Answer explanation

Wireless IDPS primarily monitors wireless networks and cannot detect attacks occurring on wired networks, making it a limitation compared to wired IDPS, which can monitor both types.

What is the primary function of a management server in an IDPS?

• To provide user interfaces

• To analyze network traffic

• To receive and manage information from sensors

• To monitor individual hosts

Answer explanation

The primary function of a management server in an IDPS is to receive and manage information from sensors. This allows it to coordinate and analyze data collected from various points in the network.