UNIT4

Which system combines outputs from multiple sources and uses alarm filtering techniques to distinguish malicious activity from false alarms? (31)

• A. An IDPS system

• B. A SIEM system

• C. An IDP

• A&C are correct

To collect attack information in support of an IDPS implementation, you can begin with .................such as Snort. (31)

• hardware IDPS

• firmware IDPS

• a freeware IDPS tool

• software package

What is the term IDPS and IPS generally used for? (31)

• to describe anti-virus programs

• to describe current anti-intrusion technologies

• to describe IDPS modes

• to describe current anti-intrusion technologies

The IDPS can also provide forensic information that may be useful should the attacker be ...................... (31)

• arrected

• sued

• prosecuted

• all are correct

A current extension of IDS ...................is the intrusion prevention system. (31)

• system

• technology

• detection

• intrusion

How many types does NIDS have according to the system interactivity property? What are they? (32)

• A. It has two types: on-line and off-line NIDS

• B. It has one: off-line NIDS

• C. It has only one: on-line NIDS

• B&C are correct

Why are Network intrusion detection systems placed at a strategic point or points within the network? (32)

• A. To control traffic to and from all devices on the network.

• B. To monitor traffic to and from all devices on the network.

• B. To supervise traffic from and to all devices on the network.

• B&C are correct

NID Systems ..................comparing signatures for similar packets to link and drop harmful detected packets which have a signature matching the records in the NIDS. (32)

• A. are also able to

• B. are responsible for

• C. are also capable of

• A & C are correct

...............can be also combined with other technologies to increase detection and prediction rates. (32)

• HIDS

• NIDS

• INN IDS

• ANN

Why will a HIDS usually go to great lengths? (32)

• A. To prevent the object-database, checksum-database

• B. To reports from any form of tampering.

• C. To detect the object-database, checksum-database

• A&B are correct