IDS/IPS

What is the main function of an IDS?

• Block all traffic

• Monitor and detect suspicious activity

• Encrypt network data

• Assign IP addresses

Answer explanation

The main function of an Intrusion Detection System (IDS) is to monitor and detect suspicious activity within a network, helping to identify potential security threats.

What is the main difference between IDS and IPS?

• IDS blocks traffic, IPS only monitors

• IDS detects only, IPS detects and blocks

• IPS works offline

• IDS encrypts packets

Answer explanation

The main difference is that IDS (Intrusion Detection System) detects and alerts on suspicious activity, while IPS (Intrusion Prevention System) not only detects but also actively blocks malicious traffic.

What is the purpose of the SID in a Snort rule?

• To define the source IP

• To uniquely identify a rule

• To block traffic

• To encrypt packets

Answer explanation

The SID (Snort ID) in a Snort rule serves to uniquely identify that specific rule. This allows for easier management and reference, distinguishing it from other rules in the system.

Snort was originally developed by who?

• Bill Gates

• Linus Torvalds

• Martin Roesch

• Elon Musk

Answer explanation

Snort, an open-source intrusion detection system, was originally developed by Martin Roesch in 1998. He created it to provide a robust network security solution, distinguishing it from the other options listed.

Snort is now owned by which company?

• Microsoft

• Google

• IBM

• Cisco

Answer explanation

Snort, an open-source intrusion detection system, is now owned by Cisco. This acquisition allows Cisco to enhance its security offerings with Snort's capabilities.

Which mode of Snort only reads and displays packets on the screen?

• IDS Mode

• IPS Mode

• Sniffer Mode

• Logger Mode

Answer explanation

Sniffer Mode is the correct choice as it captures and displays packets on the screen without any processing or analysis. In contrast, IDS and IPS modes involve detection and prevention mechanisms, while Logger Mode stores packets.

Which Snort rule action is used to block malicious traffic in IPS mode?

• alert

• pass

• log

• drop

Answer explanation

The correct action to block malicious traffic in IPS mode is 'drop'. This action prevents the traffic from reaching its destination, effectively stopping the threat, unlike 'alert', 'pass', or 'log', which do not block traffic.

What detection method does Snort mainly use?

• Artificial Intelligence

• Signature-based detection

• Blockchain verification

• Biometric scanning

Answer explanation

Snort primarily uses signature-based detection, which involves identifying known threats by matching network traffic against a database of signatures. This method is effective for detecting established attack patterns.

Which of the following attacks can Snort detect?

• Port scanning

• SQL Injection

• DoS attacks

• All of the above

Answer explanation

Snort is capable of detecting various types of attacks, including port scanning, SQL injection, and DoS attacks. Therefore, the correct answer is 'All of the above' as it encompasses all listed attack types.

In a Snort rule, what does “tcp” represent?

• Rule ID

• Action

• Protocol

• Port number

Answer explanation

In a Snort rule, 'tcp' specifies the protocol being used for the rule. It indicates that the rule applies to TCP traffic, distinguishing it from other protocols like UDP or ICMP.