Deck 4: Incident Response: Detection and Decision Making

Question 1

The term ____ refers to an event that triggers alarms and causes an IDS to react as if a real attack is in progress.

A)True Attack Stimulus
B)false positive
C)Confidence Value
D)Alarm Compaction

Answer 1

A

Question 2

A(n)____ is designed to be placed in a network to determine whether or not the network is being used in ways that are out of compliance with the policy of the organization.

A)alert
B)security policy
C)intrusion detection system
D)DNS cache

Answer 2

C

Question 3

A(n)____ is a type of attack on information assets in which the instigator attempts to gain unauthorized entry into a system or network or disrupt the normal operations of a system or network.

A)intrusion
B)alert
C)event
D)honeypot

Answer 3

A

Question 4

A(n)____ is an indication that a system has just been attacked or continues to be under attack.

A)event
B)alert
C)stimulus
D)honeypot

Question 5

A data packet is defined as invalid when its configuration matches what is defined as valid by the various Internet protocols (TCP,UDP,IP).

Question 6

Many types of intrusions,especially DoS and DDoS attacks,rely on the creation of improperly formed packets to take advantage of weaknesses in the protocol stack in certain operating systems or applications.

Question 7

The failure of an IDS system to react to an actual attack event is known as a ____.

A)false positive
B)false negative
C)Confidence Value
D)site policy

Question 8

A(n)____ is an event that triggers alarms and causes a false positive when no actual attacks are in progress.

A)alert
B)false negative
C)false attack stimulus
D)True Attack Stimulus

Question 9

The purpose of a NIDS is to look for patterns within network traffic that indicate an intrusion event is underway or about to begin.

Question 10

Using a process known as ____,Network IDSs must look for attack patterns by comparing measured activity to known signatures in their knowledge base to determine whether or not an attack has occurred or may be underway.

A)clipping
B)cache poisoning
C)scanning
D)signature matching

Question 11

The only time a HIDS produces a false positive alert is when an authorized change occurs for a monitored file.

Question 12

The ____ contains the rules and configuration guidelines governing the implementation and operation of IDSs within the organization.

A)security policy
B)honeypot
C)log file
D)site policy

Question 13

The term ____ refers to a value associated with an IDS' ability to detect and identify an attack correctly.

A)True Attack Stimulus
B)false positive
C)Confidence Value
D)Alarm Compaction

Question 14

A ____ is an alarm or alert that indicates that an attack is in progress or that an attack has successfully occurred when in fact there was no such attack.

A)false positive
B)false negative
C)Confidence Value
D)site policy

Question 15

When placed next to a hub,switch,or other key networking device,the NIDS may use that device's monitoring port,also known as a(n)____ port or mirror port.

A)SWAN
B)HID
C)SPAN
D)IDS

Question 16

____ occurs when valid packets exploit poorly configured DNS servers to inject false information to corrupt the servers' answers to routine DNS queries from other systems on that network.

A)Signature matching
B)DNS cache poisoning
C)Clipping
D)Clustering

Question 17

____ are also known as system integrity verifiers.

A)Alarm filters
B)Honeypot Farms
C)HIDSs
D)Scanning utilities

Question 18

____ is an IDS's ability to dynamically modify its site policies in reaction or response to environmental activity.

A)Alarm Compaction
B)Site policy awareness
C)True Attack Stimulus
D)Confidence Value

Question 19

____ is an ongoing activity from alarm events that are accurate and noteworthy but not necessarily significant as potentially successful attacks.

A)Alarm compaction
B)Cache poisoning
C)Noise
D)Alarm Clustering

Question 20

The smart systems administrator backs up system logs but not system data.

Question 21

Match each statement with an item below.

-Triggers an alert or alarm when one of the following changes occurs: file attributes change,new files are created,or existing files are deleted.

A)Intrusion detection system
B)HIDS
C)Signature-based IDS
D)Enticement
E)Entrapment
F)Alarm clustering
G)NIDS
H)Nmap
I)Scanning utility

Question 22

A(n)____________________ can adapt its reaction activities based on both guidance learned over time from the administrator as well as circumstances present in the local environment.

Question 23

Match each statement with an item below.

-A widely used port scanner.

A)Intrusion detection system
B)HIDS
C)Signature-based IDS
D)Enticement
E)Entrapment
F)Alarm clustering
G)NIDS
H)Nmap
I)Scanning utility

Question 24

_________________________ is the process of evaluating circumstances around organizational events,determining which events are possible incidents,or incident candidates,and then determining whether or not the event constitutes an actual incident.

Question 25

The task of monitoring file systems for unauthorized change is best performed by using a(n)____.

A)cache
B)honeypot
C)SPAN
D)HIDS

Question 26

The term ____________________ refers to a consolidation of almost identical alarms into a single higher-level alarm.

Question 27

Match each statement with an item below.

-Looks for indications of ongoing or successful attacks and resides on a computer or appliance connected to that network segment.

A)Intrusion detection system
B)HIDS
C)Signature-based IDS
D)Enticement
E)Entrapment
F)Alarm clustering
G)NIDS
H)Nmap
I)Scanning utility

Question 28

Match each statement with an item below.

-Network burglar alarm.

A)Intrusion detection system
B)HIDS
C)Signature-based IDS
D)Enticement
E)Entrapment
F)Alarm clustering
G)NIDS
H)Nmap
I)Scanning utility

Question 29

Match each statement with an item below.

-Tool used to identify which computers are active on a network,as well as which ports and services are active on the computers,what function or role the machines may be fulfilling,and so on.

A)Intrusion detection system
B)HIDS
C)Signature-based IDS
D)Enticement
E)Entrapment
F)Alarm clustering
G)NIDS
H)Nmap
I)Scanning utility

Question 30

Match each statement with an item below.

-The action of luring an individual into committing a crime to get a conviction.

A)Intrusion detection system
B)HIDS
C)Signature-based IDS
D)Enticement
E)Entrapment
F)Alarm clustering
G)NIDS
H)Nmap
I)Scanning utility

Question 31

A ____ is a computer server configured to resemble a production system,containing rich information just begging to be hacked.

A)smart IDS
B)DNS cache
C)network cluster
D)honeypot

Question 32

A ____ is a high-interaction honeypot designed to capture extensive information on threats.

A)DNS cache
B)honeypot Farm
C)DNS farm
D)network-based IDS

Question 33

Match each statement with an item below.

-Examines data traffic in search of patterns that match known signatures - that is,preconfigured,predetermined attack patterns.

A)Intrusion detection system
B)HIDS
C)Signature-based IDS
D)Enticement
E)Entrapment
F)Alarm clustering
G)NIDS
H)Nmap
I)Scanning utility

Question 34

Match each statement with an item below.

-The process of attracting attention to a system by placing tantalizing bits of information in key locations.

A)Intrusion detection system
B)HIDS
C)Signature-based IDS
D)Enticement
E)Entrapment
F)Alarm clustering
G)NIDS
H)Nmap
I)Scanning utility

Question 35

A ____ is a type of IDS that is similar to the NIDS,reviews the log files generated by servers,network devices,and even other IDSs.

A)honeypot
B)alarm cluster
C)log file monitor
D)DNS cache

Question 36

____ are tools used to identify which computers are active on a network,as well as which ports and services are active on the computers,what function or role the machines may be fulfilling,and so on.

A)Triggers
B)Clusters
C)Scanning utilities
D)Filters

Question 37

Match each statement with an item below.

-Can indicate if a relationship exists between the individual alarm elements when they have specific similar attributes.

A)Intrusion detection system
B)HIDS
C)Signature-based IDS
D)Enticement
E)Entrapment
F)Alarm clustering
G)NIDS
H)Nmap
I)Scanning utility

Question 38

A(n)____________________ monitors traffic on a segment of an organization's network.

Question 39

The term ____ refers to the level at which the IDS triggers an alert to notify the administrator.

A)clipping level
B)cache level
C)signature matching
D)Alarm Filtering

Question 40

____________________ is the process of classifying the attack alerts that an IDS detects in order to distinguish or sort false positives from actual attacks more efficiently.

Question 41

What are the steps involved in monitoring networks for signs of intrusion?

Question 42

What are the advantages and disadvantages of HIDS?

Question 43

What are honeypots? Briefly describe each of the two general types.

Question 44

List five reasons why you would acquire and use an IDS.

Question 45

What are the advantages and disadvantages of NIDS?

Question 46

The Electronic Communications Protection Act prohibits the recording of wire- or cable-based communications unless an exception applies.Briefly discuss four of these exceptions.

Question 47

According to Pipkin,what are the four types of incident candidates that are probable indicators of actual incidents? Provide a brief description of each incident candidate.

Question 48

Briefly describe the tasks involved in managing logs.

Question 49

Discuss two weaknesses of the signature-based IDS technology.