Question 1

Alarm events that are accurate and noteworthy but do not pose significant threats to information security are called noise. _________________________

Accepted Answer

This statement is true. Noise refers to alarms or alerts that are generated but do not pose a significant risk to the security of information. These types of events can be considered distractions and can make it more difficult to identify and respond to legitimate security threats.

Question 2

A(n) NIDPS functions on the host system, where encrypted traffic will have been decrypted and is available for processing. _________________________

Accepted Answer

HIDPS

Question 3

In the process of protocol application verification, the NIDPSs look for invalid data packets. _________________________

Accepted Answer

stack

Question 4

To use a packet sniffer legally, an administrator only needs permission of the organization's top computing executive.

Accepted Answer

To use a packet sniffer legally, an administrator must have permission from the network owner and potentially from the users, depending on the laws of the country or state and the organization's policies.

Question 5

The Metasploit Framework is a collection of exploits coupled with an interface that allows the penetration tester to automate the custom exploitation of vulnerable systems.

Accepted Answer

The statement accurately describes the Metasploit Framework.

Question 6

Once the OS is known, all of the vulnerabilities to which a system is susceptible can easily be determined.

Accepted Answer

The answer of Once the OS is known, all of...

Question 7

The integrity value, which is based upon fuzzy logic, helps an administrator determine how likely it is that an IDPS alert or alarm indicates an actual attack in progress. _________________________

Accepted Answer

confidence

Question 8

A(n) event is an indication that a system has just been attacked or is under attack. _________________________

Accepted Answer

alert, alarm

Question 9

Administrators who are wary of using the same tools that attackers use should remember that a tool that can help close an open or poorly configured firewall will not help the network defender minimize the risk from attack.

Accepted Answer

The statement is incorrect. Tools that can help in closing an open or poorly configured firewall can also help network defenders minimize the risk from attack. It is important for defenders to use a variety of tools and techniques to protect their networks.

Question 10

Alarm filtering may be based on combinations of frequency, similarity in attack signature, similarity in attack target, or other criteria that are defined by the system administrators. _________________________

Accepted Answer

clustering

Question 11

A(n) known vulnerability is a published weakness or fault in an information asset or its protective systems that may be exploited and result in loss. _________________________

Accepted Answer

A known vulnerability is a published weakness that can be exploited to cause loss or damage to an information asset or its protective systems.

Question 12

A(n) server-based IDPS protects the server or host's information assets. _________________________

Accepted Answer

host-based

Question 13

To assist in footprint intelligence collection, attackers may use an enhanced Web scanner that, among other things, can scan entire Web sites for valuable pieces of information, such as server names and e-mail addresses.

Accepted Answer

An enhanced Web scanner can scan entire Web sites for valuable pieces of information like server names and e-mail addresses, making it a useful tool for attackers to gather footprint intelligence.

Question 14

The process of entrapment occurs when an attacker changes the format and/or timing of activities to avoid being detected by an IDPS. _________________________

Accepted Answer

evasion

Question 15

Services using the TCP/IP protocol can run only on their commonly used port number as specified in their original Internet standard.

Accepted Answer

Services can be configured to run on any available port number, but commonly used port numbers are standardized to allow for easier communication and interoperability between systems.

Question 16

The activities that gather public information about the organization and its network activities and assets is called fingerprinting. _________________________

Accepted Answer

footprinting

Question 17

A passive vulnerability scanner is one that initiates traffic on the network in order to determine security holes.

Accepted Answer

A passive vulnerability scanner does not actively initiate traffic on the network, but rather listens passively to network traffic to detect vulnerabilities. It does not send any packets or probes.

Question 18

Security tools that go beyond routine intrusion detection include honeypots, honeynets, and padded cell systems.

Accepted Answer

Honeypots, honeynets, and padded cell systems are all advanced security tools that go beyond routine intrusion detection.

Question 19

A strategy based on the concept of defense in depth is likely to include intrusion detection systems, active vulnerability scanners, passive vulnerability scanners, automated log analyzers, and protocol analyzers.

Accepted Answer

Defense in depth is a layered approach to security that includes multiple layers of defense to protect against various types of attacks. Intrusion detection systems, active and passive vulnerability scanners, automated log analyzers, and protocol analyzers are all examples of tools that could be part of a defense in depth strategy.

Question 20

Passive scanners are advantageous in that they require vulnerability analysts to get approval prior to testing.

Accepted Answer

Passive scanners do not require approval prior to testing as they do not actively send traffic to the target system. Therefore, they are considered less intrusive compared to other types of scanners.

Quiz 7: Security Technology: Intrusion Detection and Prevention Systems, and Other Security Tools