Question 1

A(n) partially distributed IDPS control strategy combines the best of other IDPS strategies. _________________________

Accepted Answer

A partially distributed IDPS control strategy combines the benefits of both centralized and distributed strategies, allowing for a more effective and efficient intrusion detection and prevention system.

Question 2

Activities that scan network locales for active systems and then identify the network services offered by the host systems are known as __________.
A)port knocking
B)doorknob rattling
C)footprinting
D)fingerprinting

Accepted Answer

This activity is known as fingerprinting, as it involves gathering information about the target system's specific characteristics or "fingerprint" to identify it, such as its operating system, open ports, and running services, among other details. Port knocking refers to the act of specifying a particular sequence of connection attempts to gain access to a restricted service. Doorknob rattling is not a known term in the context of networking or cybersecurity. Footprinting is a broader category of reconnaissance activities that involve gathering information about a target system or organization, including their network and infrastructure.

Question 3

A(n) port is the equivalent of a network channel or connection point in a data communications system. _________________________

Accepted Answer

A port is indeed a network channel or connection point in a data communications system. It is a specific endpoint to which data can be sent and received on a network.

Question 4

When a collection of honeypots connects several honeypot systems on a subnet, it may be called a(n) honeynet. _________________________

Accepted Answer

A collection of honeypots that are connected on a subnet is called a honeynet.

Question 5

A(n) __________ works like a burglar alarm in that it detects a violation (some system activities analogous to an opened or broken window) and activates an alarm.
A)IDPS
B)WiFi
C)UDP
D)DoS

Accepted Answer

An IDPS (Intrusion Detection and Prevention System) is designed to detect and prevent unauthorized access to a system or network. It functions similar to a burglar alarm in that it alerts administrators when there is an attempt to breach the system.

Question 6

A wireless security toolkit should include the ability to sniff wireless traffic, scan wireless hosts, and assess the level of privacy or confidentiality afforded on the wireless network. _________________________

Accepted Answer

These are essential capabilities of a wireless security toolkit that allow for effective identification and analysis of potential security vulnerabilities on wireless networks.

Question 7

Enticement is the action of luring an individual into committing a crime to get a conviction. _________________________

Accepted Answer

Entrapment

Question 8

Port explorers are tools used both by attackers and defenders to identify (or fingerprint) the computers that are active on a network, as well as the ports and services active on those computers, the functions and roles the machines are fulfilling, and other useful information. _________________________

Accepted Answer

scanners

Question 9

A padded cell is a hardened honeynet. _________________________

Accepted Answer

honeypot

Question 10

Intrusion __________ activities finalize the restoration of operations to a normal state and seek to identify the source and method of the intrusion in order to ensure that the same type of attack cannot occur again.
A)prevention
B)reaction
C)detection
D)correction

Accepted Answer

Intrusion correction activities focus on restoring operations to a normal state and identifying the source and method of the intrusion to prevent the same kind of attack from happening again. Prevention activities are meant to stop attacks before they happen, detection activities are focused on identifying attacks in progress, and reaction activities are focused on mitigating the effects of an attack once it has occurred.

Question 11

__________ is the process of classifying IDPS alerts so that they can be more effectively managed.
A)Alarm filtering
B)Alarm clustering
C)Alarm compaction
D)Alarm attenuation

Accepted Answer

The answer of __________ is the process of classifying IDPS...

Question 12

The primary advantages of a centralized IDPS control strategy are cost and ease of use. _________________________

Accepted Answer

control

Question 13

A(n) monitoring vulnerability scanner is one that listens in on the network and determines vulnerable versions of both server and client software. _________________________

Accepted Answer

passive

Question 14

A(n) log file monitor is similar to an NIDPS. _________________________

Accepted Answer

A log file monitor and an NIDPS (Network Intrusion Detection and Prevention System) both serve the purpose of detecting and alerting on suspicious activity, although their specific functions and methods may differ.

Question 15

For Linux or BSD systems, a tool called "Snow White" allows a remote individual to "mirror" entire Web sites. _________________________

Accepted Answer

wget

Question 16

Preconfigured, predetermined attack patterns are called signatures. _________________________

Accepted Answer

Signatures are indeed preconfigured, predetermined attack patterns. They are used by security systems such as antivirus software and intrusion detection and prevention systems to detect and prevent known attacks.

Question 17

The disadvantages of using the honeypot or padded cell approach include the fact that the technical ​implications of using such devices are not well understood. _________________________

Accepted Answer

legal

Question 18

Fingerprinting is the organized research of the Internet addresses owned or controlled by a target organization. _________________________

Accepted Answer

Footprinting

Question 19

When using trap-and-trace, the trace usually consists of a honeypot or padded cell and an alarm. _________________________

Accepted Answer

trap

Question 20

A(n) __________ is an event that triggers an alarm when no actual attack is in progress.
A)false neutral
Attack stimulus
C)false negative
D)noise

Accepted Answer

An attack stimulus is an event that triggers an alarm signaling that an attack is in progress, even if there is no actual attack occurring. False neutral, false negative, and noise do not accurately describe this situation.

Quiz 7: Security Technology: Intrusion Detection and Prevention Systems, and Other Security Tools

A(n) partially distributed IDPS control strategy combines the best of other IDPS strategies. _________________________

Activities that scan network locales for active systems and then identify the network services offered by the host systems are known as __________.

A(n) port is the equivalent of a network channel or connection point in a data communications system. _________________________

When a collection of honeypots connects several honeypot systems on a subnet, it may be called a(n) honeynet. _________________________

A(n) __________ works like a burglar alarm in that it detects a violation (some system activities analogous to an opened or broken window) and activates an alarm.

A wireless security toolkit should include the ability to sniff wireless traffic, scan wireless hosts, and assess the level of privacy or confidentiality afforded on the wireless network. _________________________

Enticement is the action of luring an individual into committing a crime to get a conviction. _________________________

A padded cell is a hardened honeynet. _________________________

Intrusion __________ activities finalize the restoration of operations to a normal state and seek to identify the source and method of the intrusion in order to ensure that the same type of attack cannot occur again.

__________ is the process of classifying IDPS alerts so that they can be more effectively managed.

The primary advantages of a centralized IDPS control strategy are cost and ease of use. _________________________

A(n) monitoring vulnerability scanner is one that listens in on the network and determines vulnerable versions of both server and client software. _________________________

A(n) log file monitor is similar to an NIDPS. _________________________

For Linux or BSD systems, a tool called "Snow White" allows a remote individual to "mirror" entire Web sites. _________________________

Preconfigured, predetermined attack patterns are called signatures. _________________________

The disadvantages of using the honeypot or padded cell approach include the fact that the technical implications of using such devices are not well understood. _________________________

Fingerprinting is the organized research of the Internet addresses owned or controlled by a target organization. _________________________

When using trap-and-trace, the trace usually consists of a honeypot or padded cell and an alarm. _________________________

A(n) __________ is an event that triggers an alarm when no actual attack is in progress.

Quiz 7: Security Technology: Intrusion Detection and Prevention Systems, and Other Security Tools

A(n) partially distributed IDPS control strategy combines the best of other IDPS strategies. _________________________

Activities that scan network locales for active systems and then identify the network services offered by the host systems are known as __________.

A(n) port is the equivalent of a network channel or connection point in a data communications system. _________________________

When a collection of honeypots connects several honeypot systems on a subnet, it may be called a(n) honeynet. _________________________

A(n) __________ works like a burglar alarm in that it detects a violation (some system activities analogous to an opened or broken window) and activates an alarm.

A wireless security toolkit should include the ability to sniff wireless traffic, scan wireless hosts, and assess the level of privacy or confidentiality afforded on the wireless network. _________________________

Enticement is the action of luring an individual into committing a crime to get a conviction. _________________________

A padded cell is a hardened honeynet. _________________________

Intrusion __________ activities finalize the restoration of operations to a normal state and seek to identify the source and method of the intrusion in order to ensure that the same type of attack cannot occur again.

__________ is the process of classifying IDPS alerts so that they can be more effectively managed.

The primary advantages of a centralized IDPS control strategy are cost and ease of use. _________________________

A(n) monitoring vulnerability scanner is one that listens in on the network and determines vulnerable versions of both server and client software. _________________________

A(n) log file monitor is similar to an NIDPS. _________________________

For Linux or BSD systems, a tool called "Snow White" allows a remote individual to "mirror" entire Web sites. _________________________

Preconfigured, predetermined attack patterns are called signatures. _________________________

The disadvantages of using the honeypot or padded cell approach include the fact that the technical ​implications of using such devices are not well understood. _________________________

Fingerprinting is the organized research of the Internet addresses owned or controlled by a target organization. _________________________

When using trap-and-trace, the trace usually consists of a honeypot or padded cell and an alarm. _________________________

A(n) __________ is an event that triggers an alarm when no actual attack is in progress.

The disadvantages of using the honeypot or padded cell approach include the fact that the technical implications of using such devices are not well understood. _________________________