Deck 7: Security Technology: Intrusion Detection and Prevention Systems, and Other Security Tools

Question 1

Intrusion detection and prevention systems can deal effectively with switched networks.

Answer 1

False

Question 2

The Simple Network Management Protocol contains trap functions, which allow a device to send a message to the SNMP management console indicating that a certain threshold has been crossed, either positively or negatively.

Answer 2

True

Question 3

Your organization's operational goals, constraints, and culture should not affect the selection of the IDPS and other security tools and technologies to protect your systems.

Answer 3

False

Question 4

The process by which attackers change the format and/or timing of their activities to avoid being detected by the IDPS is known as a false attack stimulus.

Question 5

All IDPS vendors target users with the same levels of technical and security expertise.

Question 6

HIDPSs are also known as system integrity verifiers.

Question 7

An HIDPS can monitor system logs for predefined events.

Question 8

A false positive is the failure of an IDPS system to react to an actual attack event.

Question 9

IDPS responses can be classified as active or passive.

Question 10

A passive IDPS response is a definitive action automatically initiated when certain types of alerts are triggered.

Question 11

NIDPSs can reliably ascertain whether an attack was successful.

Question 12

The anomaly-based IDPS collects statistical summaries by observing traffic that is known to be normal.

Question 13

An HIDPS is optimized to detect multihost scanning, and it is able to detect the scanning of non-host network devices, such as routers or switches.

Question 14

An IDPS can be configured to dial a phone number and produce an alphanumeric page or other type of signal or message.

Question 15

In order to determine which IDPS best meets an organization's needs, first consider the organizational environment in technical, physical, and political terms.

Question 16

An HIDPS can detect local events on host systems and detect attacks that may elude a network-based IDPS.

Question 17

In DNS cache poisoning, valid packets exploit poorly configured DNS servers to inject false information and corrupt the servers' answers to routine DNS queries from other systems on the network.

Question 18

Intrusion detection consists of procedures and systems that identify system intrusions and take action when an intrusion is detected.

Question 19

Intrusion detection and prevention systems perform monitoring and analysis of system events and user behaviors.

Question 20

A fully distributed IDPS control strategy is an IDPS implementation approach in which all control
functions are applied at the physical location of each IDPS component.

Question 21

Alarm events that are accurate and noteworthy but do not pose significant threats to information security are called noise. _________________________

Question 22

A(n) NIDPS functions on the host system, where encrypted traffic will have been decrypted and is available for processing. _________________________

Question 23

In the process of protocol application verification, the NIDPSs look for invalid data packets. _________________________

Question 24

To use a packet sniffer legally, an administrator only needs permission of the organization's top computing executive.

Question 25

The Metasploit Framework is a collection of exploits coupled with an interface that allows the penetration tester to automate the custom exploitation of vulnerable systems.

Question 26

Once the OS is known, all of the vulnerabilities to which a system is susceptible can easily be determined.

Question 27

The integrity value, which is based upon fuzzy logic, helps an administrator determine how likely it is that an IDPS alert or alarm indicates an actual attack in progress. _________________________

Question 28

A(n) event is an indication that a system has just been attacked or is under attack. _________________________

Question 29

Administrators who are wary of using the same tools that attackers use should remember that a tool that can help close an open or poorly configured firewall will not help the network defender minimize the risk from attack.

Question 30

Alarm filtering may be based on combinations of frequency, similarity in attack signature, similarity in attack target, or other criteria that are defined by the system administrators. _________________________

Question 31

A(n) known vulnerability is a published weakness or fault in an information asset or its protective systems that may be exploited and result in loss. _________________________

Question 32

A(n) server-based IDPS protects the server or host's information assets. _________________________

Question 33

To assist in footprint intelligence collection, attackers may use an enhanced Web scanner that, among other things, can scan entire Web sites for valuable pieces of information, such as server names and e-mail addresses.

Question 34

The process of entrapment occurs when an attacker changes the format and/or timing of activities to avoid being detected by an IDPS. _________________________

Question 35

Services using the TCP/IP protocol can run only on their commonly used port number as specified in their original Internet standard.

Question 36

The activities that gather public information about the organization and its network activities and assets is called fingerprinting. _________________________

Question 37

A passive vulnerability scanner is one that initiates traffic on the network in order to determine security holes.

Question 38

Security tools that go beyond routine intrusion detection include honeypots, honeynets, and padded cell systems.

Question 39

A strategy based on the concept of defense in depth is likely to include intrusion detection systems, active vulnerability scanners, passive vulnerability scanners, automated log analyzers, and protocol analyzers.

Question 40

Passive scanners are advantageous in that they require vulnerability analysts to get approval prior to testing.

Question 41

A(n) partially distributed IDPS control strategy combines the best of other IDPS strategies. _________________________

Question 42

Activities that scan network locales for active systems and then identify the network services offered by the host systems are known as __________.

A)port knocking
B)doorknob rattling
C)footprinting
D)fingerprinting

Question 43

A(n) port is the equivalent of a network channel or connection point in a data communications system. _________________________

Question 44

When a collection of honeypots connects several honeypot systems on a subnet, it may be called a(n) honeynet. _________________________

Question 45

A(n) __________ works like a burglar alarm in that it detects a violation (some system activities analogous to an opened or broken window) and activates an alarm.

A)IDPS
B)WiFi
C)UDP
D)DoS

Question 46

A wireless security toolkit should include the ability to sniff wireless traffic, scan wireless hosts, and assess the level of privacy or confidentiality afforded on the wireless network. _________________________

Question 47

Enticement is the action of luring an individual into committing a crime to get a conviction. _________________________

Question 48

Port explorers are tools used both by attackers and defenders to identify (or fingerprint) the computers that are active on a network, as well as the ports and services active on those computers, the functions and roles the machines are fulfilling, and other useful information. _________________________

Question 49

A padded cell is a hardened honeynet. _________________________

Question 50

Intrusion __________ activities finalize the restoration of operations to a normal state and seek to identify the source and method of the intrusion in order to ensure that the same type of attack cannot occur again.

A)prevention
B)reaction
C)detection
D)correction

Question 51

__________ is the process of classifying IDPS alerts so that they can be more effectively managed.

A)Alarm filtering
B)Alarm clustering
C)Alarm compaction
D)Alarm attenuation

Question 52

The primary advantages of a centralized IDPS control strategy are cost and ease of use. _________________________

Question 53

A(n) monitoring vulnerability scanner is one that listens in on the network and determines vulnerable versions of both server and client software. _________________________

Question 54

A(n) log file monitor is similar to an NIDPS. _________________________

Question 55

For Linux or BSD systems, a tool called "Snow White" allows a remote individual to "mirror" entire Web sites. _________________________

Question 56

Preconfigured, predetermined attack patterns are called signatures. _________________________

Question 57

The disadvantages of using the honeypot or padded cell approach include the fact that the technical ​implications of using such devices are not well understood. _________________________

Question 58

Fingerprinting is the organized research of the Internet addresses owned or controlled by a target organization. _________________________

Question 59

When using trap-and-trace, the trace usually consists of a honeypot or padded cell and an alarm. _________________________

Question 60

A(n) __________ is an event that triggers an alarm when no actual attack is in progress.

A)false neutral
Attack stimulus
C)false negative
D)noise

Question 61

To use a packet sniffer legally, the administrator must __________.

A)be on a network that the organization owns
B)be under direct authorization of the network's owners
C)have knowledge and consent of the content's creators
D)All of the above

Question 62

A(n) __________ IDPS is focused on protecting network information assets.

A)network-based
B)host-based
C)application-based
D)server-based

Question 63

Which of the following ports is commonly used for the HTTP protocol?

A)20
B)25
C)53
D)80

Question 64

__________ are decoy systems designed to lure potential attackers away from critical systems.

A)Honeypots
B)Bastion hosts
C)Wasp nests
D)Designated targets

Question 65

The ability to detect a target computer's __________ is very valuable to an attacker.

A)manufacturer
B)operating system
C)peripherals
D)BIOS

Question 66

In TCP/IP networking, port __________ is not used.

A)0
B)1
C)13
D)1023

Question 67

__________ are usually passive devices and can be deployed into existing networks with little or no disruption to normal network operations.

A)NIDPSs
B)HIDPSs
C)AppIDPSs
D)SIDPSs

Question 68

Which of the following is NOT a described IDPS control strategy?

A)centralized
B)fully distributed
C)partially distributed
D)decentralized

Question 69

Some vulnerability scanners feature a class of attacks called _________, that are so dangerous they should only be used in a lab environment.

A)aggressive
B)divisive
C)destructive
D)disruptive

Question 70

__________ benchmark and monitor the status of key system files and detect when an intruder creates, modifies, or deletes monitored files.

A)NIDPSs
B)HIDPSs
C)AppIDPSs
D)SIDPSs

Question 71

Using __________, the system reviews the log files generated by servers, network devices, and even other IDPSs.

A)LFM
B)stat IDPS
C)AppIDPS
D)HIDPS

Question 72

To determine whether an attack has occurred or is underway, NIDPSs compare measured activity to known __________ in their knowledge base.

A)vulnerabilities
B)fingerprints
C)signatures
D)footprints

Question 73

__________ is the action of luring an individual into committing a crime to get a conviction.

A)Entrapment
B)Enticement
C)Intrusion
D)Padding

Question 74

__________ testing is a straightforward testing technique that looks for vulnerabilities in a program or protocol by feeding random input to the program or a network running the protocol.

A)Buzz
B)Fuzz
C)Spike
D)Black

Question 75

A __________ vulnerability scanner listens in on the network and identifies vulnerable versions of both server and client software.

A)passive
B)aggressive
C)active
D)secret

Question 76

A(n) __________ port, also known as a monitoring port, is a specially configured connection on a network device that is capable of viewing all of the traffic that moves through the entire device.

A)NIDPS
B)SPAN
C)DPS
D)IDSE

Question 77

Network behavior analysis system __________ sensors are typically intended for network perimeter use, so they are deployed in close proximity to the perimeter firewalls, often between the firewall and the Internet border router to limit incoming attacks that could overwhelm the firewall.

A)inline
B)offline
C)passive
D)bypass

Question 78

__________ applications use a combination of techniques to detect an intrusion and then trace it back to its source.

A)Honeynet
B)Trap-and-trace
C)HIDPS
D)Packet sniffer

Question 79

Most network behavior analysis system sensors can be deployed in __________ mode only, using the same connection methods as network-based IDPSs.

A)passive
B)active
C)reactive
D)dynamic

Question 80

A(n) __________ is a software program or hardware appliance that can intercept, copy, and interpret network traffic.

A)packet scanner
B)packet sniffer
C)honeypot
D)honey packet