Deck 7: Security Technology: Intrusion Detection and Prevention Systems, and Other Security Tools

Question 1

Intrusion detection and prevention systems can deal effectively with switched networks.

Answer 1

False

Question 2

An HIDPS can detect local events on host systems and detect attacks that may elude a network-based IDPS.

Answer 2

True

Question 3

HIDPSs are also known as system integrity verifiers.

Answer 3

True

Question 4

Your organization's operational goals, constraints, and culture should not affect the selection of the IDPS and other security tools and technologies to protect your systems.

Question 5

Intrusion detection and prevention systems perform monitoring and analysis of system events and user behaviors.

Question 6

An HIDPS can monitor system logs for predefined events.

Question 7

IDPS responses can be classified as active or passive.

Question 8

Intrusion detection consists of procedures and systems that identify system intrusions and take action when an intrusion is detected.

Question 9

A false positive is the failure of an IDPS system to react to an actual attack event.

Question 10

A fully distributed IDPS control strategy is an IDPS implementation approach in which all controlfunctions are applied at the physical location of each IDPS component.

Question 11

NIDPSs can reliably ascertain whether an attack was successful.

Question 12

The Simple Network Management Protocol contains trap functions, which allow a device to send a message to the SNMP management console indicating that a certain threshold has been crossed, either positively or negatively.

Question 13

All IDPS vendors target users with the same levels of technical and security expertise.

Question 14

An HIDPS is optimized to detect multihost scanning, and it is able to detect the scanning of non-host network devices, such as routers or switches.

Question 15

The anomaly-based IDPS collects statistical summaries by observing traffic that is known to be normal.

Question 16

A passive IDPS response is a definitive action automatically initiated when certain types of alerts are triggered.

Question 17

In order to determine which IDPS best meets an organization's needs, first consider the organizational environment in technical, physical, and political terms.

Question 18

An IDPS can be configured to dial a phone number and produce an alphanumeric page or other type of signal or message.

Question 19

In DNS cache poisoning, valid packets exploit poorly configured DNS servers to inject false information and corrupt the servers' answers to routine DNS queries from other systems on the network.

Question 20

The process by which attackers change the format and/or timing of their activities to avoid being detected by the IDPS is known as a false attack stimulus.

Question 21

Services using the TCP/IP protocol can run only on their commonly used port number as specified in their original Internet standard.

Question 22

Security tools that go beyond routine intrusion detection include honeypots, honeynets, and padded cell systems.

Question 23

A strategy based on the concept of defense in depth is likely to include intrusion detection systems, active vulnerability scanners, passive vulnerability scanners, automated log analyzers, and protocol analyzers.

Question 24

Once the OS is known, all of the vulnerabilities to which a system is susceptible can easily be determined.

Question 25

In the process of protocol application verification, the NIDPSs look for invalid data packets. _________________________

Question 26

To assist in footprint intelligence collection, attackers may use an enhanced Web scanner that, among other things, can scan entire Web sites for valuable pieces of information, such as server names and e-mail addresses.

Question 27

Preconfigured, predetermined attack patterns are called signatures. _________________________

Question 28

Alarm events that are accurate and noteworthy but do not pose significant threats to information security are called noise. _________________________

Question 29

Administrators who are wary of using the same tools that attackers use should remember that a tool that can help close an open or poorly configured firewall will not help the network defender minimize the risk from attack.

Question 30

The process of entrapment occurs when an attacker changes the format and/or timing of activities to avoid being detected by an IDPS. _________________________

Question 31

The activities that gather public information about the organization and its network activities and assets is called fingerprinting. _________________________

Question 32

A(n) known vulnerability is a published weakness or fault in an information asset or its protective systems that may be exploited and result in loss. _________________________

Question 33

A passive vulnerability scanner is one that initiates traffic on the network in order to determine security holes.

Question 34

A(n) NIDPS functions on the host system, where encrypted traffic will have been decrypted and is available for processing. _________________________

Question 35

The Metasploit Framework is a collection of exploits coupled with an interface that allows the penetration tester to automate the custom exploitation of vulnerable systems.

Question 36

A(n) server-based IDPS protects the server or host's information assets. _________________________

Question 37

A(n) event is an indication that a system has just been attacked or is under attack. _________________________

Question 38

The integrity value, which is based upon fuzzy logic, helps an administrator determine how likely it is that an IDPS alert or alarm indicates an actual attack in progress. _________________________

Question 39

Passive scanners are advantageous in that they require vulnerability analysts to get approval prior to testing.

Question 40

Alarm filtering may be based on combinations of frequency, similarity in attack signature, similarity in attack target, or other criteria that are defined by the system administrators. _________________________

Question 41

__________ is the process of classifying IDPS alerts so that they can be more effectively managed.

A) Alarm filtering
B) Alarm clustering 
C) Alarm compaction
D) Alarm attenuation

Question 42

When using trap-and-trace, the trace usually consists of a honeypot or padded cell and an alarm. _________________________

Question 43

For Linux or BSD systems, a tool called "Snow White" allows a remote individual to "mirror" entire Web sites. _________________________

Question 44

A(n) partially distributed IDPS control strategy combines the best of other IDPS strategies. _________________________

Question 45

A(n) __________ is an event that triggers an alarm when no actual attack is in progress.

A) false neutral
Attack stimulus 
C) false negative
D) noise

Question 46

When a collection of honeypots connects several honeypot systems on a subnet, it may be called a(n) honeynet. _________________________

Question 47

A(n) __________ IDPS is focused on protecting network information assets.

A) network-based
B) host-based 
C) application-based
D) server-based

Question 48

A(n) log file monitor is similar to an NIDPS. _________________________

Question 49

A padded cell is a hardened honeynet. _________________________

Question 50

Activities that scan network locales for active systems and then identify the network services offered by the host systems are known as __________.

A) port knocking
B) doorknob rattling 
C) footprinting
D) fingerprinting

Question 51

The disadvantages of using the honeypot or padded cell approach include the fact that the technical ​implications of using such devices are not well understood. _________________________

Question 52

A wireless security toolkit should include the ability to sniff wireless traffic, scan wireless hosts, and assess the level of privacy or confidentiality afforded on the wireless network. _________________________

Question 53

Intrusion __________ activities finalize the restoration of operations to a normal state and seek to identify the source and method of the intrusion in order to ensure that the same type of attack cannot occur again.

A) prevention
B) reaction 
C) detection
D) correction

Question 54

A(n) __________ works like a burglar alarm in that it detects a violation (some system activities analogous to an opened or broken window) and activates an alarm.

A) IDPS
B) WiFi 
C) UDP
D) DoS

Question 55

A(n) port is the equivalent of a network channel or connection point in a data communications system. _________________________

Question 56

Enticement is the action of luring an individual into committing a crime to get a conviction. _________________________

Question 57

The primary advantages of a centralized IDPS control strategy are cost and ease of use. _________________________

Question 58

A(n) monitoring vulnerability scanner is one that listens in on the network and determines vulnerable versions of both server and client software. _________________________

Question 59

Port explorers are tools used both by attackers and defenders to identify (or fingerprint) the computers that are active on a network, as well as the ports and services active on those computers, the functions and roles the machines are fulfilling, and other useful information. _________________________

Question 60

Fingerprinting is the organized research of the Internet addresses owned or controlled by a target organization. _________________________

Question 61

The ability to detect a target computer's __________ is very valuable to an attacker.

A) manufacturer
B) operating system  
C) peripherals
D) BIOS

Question 62

Most network behavior analysis system sensors can be deployed in __________ mode only, using the same connection methods as network-based IDPSs.

A) passive
B) active 
C) reactive
D) dynamic

Question 63

Network behavior analysis system __________ sensors are typically intended for network perimeter use, so they are deployed in close proximity to the perimeter firewalls, often between the firewall and the Internet border router to limit incoming attacks that could overwhelm the firewall.

A) inline
B) offline 
C) passive
D) bypass

Question 64

Which of the following ports is commonly used for the HTTP protocol  

A) 20
B) 25 
C) 53
D) 80

Question 65

In TCP/IP networking, port __________ is not used.

A) 0
B) 1 
C) 13
D) 1023

Question 66

Using __________, the system reviews the log files generated by servers, network devices, and even other IDPSs.

A) LFM
B) stat IDPS 
C) AppIDPS
D) HIDPS

Question 67

A(n) __________ is a software program or hardware appliance that can intercept, copy, and interpret network traffic.

A) packet scanner
B) packet sniffer 
C) honeypot
D) honey packet

Question 68

__________ are usually passive devices and can be deployed into existing networks with little or no disruption to normal network operations.

A) NIDPSs
B) HIDPSs 
C) AppIDPSs
D) SIDPSs

Question 69

A __________ vulnerability scanner listens in on the network and identifies vulnerable versions of both server and client software.

A) passive
B) aggressive 
C) active
D) secret

Question 70

To determine whether an attack has occurred or is underway, NIDPSs compare measured activity to known __________ in their knowledge base.

A) vulnerabilities
B) fingerprints 
C) signatures
D) footprints

Question 71

__________ testing is a straightforward testing technique that looks for vulnerabilities in a program or protocol by feeding random input to the program or a network running the protocol.

A) Buzz
B) Fuzz 
C) Spike
D) Black

Question 72

__________ is the action of luring an individual into committing a crime to get a conviction.

A) Entrapment
B) Enticement 
C) Intrusion
D) Padding

Question 73

Which of the following is NOT a described IDPS control strategy  

A) centralized
B) fully distributed 
C) partially distributed
D) decentralized

Question 74

A(n) __________ port, also known as a monitoring port, is a specially configured connection on a network device that is capable of viewing all of the traffic that moves through the entire device.

A) NIDPS
B) SPAN 
C) DPS
D) IDSE

Question 75

Some vulnerability scanners feature a class of attacks called _________, that are so dangerous they should only be used in a lab environment.

A) aggressive
B) divisive 
C) destructive
D) disruptive

Question 76

To use a packet sniffer legally, the administrator must __________.

A) be on a network that the organization owns
B) be under direct authorization of the network's owners 
C) have knowledge and consent of the content's creators
D) All of the above

Question 77

__________ are decoy systems designed to lure potential attackers away from critical systems.

A) Honeypots
B) Bastion hosts 
C) Wasp nests
D) Designated targets

Question 78

A(n) ____________________ occurs when an attacker attempts to gain entry or disrupt the normal operations of an information system, almost always with the intent to do harm.

Question 79

__________ benchmark and monitor the status of key system files and detect when an intruder creates, modifies, or deletes monitored files.

A) NIDPSs
B) HIDPSs 
C) AppIDPSs
D) SIDPSs

Question 80

__________ applications use a combination of techniques to detect an intrusion and then trace it back to its source.

A) Honeynet
B) Trap-and-trace 
C) HIDPS
D) Packet sniffer