Deck 9: Internet and Network Forensics and Intrusion Detection

Question 1

What is designed to collect data straight from the network media?

A)Packet analyzers
B)Packet sniffers
C)Packet sifters
D)Packet lifters

Answer 1

B

Question 2

Which of the following is considered the BEST answer in defining DHCP?

A)They dynamically assign IP addresses.
B)They dynamically assign IP addresses to servers.
C)They dynamically assign IP addresses to computers.
D)They dynamically assign IP addresses to computers on a network.

Answer 2

D

Question 3

Which of the following is NOT a component of an NFAT system?

A)Agents
B)Server
C)Logs
D)Examiner computer

Answer 3

C

Question 4

NFAT tools discussed in this chapter include all of the following features EXCEPT

A)Real-time network data capture
B)Command-line interface
C)Content analysis
D)Reporting

Question 5

Which type of firewall acts as a mediator between internal hosts and external connections such as the Internet?

A)Network layer firewall
B)Application layer firewall
C)Proxy firewall
D)Internet firewall

Question 6

What is considered as the first attempt to address the increasing number of attacks on networks?

A)MIDs
B)GUIDs
C)NATs
D)IDSs

Question 7

?What is considered as the primary problem associated with enterprise-level IDS tools?

A)The slowing of the network
B)The complexity of the program
C)The amount of data collected
D)The cost

Question 8

What is considered to be the first line of defense for networks?

A)IDSs
B)Firewalls
C)Routers
D)Switches

Question 9

The ________ is a major source of forensic data in both the stand-alone and network forensic fields.

Question 10

NFAT systems generally require large amounts of storage space,such as a(n)________ system.

Question 11

An IDS is considered by most system administrators to be a(n)________ security system.

Question 12

A(n)________ is the standard operation procedures of the network when it is running normally.

Question 13

Which of the following data-capture methods uses a filtering system approach?

A)Stop,look,and listen
B)Catch it as you can
C)Filter as you scan
D)Detect and filter

Question 14

The newest NFAT systems are a combination of

A)IDS and application software
B)IDS and forensic software
C)Agents and application software
D)DHCP servers and IDSs

Question 15

What device holds two network interface cards and records all data passing through it?

A)WAP
B)TAP
C)SPAN
D)Host inline device

Question 16

The NFAT software usually contains a query language such as

A)IMS
B)IIS
C)SQL
D)PHP

Question 17

Identifying situations such as regular spikes in late-night traffic is an example of

A)Pattern analysis
B)Content analysis
C)Playback analysis
D)Timeline sequencing analysis

Question 18

________ have the capability to map internal IP addresses in such a way that they appear to be part of another network.

Question 19

Using an NFAT system,an event or security breach can be

A)Detected
B)Monitored
C)Traced in real-time
D)All are correct

Question 20

Determining the date and time of an event can be a problem with multiple devices on a network because

A)Only certain devices record dates and times
B)Device clocks tend to drift slightly
C)It can be a challenge to locate where the date and time are recorded
D)Time stamps cannot be used for network devices

Question 21

________ transmit and receive data via radio frequency in the open.

Question 22

________ Software allows you to forensically search for data on your entire network using nothing more than keywords or phrases.

Question 23

Software clients called ________ installed on network devices are designed to collect information from the host.

Question 24

________ analysis is also known as deep packet inspection.

Question 25

NFAT software can be configured to accept input from almost any device that generates a(n)________ file.

Question 26

A(n)________ repeats all data received on any port to the remaining ports;it is gradually being replaced by switches and SPAN systems.

Question 27

The generation of logs on devices such as routers,proxies,and firewalls should always be set to the ________ at which your network can operate.

Question 28

The feature of modern switches called ________ duplicates the information going into a port to the SPAN port.

Question 29

A problem that can occur with IDS alerts is ________,when an IDS mistakenly flags an innocent file as being suspicious.

Question 30

_______ Software has taken steps to preserve the integrity of the data collected from the agents via encryption both from agent to server and from the examiner's station to server.