Question 1

DNS can use services of________using the well known port 53

Accepted Answer

DNS can use both UDP and TCP for its services. Typically, DNS uses UDP for query requests to keep the communication fast. However, when the response data size exceeds 512 bytes or for tasks like zone transfers, DNS uses TCP.

Question 2

In the DNS the names are defined in _____ sturucture

Accepted Answer

In the DNS (Domain Name System), names are defined in an inverted tree structure, where the root is at the top and branches out to more specific domains.

Question 3

The root of DNS tree is____

Accepted Answer

The root of the DNS (Domain Name System) tree is represented by an empty string, indicating the top-level of the DNS hierarchy.

Question 4

A full domain name is sequence of lables seperated by____

Accepted Answer

A full domain name is a sequence of labels separated by dots. Each label is a fragment of the domain name, and the dots serve to delimit these labels from one another.

Question 5

When discussing IDS/IPS, what is a signature?

Accepted Answer

Signatures in the context of Intrusion Detection Systems (IDS) or Intrusion Prevention Systems (IPS) refer to patterns of activity or code that correspond to known attacks. These signatures are used to detect and potentially block malicious activities.

Question 6

Which is true of a signature-based IDS?

Accepted Answer

Signature-based IDS identifies threats by comparing the incoming traffic against a database of known attack patterns or signatures. It does not detect new, unknown anomalies; it requires prior knowledge of attack signatures to identify threats.

Question 7

A false positive can be defined as:

Accepted Answer

A false positive in the context of system security refers to an alert that signals potential malicious activity which, after further investigation, is found to be benign or legitimate activity. This is in contrast to a true positive (B), where the activity is indeed malicious, or a false negative (C), where malicious activity goes undetected.

Question 8

The features of traditional IPSes are found in all of these modern systems, except:

Accepted Answer

Antimalware primarily focuses on preventing, detecting, and removing malicious software on individual devices rather than monitoring and controlling network traffic for malicious activities, which is the main function of traditional Intrusion Prevention Systems (IPS).

Question 9

How does machine learning benefit IDSes/IPSes?

Accepted Answer

The answer of How does machine learning benefit IDSes/IPSes?
...

Quiz 2: DNS, IDS/IPS, and Digital Investigations