CHAPTER 8 Flashcards
An intruder can also be referred to as a hacker or cracker.
T
Activists are either individuals or members of an organized crime
group with a goal of financial reward
F
Running a packet sniffer on a workstation to capture usernames and passwords is an example of intrusion
T
Those who hack into computers do so for the thrill of it or for status
T
Intruders typically use steps from a common attack methodology
T
The IDS component responsible for collecting data is the user interface.
F
Intrusion detection is based on the assumption that the behavior of the
intruder differs from that of a legitimate user in ways that can be quantified.
T
The primary purpose of an IDS is to detect intrusions, log suspicious
events, and send alerts.
T
Signature-based approaches attempt to define normal, or expected,
behavior, whereas anomaly approaches attempt to define proper behavior
F
Anomaly detection is effective against misfeasors
F
To be of practical use an IDS should detect a substantial percentage of
intrusions while keeping the false alarm rate at an acceptable level.
T
An inline sensor monitors a copy of network traffic; the actual traffic
does not pass through the device
F
A common location for a NIDS sensor is just inside the external
firewall.
T
Network-based intrusion detection makes use of signature detection
and anomaly detection
T
Snort can perform intrusion prevention but not intrusion detection.
F
