Domain 6 set 1 Flashcards
1
Q
5 steps in an attack
A
- Reconnaissance
- Foot-printing (Mapping the Network) Nmap
- Fingerprinting (port scanning)
- Vulnerability assessment (identifying weaknesses)
- The Attack
2
Q
Red Team?
A
ATTACK
3
Q
Blue Team
A
Defend
4
Q
IDS is passive or active ?
A
passive
5
Q
IDS and IPS need what to view traffic
A
Port mirroring / span
6
Q
the interface need to be in what mode for a IDS
A
Promiscuous Mode
7
Q
use what ids type for a single system
A
Host-based IDS (HIDS)
8
Q
use what ids type for a network segment
A
Network-based IDS (NDIS)
9
Q
Analysis Engine on a IDS does what?
A
Analyzes data collected by the sensor, determines if there is suspicious activity
10
Q
the 4 parts of an IDS
A
- Sensors
- Analysis Engine
- Signature Database
- User Interface and reporting
11
Q
What IDS decrypt data?
A
Host-based IDS (HIDS)
12
Q
A sensor is sometimes called what
A
Traffic Collector
13
Q
the two analysis engines?
A
- Pattern matching
2. profile matching
14
Q
Anomaly / behavior is what type of analysis engines?
A
profile matching
15
Q
analysis engine that needs a baseline
A
profile matching
