Formative 11 Flashcards
What is the host-based intrusion detection tool that is integrated into Security Onion?
Sguil
Wireshark
Snort
OSSEC
OSSEC
Which tool is included with Security Onion that is used by Snort to automatically download new rules?
ELK
Sguil
Wireshark
PulledPork
PulledPork
Which tool included in Security Onion is an interactive dashboard interface to Elasticsearch data?
Zeek
Kibana
Sguil
Wireshark
Kibana
Which NIDS tool uses a signature-based approach and native multithreading for alert detection?
Bro
Suricata
Zeek
Snort
Suricata
Which tool is a Security Onion integrated host-based intrusion detection system?
Wazuh
Zeek
Snort
Suricata
Wazuh
What are three analysis tools that are integrated into Security Onion? (Choose three.)
Kibana
Sguil
Wireshark
Snort
OSSEC
Suricata
Kibana
Sguil
Wireshark
What function is provided by Snort as part of the Security Onion?
to normalize logs from various NSM data logs so they can be represented, stored, and accessed through a common schema
to generate network intrusion alerts by the use of rules and signatures
to view pcap transcripts generated by intrusion detection tools
to display full-packet captures for analysis
to generate network intrusion alerts by the use of rules and signatures
What classification is used for an alert that correctly identifies that an exploit has occurred?
false negative
true positive
false positive
true negative
true positive
Which type of analysis relies on predefined conditions and can analyze applications that only use well-known fixed ports?
deterministic
log
statistical
probabilistic
deterministric
Which type of analysis relies on different methods to establish the likelihood that a security event has happened or will happen?
log
deterministic
statistical
probabilistic
probabilistic
Which alert classification indicates that exploits are not being detected by installed security systems?
false negative
false positive
true negative
true positive
false negative
Which tool would an analyst use to start a workflow investigation?
Snort
ELK
Sguil
Zeek
Sguil
