Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CSS 537 > IDS and IPSec > Flashcards

IDS and IPSec Flashcards

1
Q

What is an intrusion detection system?

A

A system’s second line of defense that monitors events and analyzes them for signs of intrusions.

Intrusions are defined as attempts to compromise confidentiality, integrity, or availability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the primary function of a firewall?

A

Perimeter security by deciding which packets are allowed or denied, and which must be modified before passing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is a limitation of firewalls?

A

Cannot detect security breaches associated with traffic that does not pass through it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is an insider attack?

A

The most difficult type of attack to detect and prevent, often motivated by revenge or a feeling of entitlement.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Define masquerader.

A

An unauthorized user who penetrates a system’s access controls to exploit a legitimate user’s privileges.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Define misfeasor.

A

A legitimate user who is authorized for access but misuses their privileges.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a clandestine user?

A

An individual who seizes supervisory control of the system and uses this control to evade auditing and access controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are common behaviors of hackers?

A
  • Map network for accessible services
  • Identify potentially vulnerable services
  • Use brute force methods
  • Install remote administration tools
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What does an intrusion detection system (IDS) enable?

A

Collection of information about intrusion techniques that can be used to strengthen intrusion prevention measures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are false positives in intrusion detection?

A

An intrusion is reported when none has actually occurred.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are false negatives in intrusion detection?

A

Fails to identify an actual intrusion when one has occurred.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a true positive in the context of IDS?

A

An event the IDS accurately identifies as an intrusion.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the goal of an effective IDS?

A
  • Maximize true positives
  • Minimize false positives and false negatives
  • Minimize time spent verifying attacks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a host-based IDS (HIDS)?

A

Monitors single host activity, detects intrusions, logs suspicious events, and sends alerts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is signature/misuse detection?

A

Detection method that compares known malicious data patterns with current behavior.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is rule-based anomaly detection?

A

Analyzes historical audit records to identify usage patterns and generate rules that describe those patterns.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is an anomalous behavior?

A

Anything that deviates from the baseline of normal behavior will be flagged and logged as anomalous.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is statistical anomaly detection?

A

Collection of data relating to the behavior of legitimate users over time to identify illegitimate behavior.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the base-rate fallacy in IDS?

A

An IDS should detect a substantial percentage of intrusions while keeping the false alarm rate at an acceptable level.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What does a network-based IDS (NIDS) monitor?

A

Network traffic at selected points, examining the traffic packet by packet in real time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is a honeypot?

A

Decoy systems designed to lure potential attackers and collect information about their activity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is the difference between low interaction and high interaction honeypots?

A
  • Low interaction: Emulates specific IT services
  • High interaction: A real system with a full operating system and applications
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is Snort?

A

A lightweight IDS that can function as a packet sniffer and network intrusion detection system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are the two protocols used in IPSec?

A
  • Authentication Header (AH)
  • Encapsulation Security Protocol (ESP)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What is the purpose of the Security Association (SA) in IPSec?
Establishes a network-layer logical connection between source and destination entities.
26
What are the three situations for IPSec architecture?
* Host-to-host * Host-to-gateway * Gateway-to-gateway
27
What does the Encapsulation Security Protocol (ESP) provide?
Source authentication, data integrity, and confidentiality.
28
Fill in the blank: An IDS should detect a substantial percentage of intrusions while keeping the false alarm rate at an acceptable level, otherwise it provides a _______.
[false sense of security]
29
What is a common logging component for all types of IDS?
Timestamp, connection/session ID, event/alert type, rating, source and destination IP addresses.
30
What is a main advantage of statistical anomaly-based intrusion detection systems?
Can detect 'zero days' or extremely new attacks.
31
What is a disadvantage of signature/misuse detection?
Fails to detect new attack types and variants of known attacks.
32
What is the primary purpose of IPSec?
To secure Internet Protocol communications.
33
What uniquely identifies a Security Association (SA)?
The Destination Address in the IPv4 or IPv6 header and the SPI in the enclosed extension header.
34
What does SPI stand for in the context of IPSec?
Security Parameters Index.
35
What is the length of the Security Parameters Index (SPI)?
32-bit unsigned integer.
36
What does the Security Protocol Identifier indicate?
Whether the association is an AH or ESP.
37
What information does a Security Association (SA) store?
Parameters including SPI, origin SA interface, destination SA interface, type of encryption used, encryption key, type of integrity check used, and authentication key.
38
What is the purpose of the Security Association Database (SAD)?
Defines the parameters associated with each SA.
39
What is the function of the Security Policy Database (SPD)?
Determines if a given datagram should use IPSec.
40
What do selectors in the SPD do?
Filter outgoing traffic based on IPs and upper-layer protocol field values.
41
What happens to a packet if no match is found in the SPD?
The packet is discarded.
42
True or False: If the SPD policy is BYPASS, the packet is forwarded without further IPSec processing.
True.
43
What does the anti-replay service protect against?
Replay attacks where an attacker resends a copy of an authenticated packet.
44
What is the maximum sequence number limit for IPSec?
232-1.
45
What does the Authentication Header (AH) provide?
Source authentication and data integrity.
46
What are the key components of the Encapsulation Security Payload (ESP)?
* SPI * Sequence Number * Payload data * Padding * Pad length * Next header * Integrity check
47
What does ESP provide that AH does not?
Confidentiality of message content.
48
Fill in the blank: The IPsec transport mode protects the _______ of an IP packet.
payload.
49
In tunnel mode, what does ESP encrypt?
The entire inner IP packet, including the inner IP header.
50
What is a security association bundle?
A sequence of SAs through which traffic must be processed to provide desired IPSec services.
51
What is the purpose of the Internet Key Exchange (IKE)?
Mutual authentication, shared secret establishment, crypto algorithms negotiation, and security association establishment.
52
What are the two types of key management in IPSec?
* Manual * Automatic
53
What is the default automated key management protocol of IPSec?
ISAKMP/Oakley protocol.
54
What is the main advantage of IKE over traditional key exchange methods?
It retains the advantages of Diffie-Hellman while countering its weaknesses.
55
What are cookies used for in IKE?
To thwart clogging attacks.
56
True or False: IKE allows for the negotiation of security attributes.
True.
57
What does Phase 1 of IKE establish?
A secure, authenticated channel between two computers.
58
What is negotiated during Phase 2 of IKE?
IPsec Security Associations (AH, ESP).
59
What port does IKE Phase 1 exchange use?
UDP Port 500.
60
What protocols does AH and ESP use?
* AH uses IP protocol 51 * ESP uses IP protocol 50
61
What is the purpose of the IKE payload types?
To define various elements needed for establishing, negotiating, modifying, and deleting SAs.
62
What combination of security does the Transport-Tunnel bundle provide?
Authentication before encryption between two hosts.
63
What is a common example of a cryptographic suite in IKE?
Suite VPN A relies on 3DES and HMAC.
64
What is the recommended cryptographic suite for new VPNs using IPSec?
Suite VPN B, which relies on AES.

CSS 537 (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions