IDS/IPS Architectures

Question 1

Which type of tap makes the sniffed traffic available on many different
output ports connected to different types of monitoring devices?

Answer 1

Regeneration Tap

Question 2

Which of the following will have a positive impact on your sensor processing
speed?

Answer 2

small number of signatures

Question 3

Which type of tap takes the RX and TX signals and combines them back into
full-duplex traffic and sends it to a monitoring port?

Answer 3

port aggregator

Question 4

What event will take place when valid traffic is dropped by an Intrusion
Prevention System (IPS) as a result of rules that may not be correct or may
not be tuned for your specific site?

Answer 4

false positive

Question 5

Which of the following are a hybrid use of both a switch and tap?

Answer 5

span tap

Question 6

Which type of tap will split the signal and offer bandwidth and distance
benefits?

Answer 6

Fiber

Question 7

Which of the following command’s is used to associate a physical interface
(such as eth1 or eth2) with a logical interface?

Answer 7

???

Question 8

Which of the following is NOT a concern when using a span port on a
switch?

Answer 8

???

Question 9

Which device bleeds off the existing signal of traffic for capture?

Answer 9

tap

Question 10

Which of the following is an inexpensive low-end solution for half-duplex
traffic, and is best used on networks where throughput is low?

Answer 10

Hub

Question 11

Which of the following tools captures, indexes and correlates real-time
data in a searchable repository from which it can generate graphs, reports,
alerts, dashboards and visualizations?

Answer 11

Splunk – yeah right!

Question 12

What is not an advantage of correlating IDS log data?

Answer 12

Reduced volume of data required for analysis

Question 13

Which of the following correlation methods will compare the condition of a
host to an attack?

Statistical
Rule-based
Flow-based
Behavioral

Answer 13

statistical ??

Question 14

When correlating data, there are four primary tasks. Which task is required
because different devices have different log formats that need to be
standardized?

Stored in a database
Normalization
Common encoding
Data acquisition

Answer 14

Normalization

Question 15

Which of the following services must be used to help correlate log files
between multiple sources on a network?

SNMP
NTP
Syslog
NNTP

Answer 15

NTP

Question 16

Which of the following will parse data from network, security, or system
devices and reorganize the data into a uniform format that can easily be
searched?

Intrusion Prevention System
Security Information Manager
Unified Threat Management Platform
Intrusion Detection System

Answer 16

Security Information Manager