Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Sec > L12 - Intrusion Detection > Flashcards

L12 - Intrusion Detection Flashcards

1
Q

A system that tries to stop intrusion from happening

a) Firewalls
b) Intrusion Detection System (IDS)

A

a) Firewalls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

A system that tries to evaluate an intrusion after it has happened

a) Firewalls
b) Intrusion Detection System (IDS)

A

b) Intrusion Detection System (IDS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

A system that watches for intrusions that start within the system

a) Firewalls
b) Intrusion Detection System (IDS)

A

b) Intrusion Detection System (IDS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

A system that limits access between networks to prevent intrusion

a) Firewalls
b) Intrusion Detection System (IDS)

A

a) Firewalls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

An intruder can also be referred to as a hacker or cracker

a) True
b) False

A

a) True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Activists are either individuals or members of an organized crime group with a goal of financial reward

a) True
b) False

A

b) False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Running a packet sniffer on a workstation to capture usernames and passwords is an example of intrusion

a) True
b) False

A

a) True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Those who hack into computers do so for the thrill of it or for status

a) True
b) False

A

b) False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Intruders typically use steps from a common attack methodology

a) True
b) False

A

a) True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which describes the following backdoor: Compiler backdoors

a) This backdoor is hard to detect because it modifies machine code
b) This backdoor can only be used by the person who created it, even if it is discovered by others
c) This backdoor inserts backdoors into other programs during compilation

A

c) This backdoor inserts backdoors into other programs during compilation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which describes the following backdoor: Object Code backdoors

a) This backdoor is hard to detect because it modifies machine code
b) This backdoor can only be used by the person who created it, even if it is discovered by others
c) This backdoor inserts backdoors into other programs during compilation

A

a) This backdoor is hard to detect because it modifies machine code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Which describes the following backdoor: Asymmetric backdoors

a) This backdoor is hard to detect because it modifies machine code
b) This backdoor can only be used by the person who created it, even if it is discovered by others
c) This backdoor inserts backdoors into other programs during compilation

A

b) This backdoor can only be used by the person who created it, even if it is discovered by others

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

For Anomaly detection systems, the longer the system is in use, the more it learns about network activity

a) True
b) False

A

a) True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

For Anomaly detection systems, if malicious activity looks like normal traffic to the system, it will not detect an attack

a) True
b) False

A

a) True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

For Anomaly detection systems, false positives can become a problem, normal usage can be mistaken for an attack

a) True
b) False

A

a) True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

For Signature Based detection systems, new threats can be detected immediately

a) True
b) False

A

b) False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

For Signature Based detection systems, when a new virus is identified, it must be added to the signature databases

a) True
b) False

A

a) True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

For Signature Based detection systems, it can only detect an intrusion attempt if it matches a pattern that is in the database

a) True
b) False

A

a) True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Could the following be considered an anomaly to typical network traffic: IP address

a) True
b) False

A

a) True

If an IP address is not normally accessed by users (or is unknown) then it can be considered an anomaly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Could the following be considered an anomaly to typical network traffic: Port Address

a) True
b) False

A

a) True

If a port address is not normally accessed by users (or is unknown) then it can be considered an anomaly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Could the following be considered an anomaly to typical network traffic: Packet Length

a) True
b) False

A

a) True

If the length is unusually long

22
Q

Could the following be considered an anomaly to typical network traffic: Flag setting

a) True
b) False

A

a) True

If a flag is not normally seen in normal traffic conditions, then it can be considered an anomaly

23
Q

Any action that does not fit the normal behavior profile is considered an attack in a:

a) Statistical approach
b) Knowledge based approach

A

a) Statistical approach

24
Q

Any action that does not classified as normal is considered an attack in a:

a) Statistical approach
b) Knowledge based approach

A

b) Knowledge based approach

25
Q

Which describes the Machine Learning approach for Intruder detection

a) Detects new and novel attacks
b) Detects attacks similar to past attacks

A

b) Detects attacks similar to past attacks

26
Q

In the thriving zero day attack marketplace hackers sell information on software vulnerabilities. Who are some of the buyers?

a) Apple
b) Google
c) Microsoft
d) US Government

A

All of the above

27
Q

An attacker sends various kinds of packets to probe a system or network for vulnerability that can be exploited. This is an example of

a) Scanning Attack
b) DOS
c) Penetration Attack

A

a) Scanning Attack

28
Q

Attempts to slow down or completely shut down a target so as to disrupt the service for legitimate users. This is an example of

a) Scanning Attack
b) DOS
c) Penetration Attack

A

b) DOS

29
Q

An attacker gains an unauthorized control of a system. This is an example of

a) Scanning Attack
b) DOS
c) Penetration Attack

A

c) Penetration Attack

30
Q

Can you think of a way to reduce the impact of excessive reporting on a system administrator?

A

Prioritization.

Add security levels associated with each alert. The admin can focus on high priority issues.

31
Q

Intrusion Detection is based on the assumption that the behavior of the intruder differs from that of a legitimate user in ways that can be quantified

a) True
b) False

A

a) True

32
Q

The primary purpose of an IDS is to detect intrusions, log suspicious events and send alerts

a) True
b) False

A

a) True

33
Q

Signature-based approaches attempt to define normal, or expected, behavior, whereas anomaly approaches attempt to define proper behavior

a) True
b) False

A

b) False

Signature-based approaches are typically used to represent known intrusion patterns

34
Q

A network IDS sensor monitors a copy of network traffic; the actual traffic does not pass through the device.

a) True
b) False

A

a) True

35
Q

Network-based intrusion detection makes use of signature detection and anomaly detection

a) True
b) False

A

a) True

36
Q

When using NIDS (Network Intrusion Detection System), it is good practice to set the IDS level to the highest sensitivity to detect every attack

a) True
b) False

A

b) False

Will lead to a lot of false alarms

37
Q

When using NIDS (Network Intrusion Detection System), it is good practice to monitor both outbound and inbound traffic

a) True
b) False

A

a) True

38
Q

When using NIDS (Network Intrusion Detection System), it is good practice to use a shared network resource to gather NIDS data

a) True
b) False

A

b) False

Attacker can disable IDS or modify alerts

39
Q

In a NIDS (Network Intrusion Detection System), NIDS sensors are not turnkey solutions, system administrators must interpret alerts

a) True
b) False

A

a) True

NIDS can produce many false positives

40
Q

Who can write rules for SNORT?

a) Users of SNORT
b) The SNORT community
c) Talos Security Intelligence and Research Team

A

All of the above

SNORT is open source

41
Q

A common location for a NIDS sensor is just inside the external firewall

a) True
b) False

A

a) True

42
Q

A Honeypot can be a workstation that a user uses for work

a) True
b) False

A

b) False

A Honeypot is not a real system, used by any user

43
Q

There is no benefit of deploying a NIDS or Honeypot outside of the external firewall

a) True
b) False

A

b) False

Setting up a Honeypot outside the external firewall will allow us to see what attacks are coming from the internet

44
Q

To improve performance, an IDS should reduce false alarm rate while detecting as many intrusions as possible

a) True
b) False

A

a) True

45
Q

To improve performance, an IDS should apply detection models at all unfiltered packet data directly

a) True
b) False

A

b) False

46
Q

To improve performance, an IDS should apply detection models at processed event data that has higher base rate

a) True
b) False

A

a) True

47
Q

An attacker can defeat an IDS by sending a huge amount of traffic

a) True
b) False

A

a) True

48
Q

An attacker can defeat an IDS by sending traffic that purposely matches detection rules

a) True
b) False

A

a) True

49
Q

An attacker can defeat an IDS by embedding attack packets that cause non-uniform processing by different OS (bad checksum, overlapping fragments)

a) True
b) False

A

a) True

50
Q

An attacker can defeat an IDS by sending a packet that would trigger a buffer-overflow in the IDS code

a) True
b) False

A

a) True

Sec (18 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions