quiz 11

Question 1

In a signature-based monitoring environment, network traffic is analyzed for predetermined attack patterns.

Answer 1

True—Signature-based monitoring analyzes network traffic for predetermined attack patterns known as signatures stored in a database.

Question 2

Behavior-based monitoring establishes a performance baseline based on a set of normal network traffic evaluations.

Answer 2

False—Behavioral-based monitoring looks at previous behavior of applications and compares that to current activity on the system.

Question 3

Anomaly-based monitoring uses predetermined attack patterns.

Answer 3

False—Anomaly-based monitoring establishes a performance baseline based on a set of normal network traffic evaluations. Signature-based monitoring uses predetermined attack patterns.

Question 4

Baselining is the process of measuring changes in networking.

Answer 4

True—Creating a baseline consists of selecting something to measure and measuring it consistently for a period of time; baselining is the process of measuring changes.

Question 5

A broadcast storm is when the TCP/IP handshake has been compromised.

Answer 5

False—A broadcast storm is when there is an accumulation of protest animal key cast packet traffic on the LAN.

Question 6

By default, Wireshark is nonpromiscuous.

Answer 6

False—By default, Wireshark is promiscuous, which means it can delve into packets even if the packets were addressed to a different computer.

Question 7

Network Monitor requires Windows server to run.

Answer 7

True—Windows Server 2003 and 2008 come with built-in versions of Network Monitor; the program does not run on Windows client operating systems.

Question 8

An SNMP agent is software run on a server to monitor the network.

Answer 8

False—SNMP agents are software deployed by an NMS and loaded on monitored devices.

Question 9

An NMS is the software run on one or more servers that control the monitoring of network attached devices and computers.

Answer 9

True—An NMS (network management system) controls the monitoring of SNMP-enabled devices.

Question 10

SNMP uses port 143.

Answer 10

False—SNMP uses ports 161 and 162. IMAP uses 143.

Question 11

When conducting an audit, what should be done after risk has been scanned for, analyzed, and calculated?
A. Define exactly what should be audited.
B. Create backups.
C. Create a list of vulnerabilities.
D. Develop a plan to mitigate risk.

Answer 11

D. After risk has been scanned for, analyzed, and calculated, a plan should be developed to mitigate those risks.

Question 12

Which of the following is not part of the three-step auditing process? 
A. Enabling auditing for files. 
B. Turning on and auditing policy. 
C. Evaluating the system log. 
D. Reviewing the security log.

Answer 12

C. The system log doesn’t play into the auditing process; it deals with drivers, operating system files, and so on.

Question 13

A person complains that he cannot see any events in the Event Viewer. Which of the following questions should you not ask the person?
A. Did you reboot your computer?
B. Has auditing been turned on in a policy?
C. Was auditing enabled for the individual objects?
D. Do you have administrative capabilities?

Answer 13

A. It is not necessary to ask the users whether they rebooted the computer. This will not affect whether they can see events in the Event Viewer.

Question 14

Which of the following questions should you take into account when securing log files? (Select the two best answers.)
A. Were the log files encrypted and hashed?
B. Are the logs stored in multiple locations?
C. Were the log files encrypted in a Kerberos system?
D. How big are the log files?

Answer 14

A and B. It is important to find out if log files have been encrypted, hashed, and where they are stored. Log files would not be stored in a Kerberos system. The size of log files deals more with log file maintenance than it does with security.

Question 15

Which file would you set permissions on to protect the security log on Windows Server 2003? 
A. config 
B. system.log1 
C. SecEvent.evt 
D. Security.log

Answer 15

C. SecEvent.evt is the file you would set permissions on to protect the security log on Windows Server 2003. This file may have a different name depending on which Windows operating system you are working in.

Question 16

Which of the following is not an example of a default hidden share? 
A. IPC$ 
B. Security$ 
C. Admin$ 
D. C$

Answer 16

B. Security$ is not a hidden share. All the others listed are default hidden shares in Windows.

Question 17

Which of the following best describes an audit trail?
A. Records or logs that show the tracked actions of users
B. Ensuring that a person or group cannot refute the validity of your proof
C. Files that log activity of users
D. Software deployed via the network management system

Answer 17

A. An audit trail can best be described as records or logs that show the tracked actions of users, whether the user was successful in an attempt.

Question 18

Which tool can be instrumental in capturing FTP GET requests? 
A. Vulnerability scanner 
B. Port scanner 
C. Performance Monitor 
D. Protocol analyzer

Answer 18

D. A protocol analyzer captures data, including things such as GET requests that were initiated from an FTP client. Vulnerability scanners and port scanners look for open ports and other vulnerabilities of a host. Performance Monitor is a Windows program that reports on the performance of the computer system and any of its parts.

Question 19

You are setting up auditing on a Windows XP Professional computer. If set up properly, which log should have entries? 
A. Application log 
B. System log 
C. Security log 
D. Maintenance log

Answer 19

C. After Auditing is turned on and specific resources are configured for auditing, you need to check the Event Viewer’s Security log for the entries. These could be successful logons or misfired attempts at deleting files; there are literally hundreds of options. The Application log contains errors, warnings, and informational entries about applications. The System log deals with drivers, system files, and so on. A System Maintenance log can be used to record routine maintenance procedures.

Question 20

Which of the following is the most basic form of IDS? 
A. Anomaly-based 
B. Behavioral-based 
C. Signature-based 
D. Statistical-based

Answer 20

C. Signature-based IDS is the most basic form of intrusion detection systems or IDS. This monitors packets on the network and compare them against a database of signatures. Anomaly-based, behavioral-based, and statistical-based are all more complex forms of IDS. Anomaly and statistical are often considered to be the same type of monitoring methodology.