Intrusion Detection and Prevention Systems

A(n) works like a burglar alarm in that it detects a violation and activates an alarm.

What is a major advantage of a Heuristic-based IDS?

What is the primary characteristic of a signature-based IDS?

What is the primary function of a SIEM system?

Intrusion detection consists of procedures and systems that identify system intrusions and take steps to limit the intrusion and return operations to a normal state when an intrusion is detected.

An IDPS can be configured to call a phone number or perform another type of signal or message.

A false positive is the failure of an IDPS system to react to an actual attack event.

NIDPSs can reliably ascertain whether an attack was successful.

HIDPSs are also known as system integrity verifiers.

An HIDPS can monitor system logs for predefined events.

An HIDPS can detect local events on host systems and detect attacks that may elude a network-based IDPS.

An HIDPS is optimized to detect multihost scanning, and it is able to detect the scanning of non-host network devices, such as routers or switches.

The anomaly-based IDPS collects statistical summaries by observing traffic that is known to be normal.

IDPS responses can be classified as active or passive.

A passive IDPS response is a definitive action automatically initiated when certain types of alerts are triggered.

The Simple Network Management Protocol contains trap functions, which allow a device to send a message to the SNMP management console indicating that a certain threshold has been crossed, either positively or negatively.

In order to determine which IDPS best meets an organization's needs to consider the system environment, security goals and objectives, and the existing security policy.

Your organization's operational goals, constraints, and culture should not affect the selection of the IDPS and other security tools and technologies to protect your systems.

Among the considerations in evaluating an IDPS are the product's scalability, testing, support provisions, and ability to provide information on the source of attacks.

A fully distributed IDPS control strategy is an IDPS implementation approach in which all control functions are applied at the physical location of each IDPS component.

Security tools that provide decoy systems designed to lure potential attackers away from critical systems include honeypots, honeynets, and padded cell systems.

An IDPS helps to secure networks by identifying where the network needs securing.

Once the OS is known, the vulnerabilities to which a system is susceptible can more easily be determined.

The Metasploit Framework is a collection of exploits coupled with an interface that allows the penetration tester to automate the custom exploitation of vulnerable systems.

A passive vulnerability scanner is one that initiates traffic on the network in order to determine security holes.

Passive scanners are advantageous in that they can find client-side vulnerabilities that are typically not found by active scanners.

To use a packet sniffer legally, the administrator only needs to be on a network that the organization owns, and have authorization of the network's owners.

Alarm filtering and compaction is the process of grouping almost identical alarms that occur nearly at the same time into a single higher-level alarm.

A(n) event is an indication that a system has just been attacked or is under attack.

Alarm events that are accurate and noteworthy but do not pose significant threats to information security are called noise.

Avoidance is the process by which an attacker changes the format and/or timing of activities to avoid being detected by an IDPS.

The integrity value, which is based upon fuzzy logic, helps an administrator determine how likely it is that an IDPS alert or alarm indicates an actual attack in progress.

A(n) known vulnerability is a published weakness or fault in an information asset or its protective systems that may be exploited and result in loss.

The activities that gather public information about the organization and its network activities and assets is called fingerprinting.

In the process of protocol application verification, the NIDPSS look for invalid data packets.

A HIDPS is also known as a system validity verifier.

A(n) NIDPS functions on the host system, where encrypted traffic will have been decrypted and is available for processing.

Preconfigured, predetermined attack patterns are called signatures.

A(n) log file monitor is similar to an NIDPS.

The centralized IDPS implementation approach occurs when all detection functions are managed in a central location.

A(n) partially distributed IDPS control strategy combines the best of other IDPS strategies.

When a collection of honeypots connects several honeypot systems on a subnet, it may be called a(n) honeynet.

A hardened honeypot is also known as a protected cell system.

The disadvantages of using the honeypot or padded cell approach include the fact that the technical implications of using such devices are not well understood.

When using trap-and-trace, the trap usually consists of a honeypot or padded cell and a(n) packet sniffer.

Enticement is the illegal and unethical action of luring an individual into committing a crime to get a conviction.

Fingerprinting is the organized research of the Internet addresses owned or controlled by a target organization.

For Linux or BSD systems, a tool called "Sam Spade" allows a remote individual to “mirror” entire Web sites.

Port scanners are tools used both by attackers and defenders to identify (or footprint) the computers that are active on a network, as well as the ports and services active on those computers, the functions and roles the machines are fulfilling, and other useful information.

A(n) port is the equivalent of a network channel or connection point in a data communications system.

A(n) monitoring vulnerability scanner is one that listens in on the network and determines vulnerable versions of both server and client software.

Which of the following ports is commonly used for the HTTP protocol?

The ability to detect a target computer's is very valuable to an attacker.

Testing is a straightforward testing technique that looks for vulnerabilities in a program or protocol by feeding random input to the program or a network running the protocol.

Some vulnerability scanners feature a class of attacks called that are so dangerous they should only be used in a lab environment.

A vulnerability scanner listens in on the network and identifies vulnerable versions of both server and client software.

A(n) is a software program or hardware appliance that can intercept, copy, and interpret network traffic.

To use a packet sniffer legally, the administrator must

How does a signature-based IDPS differ from a behavior-based IDPS?

What is a SIEM and what is its primary purpose?

What is network footprinting and how is it related to network fingerprinting?

Flashcard Creation

Term

Definition

Hint

Memory Tip

Testing Effect

Active Retrieval

Core Concepts

Progressive Building

Atomic Concepts