Chapter 7 – Flashcards with Answers
Unlock all answers in this set
Unlock answersquestion
anomaly-based monitoring
answer
A monitoring technique used by an intrusion detection system (IDS) that creates a baseline of normal activities and compares actions against the baseline. Whenever there is a significant deviation from this baseline, an alarm is raised.
question
application-aware firewall
answer
A firewall that can identify the applications that send packets through the firewall and then make decisions about the applications.
question
application-aware IDS
answer
A specialized intrusion detection system (IDS) that is capable of using "contextual knowledge" in real time.
question
application-aware IPS
answer
An intrusion prevention system (IPS) that knows information such as the applications that are running as well as the underlying operating systems.
question
application-aware proxy
answer
A special proxy server that knows the application protocols that it supports.
question
behavior-based monitoring
answer
A monitoring technique used by an IDS that uses the normal processes and actions as the standard and compares actions against it.
question
content inspection
answer
Searching incoming web content to match keywords.
question
defense in depth
answer
A defense that uses multiple types of security devices to protect a network. Also called layered security.
question
demilitarized zone (DMZ)
answer
A separate network that rests outside the secure network perimeter: untrusted outside users can access the DMZ but cannot enter the secure network.
question
firewall rules
answer
A set of individual instructions to control the actions of a firewall.
question
heuristic monitoring
answer
A monitoring technique used by an intrusion detection system (IDS) that uses an algorithm to determine if a threat exists.
question
host-based intrusion detection system (HIDS)
answer
A software-based application that runs on a local host computer that can detect an attack as it occurs.
question
intrusion detection system (IDS)
answer
A device that detects an attack as it occurs.
question
layered security
answer
A defense that uses multiple types of security devices to protect a network. Also called defense in depth.
question
load balancer
answer
A dedicated network device that can direct requests to different servers based on a variety of factors.
question
malware inspection
answer
Searching for malware in incoming web content.
question
network access control (NAC)
answer
A technique that examines the current state of a system or network device before it is allowed to connect to the network.
question
network address translation (NAT)
answer
A technique that allows private IP addresses to be used on the public Internet.
question
network intrusion detection system (NIDS)
answer
A technology that watches for attacks on the network and reports back to a central device.
question
network intrusion prevention system (NIPS)
answer
A technology that monitors network traffic to immediately react to block a malicious attack.
question
protocol analyzer
answer
Hardware or software that captures packets to decode and analyze their contents.
question
proxy server
answer
A computer or an application program that intercepts user requests from the internal secure network and then processes those requests on behalf of the users.
question
remote access
answer
Any combination of hardware and software that enables remote users to access a local internal network.
question
reverse proxy
answer
A computer or an application program that routes incoming requests to the correct server.
question
router
answer
A device that can forward packets across computer networks.
question
signature-based monitoring
answer
A monitoring technique used by an intrusion detection system (IDS) that examines network traffic to look for well-known patterns and compares the activities against a predefined signature.
question
subnetting (subnet addressing)
answer
A technique that uses IP addresses to divide a network into network, subnet, and host.
question
switch
answer
A device that connects network segments and forwards only frames intended for that specific device or frames sent to all devices.
question
Unified Threat Management (UTM)
answer
Network hardware that provides multiple security functions.
question
URL filtering
answer
Restricting access to unapproved websites.
question
virtual LAN (VLAN)
answer
A technology that allows scattered users to be logically grouped together even though they may be attached to different switches.
question
virtual private network (VPN)
answer
A technology that enables use of an unsecured public network as if it were a secure private network.
question
VPN concentrator
answer
A device that aggregates VPN connections.
question
web application firewall
answer
A special type of application-aware firewall that looks at the applications using HTTP.
question
web security gateway
answer
A device that can block malicious content in real time as it appears (without first knowing the URL of a dangerous site).
