CTC 452 Quiz 6
19 test answers
Unlock all answers in this set
Unlock answers 19question
Which of the following is NOT a primary detection methodology?
answer
Baseline Detection
Unlock the answer
question
Which of the following is true about an HIDPS?
answer
Monitors OS and application logs
Unlock the answer
question
An IDPS consists of a single device that you install between your firewall and the Internet.
answer
False
Unlock the answer
question
Which of the following is an IDPS security best practice?
answer
Communication between IDPS components should be encrypted
Unlock the answer
question
What is an advantage of the anomaly detection method?
answer
System can detect attacks from inside the network by people with stolen accounts
Unlock the answer
question
Which of the following is a sensor type that uses bandwidth throttling and alters malicious content?
answer
Inline Only
Unlock the answer
question
Which of the following is true about the steps in setting up and using an IDPS?
answer
False positives do not compromise network security
Unlock the answer
question
Which of the following is NOT a method used by passive sensors to monitor traffic?
answer
Packet Filter
Unlock the answer
question
Which of the following is NOT a network defense function found in intrusion detection and prevention systems?
answer
Identification
Unlock the answer
question
Which of the following is an advantage of a signature-based detection system?
answer
Each signature is assigned a number and name
Unlock the answer
question
Which type of IDPS can have the problem of getting disparate systems to work in a coordinated fashion?
answer
Hybrid
Unlock the answer
question
A hybrid IDPS combines aspects of NIDPS and HIDPS configuration
answer
True
Unlock the answer
question
Why might you want to allow extra time for setting up the database in an anomaly-based system?
answer
to allow a baseline of data to be compiled
Unlock the answer
question
Which method for detecting certain types of attacks uses an algorithm to detect suspicious traffic, is resource intensive, and requires extensive tuning and maintenance?
answer
heuristic
Unlock the answer
question
If you see a /16 in the header of a snort rule, what does it mean?
answer
the subnet mask is 255.255.0.0
Unlock the answer