Monitoring and Analysis
Unlock all answers in this set
Unlock answersquestion
Which of the following is not true concerning a padded cell?
answer
Is often place inside a honey pot
question
Which of the following is not included in a system level audit event? (Select two)
answer
-Names of accessed files -any actions performed by the user
question
Which IDS method searches for intrusion or attack attempts by recognizing patterns or identities listed in a database?
answer
Signature based
question
A recreation of historical events is made possible through?
answer
Audit Trails
question
Network-based intrusion detection system is most suited to detect and prevent which types of attacks?
answer
Bandwidth-based Denial of Service
question
What is the purpose of audit trails?
answer
Detect security-violating events
question
A honey pot is used for what purpose?
answer
To delay intruders in order to gather auditing data
question
Which of the following is a collection of recorded data that may include details bout logons, object access, and other activities deemed important by your security policy that is often used to detect unwanted and unauthorized user activity?
answer
Audit trail
question
What actions can a typical passive Intrusion Detection System (IDS) take when it detects an attack? (Select two)
answer
-An alert is generated and delivered via e-mail, the consoles, or an SNMP trap -The IDS logs all pertinent data about the intrusion
question
Audit trails produced by auditing activities are considered what type of security control?
answer
Detective
question
The auditing feature of an operating system serves as what form of control when users are informed that their actions are being monitored?
answer
Preventive
question
Network-based intrusion detection systems (IDS) are able to detect which type of attacks? (Select two)
answer
-Port scanning -Denial of service
question
Which of the following is a security service that monitors network traffic in real time or reviews the audit logs on servers looking for security violations?
answer
IDS
question
What security mechanism can be used to detect attacks originating on the Internet or from within an internal trusted subnet?
answer
IDS
question
Which of the following best describes an audit daemon?
answer
The trusted utility that runs a background process whenever auditing is enabled
question
If maintaining confidentiality is of the utmost importance to your organization, what is the best response when an intruder is detected on your network?
answer
Disconnect the intruder
question
An active IDS system often performs which of the following actions? (Select two)
answer
-Update filters to block suspect traffic -Perform reverse look ups to identify an intruder
