Questions in Software

Generate Quick Response Code in Software Questions

1 What are the three types of event logs generated by Windows NT and 2000 systems A Event, Process, and Security B Application, User, and Security C User, Event, and Security D Application, System, and Security 2 What are the two main types of intrusion detection systems A Network-based and host-based B Signature-based and event-based C Active and reactive D Intelligent and passive

3 The first commercial, network-based IDS product was A Stalker B NetRanger C IDES D RealSecure 4 What are the two main types of IDS signatures A Network-based and file-based B Context-based and content-based C Active and reactive D None of the above 5 A passive, host-based IDS A Runs on the local system B Does not interact with the traffic around it C Can look at system event and error logs PART IV D All of the above 6 Which of the following is not a capability of network-based IDS A Can detect denial-of-service attacks B Can decrypt and read encrypted traffic C Can decode UDP and TCP packets D Can be tuned to a particular network environment 7 An active IDS can A Respond to attacks with TCP resets B Monitor for malicious activity C A and B D None of the above 8 Honeypots are used to A Attract attackers by simulating systems with open network services B Monitor network usage by employees C Process alarms from other IDSs D Attract customers to e-commerce sites 9 Egress filtering is used to detect SPAM that is A Coming into an organization B Sent from known spammers outside your organization

C Leaving an organization D Sent to mailing lists in your organization 10 Preventative intrusion detection systems A Are cheaper B Are designed to stop malicious activity from occurring C Can only monitor activity D Were the first types of IDS 11 Which of the following is not a type of proxy A Reverse B Web C Open D Simultaneous 12 IPS stands for A Intrusion processing system B Intrusion prevention sensor C Intrusion prevention system D Interactive protection system 13 A protocol analyzer can be used to A Troubleshoot network problems B Collect network traffic statistics C Monitor for suspicious traffic D All of the above 14 True or False: Windows Defender is available with every version of the Windows operating system A True B False 15 Heuristic scanning looks for A Normal network traffic patterns B Viruses and spam only C Firewall policy violations D Commands or instructions that are not normally found in application programs

1 D The three main types of event logs generated by Windows NT and 2000 systems are Application, System, and Security 2 A The two main types of intrusion detection systems are network-based and host-based Network-based systems monitor network connections for suspicious traffic Host-based systems reside on an individual system and monitor that system for suspicious or malicious activity 3 B The first commercial network-based IDS product was NetRanger, released by Wheelgroup in 1995 4 B The two main types of IDS signatures are context-based and content-based Context-based signatures examine traffic and how that traffic fits into the other traffic around it A port scan is a good example of a context-based signature A content-based signature looks at what is inside the traffic, such as the contents of a specific packet 5 D A passive, host-based IDS runs on the local system, cannot interfere with traffic or activity on that system, and would have access to local system logs PART IV 6 B A network-based IDS typically cannot decrypt and read encrypted traffic This is one of the principle weaknesses of network-based intrusion detection systems 7 C An active IDS can perform all the functions of a passive IDS (monitoring, alerting, reporting, and so on) with the added ability of responding to suspected attacks with capabilities such as sending TCP reset messages to the source and destination IP addresses 8 A Honeypots are designed to attract attackers by providing what appear to be easy, inviting targets The honeypot collects and records the activity of attackers and their tools 9 C Egress filtering is performed to detect and stop SPAM from leaving your organization Mail is checked as it leaves your organization 10 B Preventative intrusion detection systems are designed to prevent malicious actions from having any impact on the targeted system or network For example, a host-based preventative IDS may intercept an attacker's buffer overflow attempt and prevent it from executing By stopping the attack, the IDS prevents the attacker from affecting the system 11 D Reverse, Web, and Open are all types of proxies discussed in the chapter Simultaneous is not a type of known proxy 12 C IPS stands for intrusion prevention system