Chapter 7 Quiz

A false positive is the failure of an IDPS system to react to an actual attack event.

False

A padded cell is a hardened honeynet. _________________________

False

A passive IDPS response is a definitive action automatically initiated when certain types of alerts are triggered.

False

A passive vulnerability scanner is one that initiates traffic on the network in order to determine security holes.

False

A(n) NIDPS functions on the host system, where encrypted traffic will have been decrypted and is available for processing. _________________________

False

A(n) event is an indication that a system has just been attacked or is under attack. _________________________

False

A(n) server-based IDPS protects the server or host's information assets. _________________________

False

Administrators who are wary of using the same tools that attackers use should remember that a tool that can help close an open or poorly configured firewall will not help the network defender minimize the risk from attack.

False

All IDPS vendors target users with the same levels of technical and security expertise.

False

An HIDPS is optimized to detect multihost scanning, and it is able to detect the scanning of non-host network devices, such as routers or switches.

False

Enticement is the action of luring an individual into committing a crime to get a conviction. _________________________

False

In the process of protocol application verification, the NIDPSs look for invalid data packets. _________________________

False

Intrusion detection and prevention systems can deal effectively with switched networks.

False

Intrusion detection consists of procedures and systems that identify system intrusions and take action when an intrusion is detected.

False

NIDPSs can reliably ascertain whether an attack was successful.

False

Passive scanners are advantageous in that they require vulnerability analysts to get approval prior to testing.

False

Services using the TCP/IP protocol can run only on their commonly used port number as specified in their original Internet standard.

False

The disadvantages of using the honeypot or padded cell approach include the fact that the technical ​implications of using such devices are not well understood. _________________________

False

The primary advantages of a centralized IDPS control strategy are cost and ease of use. _________________________

False

The process by which attackers change the format and/or timing of their activities to avoid being detected by the IDPS is known as a false attack stimulus.

False

The process of entrapment occurs when an attacker changes the format and/or timing of activities to avoid being detected by an IDPS. _________________________

False

To use a packet sniffer legally, an administrator only needs permission of the organization's top computing executive.

False

When using trap-and-trace, the trace usually consists of a honeypot or padded cell and an alarm. _________________________

False

Your organization's operational goals, constraints, and culture should not affect the selection of the IDPS and other security tools and technologies to protect your systems.

False

Activities that scan network locales for active systems and then identify the network services offered by the host systems are known as __________.

fingerprinting

HIDPSs are also known as system integrity verifiers.

True

IDPS responses can be classified as active or passive.

True

In DNS cache poisoning, valid packets exploit poorly configured DNS servers to inject false information and corrupt the servers' answers to routine DNS queries from other systems on the network.

True

In order to determine which IDPS best meets an organization's needs, first consider the organizational environment in technical, physical, and political terms.

True

Intrusion detection and prevention systems perform monitoring and analysis of system events and user behaviors.

True

Once the OS is known, all of the vulnerabilities to which a system is susceptible can easily be determined.

True

Security tools that go beyond routine intrusion detection include honeypots, honeynets, and padded cell systems.

True

The Simple Network Management Protocol contains trap functions, which allow a device to send a message to the SNMP management console indicating that a certain threshold has been crossed, either positively or negatively.

True

The anomaly-based IDPS collects statistical summaries by observing traffic that is known to be normal.

True

To assist in footprint intelligence collection, attackers may use an enhanced Web scanner that, among other things, can scan entire Web sites for valuable pieces of information, such as server names and e-mail addresses.

True

When a collection of honeypots connects several honeypot systems on a subnet, it may be called a(n) honeynet. _________________________

True

Which of the following ports is commonly used for the HTTP protocol?

80

A(n) __________ IDPS is focused on protecting network information assets.

network-based

To determine whether an attack has occurred or is underway, NIDPSs compare measured activity to known __________ in their knowledge base.

signatures

In TCP/IP networking, port __________ is not used.

0

__________ benchmark and monitor the status of key system files and detect when an intruder creates, modifies, or deletes monitored files.

HIDPSs

A fully distributed IDPS control strategy is an IDPS implementation approach in which all control functions are applied at the physical location of each IDPS component.

True

A(n) log file monitor is similar to an NIDPS. _________________________

True

Alarm events that are accurate and noteworthy but do not pose significant threats to information security are called noise. _________________________

True

An HIDPS can detect local events on host systems and detect attacks that may elude a network-based IDPS.

True

An HIDPS can monitor system logs for predefined events.

True

An IDPS can be configured to dial a phone number and produce an alphanumeric page or other type of signal or message.

True

Some vulnerability scanners feature a class of attacks called _________, that are so dangerous they should only be used in a lab environment.

destructive

Network behavior analysis system __________ sensors are typically intended for network perimeter use, so they are deployed in close proximity to the perimeter firewalls, often between the firewall and the Internet border router to limit incoming attacks that could overwhelm the firewall.

inline

A(n) __________ is a software program or hardware appliance that can intercept, copy, and interpret network traffic.

packet sniffer