Sys Ops - Mod 5-4 Book Questions PT 1

Question 1

A CLI tool included with Red Hat Enterprise Linux is tcpdump.

Accepted Answer

True

Question 2

open-source, multi-platform, & lightweight IDS.designed to be comprehensive & accurate log malicious activ &notify admin

Accepted Answer

Snort

Question 3

IDS allows resource _ & _ to respond timely to covered devices that are compromised or in danger of being compromised.

Accepted Answer

custodians, proprietors

Question 4

There are both _ and _ based NIDS.

Accepted Answer

CLI, GUI

Question 5

Enabling _ would store the data on a system separate from where intrusion detection is being monitored.

Accepted Answer

log forwarding

Question 6

File integrity checking can only determine after-the-fact that a file has already been changed, sys binary replaced

Accepted Answer

True

Question 7

Signature-based and anomaly-based are mechanisms that separate benign traffic from its malicious brethren.

Accepted Answer

True

Question 8

_ work primarily by monitoring system logs & behavior & can be signature based (include rule sets) or anomaly based.

Accepted Answer

HIDS

Question 9

NIPSs typically placed _ w/your ntwk. It positions the NIPS in the packet flow & allows for real-time response to stop

Accepted Answer

“in-band”

Question 10

mainly a HIDS package,can use NIDS functions w/this tool. can be used as analytical utility to process data col by Snort

Accepted Answer

SolarWinds Security Event Manager

Question 11

NIDSs have become popular as the Internet grows in size and traffic.

Accepted Answer

True

Question 12

To be effective, IDS/IPS devices must not be tuned and monitored

Accepted Answer

False

Question 13

An agent w/a file sys shim can monitor all attempts to access critical files,such as sys binaries, & stop suspic efforts

Accepted Answer

File access attempts

Question 14

periodically gen message digests/other cryptographic checksums for crit files, comparing thm to reference values,&IDdiff

Accepted Answer

File integrity checking

Question 15

The purpose of the _ is to keep track of triggering events such as an HTTP request or a new TCP connection.

Accepted Answer

Event engine

Question 16

There are some extensions of this NIDS dichotomy to include distributed IDSs and comprehensive ESSs.

Accepted Answer

True

Question 17

Monitor current activity data to a known threat database, or compare it to a _ of normal activity previously

Accepted Answer

baseline

Question 18

The design philosophy of a NIDS is to scan network packets at the _, auditing packet information, & logging suspici pack

Accepted Answer

router or host-level

Question 19

Additionally, the Zeek IDS software uses two elements to work, Event engine and Policy scripts.

Accepted Answer

True

Question 20

NIPS solutions detect attacks based on signatures & anomaly-based behavior. NIPSs typically sit directly behind firewall

Accepted Answer

True

Question 21

It sniffs the traffic flowing through your network in what is called “out-of-band” or “promiscuous mode”.

Accepted Answer

True

Question 22

The _ also works with other systems, like a firewall, to help better protect against known attack sources

Accepted Answer

NIDS

Question 23

Intrusion det & prevention solut cld be physical hardware, virtual appliance, or software installed within a server OS.

Accepted Answer

True

Question 24

Intrusion detection can&#x27;t send notifications to administrators about suspicious activity.

Accepted Answer

False

Question 25

Zeek is a NIDS like Snort; however, it has a major advantage over the Snort system – this tool operates at the _ Layer.

Accepted Answer

Application

Question 26

In _ mode, the NIDS receives a copy of the packets instead of sitting in-band on the network.

Accepted Answer

promiscuous

Question 27

_ can provide additional detection by installing agents on monitored systems.

Accepted Answer

HIDS

Question 28

System call monitoring. Agent knows which apps & processes shld be calling other apps & processes or perform spec action

Accepted Answer

Code Analysis

Question 29

The _ can monitor incoming, outgoing, and local traffic.

Accepted Answer

NIDS

Question 30

Using a tool such as , we can see the large amounts of traffic flowing throughout a network:

Accepted Answer

tcpdump

Question 31

A free NIDS, it can do more than just detect intrusions. It can also perform a signature analysis.

Accepted Answer

Zeek

Question 32

With IDS, the detection part comes through _.

Accepted Answer

monitoring

Question 33

Some agents can monitor a host’s current ntwk config & detect changes to it. All ntwrk interfaces on host are monitored

Accepted Answer

Configuration monitoring

Question 34

Potential issues w/_ inc high-speed ntwk data overload, tuning difficulties, encryption,& signature development lagtime

Accepted Answer

NIDS

Question 35

The least expensive attack cost Demark based company, ISS World, $74 Million to recover & have full access systems again

Accepted Answer

False

Question 36

To put the importance of NIDS, in 2020 the avg recovery cost of a cyber-attack was $3.2 Million

Accepted Answer

True

Question 37

Most organizations use: Host(to secure critical host sys) & Network(to secure their network) Intrusion Detection Systems

Accepted Answer

True

Question 38

The safest rule is to assume that everything except legitimate traffic is an attack.

Accepted Answer

True

Question 39

It is best to _ the requests that you are not sure about & log some extra information so you can investigate it later.

Accepted Answer

accept

Question 40

However, the main distinction is the _ and _ of the IDS.

Accepted Answer

placement, goal

Question 41

periodically checking the attributes of important files, such as ownership and permissions, for changes & after-the-fact

Accepted Answer

File attribute checking

Question 42

On the other hand, _ are used to mine the event data

Accepted Answer

Policy scripts

Sys Ops - Mod 5-4 Book Questions PT 1

Questions 42

Sys Ops - Mod 5-4 Book Questions PT 1

Questions 42