Test: Intrusion Detection Systems

Question 1

Which of the following is an advantage of anomaly detection?

Accepted Answer

The engine can scale as the rule set grows

Answer

Rules are easy to define

Answer

Custom protocols can be easily analyzed

Answer

Malicious activity that falls within normal usage patterns is detected

Question 2

A false positive can be defined as…

Accepted Answer

Both a. and b

Answer

An alert that indicates nefarious activity on a system that, upon further inspection, turns out to represent legitimate network traffic or behavior

Answer

An alert that indicates nefarious activity on a system that is not running on the network

Answer

The lack of an alert for nefarious activity

Question 3

One of the most obvious places to put an IDS sensor is near the firewall. Where exactly in relation to the firewall is the most productive placement?

Accepted Answer

Inside the firewall

Answer

Outside the firewall

Answer

Both inside and outside the firewall

Answer

Neither inside the firewall nor outside the firewall.

Question 4

What is the purpose of a shadow honeypot?

Accepted Answer

To randomly check suspicious traffic identified by an anomaly detection system

Answer

To flag attacks against known vulnerabilities

Answer

To help reduce false positives in a signature-based IDS

Answer

To enhance the accuracy of a traditional honeypot

Question 5

At which two traffic layers do most commercial IDSes generate signatures?

Accepted Answer

Question 6

An IDS follows a two-step process consisting of a passive component and an active component. Which of the following is part of the active component?

Accepted Answer

Mechanisms put in place to reenact known methods of attack and record system responses

Answer

Inspection of password files to detect inadvisable passwords

Answer

Inspection of system to detect policy violations

Answer

Inspection of configuration files to detect inadvisable settings

Question 7

When discussing IDS/IPS, what is a signature?

Accepted Answer

Attack-definition file

Answer

An electronic signature used to authenticate the identity of a user on the network

Answer

It refers to “normal,” baseline network behavior

Answer

None of the above

Question 8

“Semantics-aware” signatures automatically generated by Nemean are based on traffic at which two layers?

Accepted Answer

Question 9

Which of the following is used to provide a baseline measure for comparison of IDSes?

Accepted Answer

Crossover error rate

Answer

False negative rate

Answer

False positive rate

Answer

Bit error rate

Question 10

Which of the following is true of signature-based IDSes?

Accepted Answer

They scan network traffic or packets to identify matches with attack-definition files

Answer

They alert administrators to deviations from “normal” traffic behavior

Answer

They identify previously unknown attacks

Answer

The technology is mature and reliable enough to use on production networks

Intrusion Detection Systems - Free MCQ Practice Test with solutions, GATE

MCQ Practice Test & Solutions: Test: Intrusion Detection Systems (10 Questions)