Computer Security Quiz 8

An intruder can also be referred to as a hacker or cracker. T/F?

True

Intrusion detection is based on the assumption that the behavior of the intruder differs from that of a legitimate user in ways that can be quantified. T/F?

True

The primary purpose of an IDS is to detect intrusions, log suspicious events, and send alerts. T/F?

True

Signature-based approaches attempt to define normal, or expected, behavior, whereas anomaly approaches attempt to define proper behavior. T/F?

False

Anomaly detection has a low false alarm rate. T/F?

False

An inline sensor monitors a copy of network traffic; the actual traffic does not pass through the device. T/F?

False

Network-based intrusion detection makes use of signature detection and anomaly detection. T/F?

True

___ are either individuals or members of a larger group of outsider attackers who are motivated by social or political causes.

Activists

A ___ is the unauthorized act of bypassing the security mechanisms of a system.

Security intrusion

The __ is responsible for determining if an intrusion has occurred.

Analyzer

A (n) ____ is a hacker with minimal technical skill who primarily uses existing attack toolkits.

Beginner

The purpose of the __ module is to collect data on security-related events on the host and transmit these to the central manager.

Host agent

A(n) __ event is an alert that is generated when the gossip traffic enables a platform to conclude that an attack is underway.

DDI

A ___ honeypot is a software package that emulates particular IT services or systems well enough to provide a realistic initial interaction, but does not execute a full version of those services or systems.

Low-interaction

____ is a security service that monitors and analyzes system events for the purpose of finding, and providing real-time warning of attempts to access system resources in an unauthorized manner.

Intrusion detection

An IDS comprises three logical components: analyzers, user interface, and _____.

sensors

Copying a database containing credit card numbers, viewing sensitive data without authorization, and guessing and cracking passwords are examples of ___.

intrusion activity

__ detection techniques detect intrusion by observing events in the system and applying a set of rules that lead to a decision regarding whether a given pattern of activity is or is not suspicious.

Rule-based

A __ IDS monitors traffic at selected points on a network or interconnected set of networks.

Network-based

The functional components of an ___ are: data source, sensor, analyzer, administration, manager, and operator.

IDS