5-2

Question 1

there are 6 basic approaches to IDS and IPS. some of these methods are implimented in various software packages and other are simply strategies that an organization can employ to decrease the likelihood of a ___________

Answer 1

successful intrusion

Question 2

when ids was first developed _________ were generally used

Answer 2

hubs

Question 3

with a hub a packet is sent from its _________________ via the IP address. when it arrives at its target network . then a mac address is used to find the target. be aware that all computers on this segment can see the packet, but since the mac address doesn’t match the other computers can ignore it.

Answer 3

source network to its destination network

Question 4

sometimes called banishment vigilance, seeks to prevent intrusions before they occur. but can be complicated since it could block legitimate traffic

Answer 4

preemptive blocking

Question 5

normally a software system will alert the administrator of suspicious. a human administrator will then decide whether or not to ______________. the preemptive looking technique should only be part of an overall intrusion detection strategy

Answer 5

block traffic

Question 6

anomalies are detected in one of a few ways including

Answer 6

threshold monitoring
resource profiling
user/group work profiling
executable profiling

Question 7

this technique involves actual software that works to detect intrusion attempts and notify the administrator

Answer 7

anomoly detection

Question 8

this technique monitors preset acceptable behavior levels and observes whether these levels are exceeded

Answer 8

threshold monitoring

Question 9

threshold provides a definition of __________ behavior

Answer 9

acceptable

Question 10

indications of abnormal resource usage with resource profiling can be indicative of ____________

Answer 10

illicate activity

Question 11

the enables the ids to id activity that might indicate an attack. once a potential danger is identified, the admin is contacted.

Answer 11

executalbe profiling

Question 12

_______ is an element of data source that is of interest to the operator

Answer 12

activity

Question 13

the ____________ is the person responsible for organizational security

Answer 13

administrator

Question 14

the ids component that collects data and passes it to the analyzer for analysis

Answer 14

sensor

Question 15

the component or process that analyzes the data collected by the sensor

Answer 15

analyzer