Ch. 7 IDS - Intrusion Detection System
____ are capable of identifying active computers on a network. - ANS-Port Scanners
\____ firewalls are network devices that examine every incoming and outgoing packet's
header, selectively allowing or rejecting packets based on the header information. -
ANS-Packet filtering
\____ is NOT a packet header component that is most commonly examined by a packet
filtering firewall. - ANS-MAC source and destination address
\_____________________ are decoy systems designed to lure potential attackers away
from critical systems. - ANS-honeypots
\____________=single system
____________=network
__ __=hardened honeypot - ANS-Honeypot
Honeynet
Padded Cell
\____, also known as proxy servers, often consists of dedicated computers kept separate
from the first filtering router and are commonly used in conjunction with a second or internal
filtering router. - ANS-Application-level firewalls
\(T/F) An intrusion detection and prevention device denies access to a system by default -
ANS-False
\A ____ intrusion detection and prevention system can monitor multiple computers
simultaneously. - ANS-Host-based
\A ____ intrusion detection and prevention system is also known as a behavior-based
intrusion detection system. - ANS-Statistical anomaly-based
\A ____ is a network channel connection point in a data communications system. - ANS-Port
\A _____________________ IDPS resides on a particular computer or server, known as the
host, and monitors activity only on that system. - ANS-host-based
\A firewall should never be directly accessible from - ANS-The public network
\A firewall uses its ____ to decide whether or not to allow packets into the network. -
ANS-Configuration rules
\A vulnerability queries services to determine: - ANS--Version Info
-Active Users
-Available local resources
-Additional packages that are being used
\A/n _____________________ IDPS examines network traffic in search of patterns that
match known signatures. - ANS-signature-based
\A/n _____________________ IDPS resides on a computer or appliance connected to a
segment of an organization's network and monitors network traffic on that network segment.
- ANS-network-based
\Fourth generation firewalls, know as ____, allow only specific packets with a particular
source, destination, and port address to pass through it. - ANS-Dynamic packet filtering
firewalls
\Give an example of what a honeypot would consist of - ANS-An area of network site is set
up to appear to be a legitimate part of the site. It seems to contain info or resources of value
____ are capable of identifying active computers on a network. - ANS-Port Scanners
\____ firewalls are network devices that examine every incoming and outgoing packet's
header, selectively allowing or rejecting packets based on the header information. -
ANS-Packet filtering
\____ is NOT a packet header component that is most commonly examined by a packet
filtering firewall. - ANS-MAC source and destination address
\_____________________ are decoy systems designed to lure potential attackers away
from critical systems. - ANS-honeypots
\____________=single system
____________=network
__ __=hardened honeypot - ANS-Honeypot
Honeynet
Padded Cell
\____, also known as proxy servers, often consists of dedicated computers kept separate
from the first filtering router and are commonly used in conjunction with a second or internal
filtering router. - ANS-Application-level firewalls
\(T/F) An intrusion detection and prevention device denies access to a system by default -
ANS-False
\A ____ intrusion detection and prevention system can monitor multiple computers
simultaneously. - ANS-Host-based
\A ____ intrusion detection and prevention system is also known as a behavior-based
intrusion detection system. - ANS-Statistical anomaly-based
\A ____ is a network channel connection point in a data communications system. - ANS-Port
\A _____________________ IDPS resides on a particular computer or server, known as the
host, and monitors activity only on that system. - ANS-host-based
\A firewall should never be directly accessible from - ANS-The public network
\A firewall uses its ____ to decide whether or not to allow packets into the network. -
ANS-Configuration rules
\A vulnerability queries services to determine: - ANS--Version Info
-Active Users
-Available local resources
-Additional packages that are being used
\A/n _____________________ IDPS examines network traffic in search of patterns that
match known signatures. - ANS-signature-based
\A/n _____________________ IDPS resides on a computer or appliance connected to a
segment of an organization's network and monitors network traffic on that network segment.
- ANS-network-based
\Fourth generation firewalls, know as ____, allow only specific packets with a particular
source, destination, and port address to pass through it. - ANS-Dynamic packet filtering
firewalls
\Give an example of what a honeypot would consist of - ANS-An area of network site is set
up to appear to be a legitimate part of the site. It seems to contain info or resources of value
