One of the most obvious places to put an IDS sensor is near the firewall. Where exactly in relation to the firewall is the most productive placement?

• A. Inside the firewall
• B. Outside the firewall
• C. Both inside and outside the firewall
• D. Neither inside the firewall nor outside the firewall.

What is the purpose of a shadow honeypot?

• A. To flag attacks against known vulnerabilities
• B. To help reduce false positives in a signature-based ids
• C. To randomly check suspicious traffic identified by an anomaly detection system
• D. To enhance the accuracy of a traditional honeypot

At which two traffic layers do most commercial IDSes generate signatures?

• A. Application layer and network layer
• B. Network layer and session layer
• C. Transport layer and application layer
• D. Transport layer and network layer

IDS follows a two-step process consisting of a passive component and an active component. Which of the following is part of the active component?

• A. Inspection of password files to detect inadvisable passwords
• B. Mechanisms put in place to reenact known methods of attack and record system responses
• C. Inspection of system to detect policy violations
• D. Inspection of configuration files to detect inadvisable settings

“Semantics-aware” signatures automatically generated by Nemean are based on traffic at which two layers?

• A. Application layer and transport layer
• B. Network layer and application layer
• C. Session layer and transport layer
• D. Application layer and session layer

Which of the following is used to provide a baseline measure for comparison of IDSes?

• A. Crossover error rate
• B. False negative rate
• C. False positive rate
• D. Bit error rate

Which of the following is true of signature-based IDSes?

• A. They alert administrators to deviations from €?normal” traffic behavior
• B. They identify previously unknown attacks
• C. The technology is mature and reliable enough to use on production networks
• D. They scan network traffic or packets to identify matches with attack-definition files

Both HDLC and PPP are Data link layer protocols.

• A. True
• B. False
• C.
• D.

Which protocol does the PPP protocol provide for handling the capabilities of the connection/link on the network?

• A. Lcp
• B. Ncp
• C. Both lcp and ncp
• D. Tcp

The PPP protocol _________

• A. Is designed for simple links which transport packets between two peers
• B. Is one of the protocols for making an internet connection over a phone line
• C. Is designed for simple links which transport packets between two peers and making an internet connection over a phone line
• D. Is used for sharing bandwidth