Entrance Exams — Test 1

Correct Answer: B. B. Attack-definition file
Explanation: IDSes work in a manner similar to modern antivirus technology. They are constantly updated with attack-definition files (signatures) that describe each type of known malicious activity. Nemean is a popular signature generation method for conventional computer networks.

Correct Answer: C. C. The engine can scale as the rule set grows
Explanation: Once a protocol has been built and a behavior defined, the engine can scale more quickly and easily than the signature-based model because a new signature does not have to be created for every attack and potential variant.

Correct Answer: D. D. Both an alert that indicates nefarious activity on a system that, upon further inspection, turns out to represent legitimate network traffic or behavior and an alert that indicates nefarious activity on a system that is not running on the network
Explanation: A false positive is any alert that indicates nefarious activity on a system that, upon further inspection, turns out to represent legitimate network traffic or behavior.

Correct Answer: A. A. Inside the firewall
Explanation: There are legitimate political, budgetary and research reasons to want to see all the “attacks” against your connection, but given the care and feeding any IDS requires, do yourself a favor and keep your NIDS sensors on the inside of the firewall.

Correct Answer: C. C. To randomly check suspicious traffic identified by an anomaly detection system
Explanation: “Shadow honeypots,” as researchers call them, share all the same characteristics of protected applications running on both the server and client side of a network and operate in conjunction with an ADS.

Correct Answer: D. D. Transport layer and network layer
Explanation: Most commercial IDSes generate signatures at the network and transport layers. These signatures are used to ensure that no malicious operation is contained in the traffic. Nemean generates signature at application and session layer.

Correct Answer: B. B. Mechanisms put in place to reenact known methods of attack and record system responses
Explanation: Secondary components of mechanism are set in place to reenact known methods of attack and to record system responses. In passive components, the system I designed just to record the system’s responses in case of an intrusion.

Correct Answer: D. D. Application layer and session layer
Explanation: Nemean automatically generates “semantics-aware” signatures based on traffic at the session and application layers. These signatures are used to ensure that no malicious operation is contained in the traffic.

Correct Answer: A. A. Crossover error rate
Explanation: As the sensitivity of systems may cause the false positive/negative rates to vary, it’s critical to have some common measure that may be applied across the board.

Correct Answer: D. D. They scan network traffic or packets to identify matches with attack-definition files
Explanation: They are constantly updated with attack-definition files (signatures) that describe each type of known malicious activity. They then scan network traffic for packets that match the signatures, and then raise alerts to security administrators.