A. An electronic signature used to authenticate the identity of a user on the network
B. Attack-definition file
C. It refers to €?normal,€? baseline network behavior
D. It is used to authorize the users on a network

A. Rules are easy to define
B. Custom protocols can be easily analyzed
C. The engine can scale as the rule set grows
D. Malicious activity that falls within normal usage patterns is detected

A. An alert that indicates nefarious activity on a system that, upon further inspection, turns out to represent legitimate network traffic or behavior
B. An alert that indicates nefarious activity on a system that is not running on the network
C. The lack of an alert for nefarious activity
D. Both an alert that indicates nefarious activity on a system that, upon further inspection, turns out to represent legitimate network traffic or behavior and an alert that indicates nefarious activity on a system that is not running on the network

A. Inside the firewall
B. Outside the firewall
C. Both inside and outside the firewall
D. Neither inside the firewall nor outside the firewall.

A. To flag attacks against known vulnerabilities
B. To help reduce false positives in a signature-based ids
C. To randomly check suspicious traffic identified by an anomaly detection system
D. To enhance the accuracy of a traditional honeypot

A. Application layer and network layer
B. Network layer and session layer
C. Transport layer and application layer
D. Transport layer and network layer

A. Inspection of password files to detect inadvisable passwords
B. Mechanisms put in place to reenact known methods of attack and record system responses
C. Inspection of system to detect policy violations
D. Inspection of configuration files to detect inadvisable settings

A. Application layer and transport layer
B. Network layer and application layer
C. Session layer and transport layer
D. Application layer and session layer

A. Crossover error rate
B. False negative rate
C. False positive rate
D. Bit error rate

A. They alert administrators to deviations from €?normal” traffic behavior
B. They identify previously unknown attacks
C. The technology is mature and reliable enough to use on production networks
D. They scan network traffic or packets to identify matches with attack-definition files